Edit tour

Windows Analysis Report
diCTAJuHTs.exe

Overview

General Information

Sample name:	diCTAJuHTs.exe renamed because original name is a hash value
Original sample name:	9ecab398729b9a2e9d1c843707c40054.exe
Analysis ID:	1580282
MD5:	9ecab398729b9a2e9d1c843707c40054
SHA1:	282b755423a18cf801f013694b9d4a4ff04a0d78
SHA256:	68a7291a46870781bb9088ac64e7890087eb5ca851973c0d8d0b7566e650eabc
Tags:	exeuser-abuse_ch
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE file contains sections with non-standard names

Program does not show much activity (idle)

Classification

Process Tree

System is w10x64

diCTAJuHTs.exe (PID: 7120 cmdline: "C:\Users\user\Desktop\diCTAJuHTs.exe" MD5: 9ECAB398729B9A2E9D1C843707C40054)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: diCTAJuHTs.exe	Virustotal: Detection: 37%			Perma Link
Source: diCTAJuHTs.exe	ReversingLabs: Detection: 42%

Source: diCTAJuHTs.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Code function: 0_2_00007FF7DDF2C06C _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,	0_2_00007FF7DDF2C06C
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Code function: 0_2_00007FF7DDF21DAC _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF7DDF21DAC
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Code function: 0_2_00007FF7DDF21DAC _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF7DDF21DAC

Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Code function: 0_2_00007FF7DDF2FF2C	0_2_00007FF7DDF2FF2C
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Code function: 0_2_00007FF7DDF19760	0_2_00007FF7DDF19760
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Code function: 0_2_00007FF7DDF11B80	0_2_00007FF7DDF11B80
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Code function: 0_2_00007FF7DDF17FCC	0_2_00007FF7DDF17FCC
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Code function: 0_2_00007FF7DDF22BE0	0_2_00007FF7DDF22BE0
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Code function: 0_2_00007FF7DDF287F4	0_2_00007FF7DDF287F4
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Code function: 0_2_00007FF7DDF1E80C	0_2_00007FF7DDF1E80C
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Code function: 0_2_00007FF7DDF30010	0_2_00007FF7DDF30010
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Code function: 0_2_00007FF7DDF33C18	0_2_00007FF7DDF33C18
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Code function: 0_2_00007FF7DDF2B13C	0_2_00007FF7DDF2B13C
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Code function: 0_2_00007FF7DDF1A060	0_2_00007FF7DDF1A060
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Code function: 0_2_00007FF7DDF2C06C	0_2_00007FF7DDF2C06C
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Code function: 0_2_00007FF7DDF2E0C0	0_2_00007FF7DDF2E0C0
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Code function: 0_2_00007FF7DDF2E4EC	0_2_00007FF7DDF2E4EC
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Code function: 0_2_00007FF7DDF1790D	0_2_00007FF7DDF1790D
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Code function: 0_2_00007FF7DDF2B13C	0_2_00007FF7DDF2B13C
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Code function: 0_2_00007FF7DDF1E5A4	0_2_00007FF7DDF1E5A4
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Code function: 0_2_00007FF7DDF21DAC	0_2_00007FF7DDF21DAC
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Code function: 0_2_00007FF7DDF26DE0	0_2_00007FF7DDF26DE0
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Code function: 0_2_00007FF7DDF29200	0_2_00007FF7DDF29200
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Code function: 0_2_00007FF7DDF30A18	0_2_00007FF7DDF30A18
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Code function: 0_2_00007FF7DDF24684	0_2_00007FF7DDF24684
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Code function: 0_2_00007FF7DDF17AA4	0_2_00007FF7DDF17AA4
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Code function: 0_2_00007FF7DDF302A4	0_2_00007FF7DDF302A4
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Code function: 0_2_00007FF7DDF162D0	0_2_00007FF7DDF162D0
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Code function: 0_2_00007FF7DDF182D8	0_2_00007FF7DDF182D8
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Code function: 0_2_00007FF7DDF21DAC	0_2_00007FF7DDF21DAC
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Code function: 0_2_00007FF7DDF20700	0_2_00007FF7DDF20700

Source: C:\Users\user\Desktop\diCTAJuHTs.exe

Code function: String function: 00007FF7DDF12760 appears 41 times

Source: classification engine

Classification label: mal48.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\diCTAJuHTs.exe

Code function: 0_2_00007FF7DDF16FA0 GetLastError,FormatMessageW,WideCharToMultiByte,

0_2_00007FF7DDF16FA0

Source: diCTAJuHTs.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\diCTAJuHTs.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: diCTAJuHTs.exe	Virustotal: Detection: 37%
Source: diCTAJuHTs.exe	ReversingLabs: Detection: 42%

Source: C:\Users\user\Desktop\diCTAJuHTs.exe

File read: C:\Users\user\Desktop\diCTAJuHTs.exe

Jump to behavior

Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Section loaded: wintypes.dll	Jump to behavior

Source: diCTAJuHTs.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: diCTAJuHTs.exe

Static file information: File size 14444897 > 1048576

Source: diCTAJuHTs.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: diCTAJuHTs.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: diCTAJuHTs.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: diCTAJuHTs.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: diCTAJuHTs.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: diCTAJuHTs.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: diCTAJuHTs.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: diCTAJuHTs.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: diCTAJuHTs.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: diCTAJuHTs.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: diCTAJuHTs.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: diCTAJuHTs.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: diCTAJuHTs.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: diCTAJuHTs.exe

Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\diCTAJuHTs.exe

Code function: 0_2_00007FF7DDF13C90 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00007FF7DDF13C90

Source: C:\Users\user\Desktop\diCTAJuHTs.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-15779

Source: C:\Users\user\Desktop\diCTAJuHTs.exe

API coverage: 6.7 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Code function: 0_2_00007FF7DDF2C06C _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,	0_2_00007FF7DDF2C06C
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Code function: 0_2_00007FF7DDF21DAC _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF7DDF21DAC
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Code function: 0_2_00007FF7DDF21DAC _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF7DDF21DAC

Source: diCTAJuHTs.exe

Binary or memory string: jqEMu

Source: C:\Users\user\Desktop\diCTAJuHTs.exe

Code function: 0_2_00007FF7DDF25750 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF7DDF25750

Source: C:\Users\user\Desktop\diCTAJuHTs.exe

Code function: 0_2_00007FF7DDF2DB48 GetProcessHeap,

0_2_00007FF7DDF2DB48

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Code function: 0_2_00007FF7DDF25750 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7DDF25750
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Code function: 0_2_00007FF7DDF1B0C4 SetUnhandledExceptionFilter,	0_2_00007FF7DDF1B0C4
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Code function: 0_2_00007FF7DDF1A8DC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7DDF1A8DC
Source: C:\Users\user\Desktop\diCTAJuHTs.exe	Code function: 0_2_00007FF7DDF1AEE0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7DDF1AEE0

Source: C:\Users\user\Desktop\diCTAJuHTs.exe

Code function: 0_2_00007FF7DDF33A60 cpuid

0_2_00007FF7DDF33A60

Source: C:\Users\user\Desktop\diCTAJuHTs.exe

Code function: 0_2_00007FF7DDF1ADC8 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF7DDF1ADC8

Source: C:\Users\user\Desktop\diCTAJuHTs.exe

Code function: 0_2_00007FF7DDF30010 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF7DDF30010

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 DLL Side-Loading	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	13 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
diCTAJuHTs.exe	38%	Virustotal		Browse
diCTAJuHTs.exe	42%	ReversingLabs	Win64.Trojan.Generic

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580282
Start date and time:	2024-12-24 08:45:58 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	diCTAJuHTs.exe renamed because original name is a hash value
Original Sample Name:	9ecab398729b9a2e9d1c843707c40054.exe
Detection:	MAL
Classification:	mal48.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 25 Number of non-executed functions: 70
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Report size getting too big, too many NtSetInformationFile calls found.

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.9966455409097
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	diCTAJuHTs.exe
File size:	14'444'897 bytes
MD5:	9ecab398729b9a2e9d1c843707c40054
SHA1:	282b755423a18cf801f013694b9d4a4ff04a0d78
SHA256:	68a7291a46870781bb9088ac64e7890087eb5ca851973c0d8d0b7566e650eabc
SHA512:	e99e4437c12d443f6458d337453ef829b209a0b68d0df64ba1fd3db26854552eae18fe1bf263c0b31c319fcc6ab766b3accb96b093b3000e89fb1e28a463e09c
SSDEEP:	393216:bSatY8L2Vmd6melh2pOc/e+7G99YP0BmRFN+MebJ:bSai8yVmdKQpOun0ApiJ
TLSH:	ABE6334053A00BD8F46A883388779517EB76F4AA579BDB8F875186600FB32FB9D71390
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'X.8c9.kc9.kc9.kwR.jh9.kwR.jd9.kwR.j.9.k.V#kg9.k1L.jE9.k1L.jr9.k1L.jj9.kwR.jh9.kc9.k.9.k.L.jp9.k.L.jb9.kRichc9.k...............

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x14000a8c8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6750E25E [Wed Dec 4 23:14:38 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	c5640c7a22008f949f9bc94a27623f95

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FE8FC61AA6Ch
dec eax
add esp, 28h
jmp 00007FE8FC61A3EFh
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [0001A8D3h]
dec eax
mov ecx, ebx
call dword ptr [0001A8C2h]
call dword ptr [0001A83Ch]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [0001A8B8h]
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 38h
mov ecx, 00000017h
call dword ptr [0001A8ACh]
test eax, eax
je 00007FE8FC61A579h
mov ecx, 00000002h
int 29h
dec eax
lea ecx, dword ptr [0003B6DAh]
call 00007FE8FC61A73Eh
dec eax
mov eax, dword ptr [esp+38h]
dec eax
mov dword ptr [0003B7C1h], eax
dec eax
lea eax, dword ptr [esp+38h]
dec eax
add eax, 08h
dec eax
mov dword ptr [0003B751h], eax
dec eax
mov eax, dword ptr [0003B7AAh]
dec eax
mov dword ptr [0003B61Bh], eax
dec eax
mov eax, dword ptr [esp+40h]
dec eax
mov dword ptr [0003B71Fh], eax
mov dword ptr [0003B5F5h], C0000409h
mov dword ptr [0003B5EFh], 00000001h
mov dword ptr [0003B5F9h], 00000001h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x35b18	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4b000	0x5fc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x48000	0x1de8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4c000	0x748	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x33920	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x33940	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x25000	0x3e8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x235d0	0x23600	050ad070d74c0ab2baca6ee9c3b61b5d	False	0.5690426236749117	data	6.471510843579973	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x25000	0x11898	0x11a00	41b70ae4502758e24e137cafe311eeb7	False	0.4956504875886525	PGP symmetric key encrypted data - Plaintext or unencrypted data	5.711786264889031	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x37000	0x10398	0xc00	b88590ca230f956ba7b5bffcbee69475	False	0.138671875	data	1.8589891596226968	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x48000	0x1de8	0x1e00	626ab1518bc3687e03dacd39bbfde649	False	0.4921875	data	5.392285019157171	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x4a000	0xf4	0x200	3fa4bb815d2865eb13ca6b140ccf210f	False	0.302734375	data	1.9616758456060694	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x4b000	0x5fc	0x600	e9f38e874665b2f0eec96d08193b0b48	False	0.4609375	data	5.4060894423190256	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x4c000	0x748	0x800	ab10229e6319ea5b4dde9f2a80ec60f0	False	0.55322265625	data	5.222259043944798	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4b058	0x5a2	XML 1.0 document, ASCII text, with CRLF line terminators			0.45145631067961167

Imports

DLL	Import
USER32.dll	CreateWindowExW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	GetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, FlushFileBuffers, GetCurrentDirectoryW, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, GetLastError, SetDllDirectoryW, GetModuleFileNameW, GetProcAddress, GetEnvironmentStringsW, GetEnvironmentVariableW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, CreateDirectoryW, GetTempPathW, WaitForSingleObject, Sleep, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LoadLibraryExW, CloseHandle, GetCurrentProcess, LocalFree, FormatMessageW, MultiByteToWideChar, WideCharToMultiByte, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, GetCommandLineW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, RaiseException, GetCommandLineA, CreateFileW, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetFullPathNameW, RemoveDirectoryW, FindClose, FindFirstFileExW, FindNextFileW, SetStdHandle, SetConsoleCtrlHandler, DeleteFileW, ReadFile, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, CompareStringW, LCMapStringW
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Target ID:	0
Start time:	02:46:48
Start date:	24/12/2024
Path:	C:\Users\user\Desktop\diCTAJuHTs.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\diCTAJuHTs.exe"
Imagebase:	0x7ff7ddf10000
File size:	14'444'897 bytes
MD5 hash:	9ECAB398729B9A2E9D1C843707C40054
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	41

Executed Functions

Function 00007FF7DDF117A0 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fread_nolock.LIBCMT ref: 00007FF7DDF1184C
_fread_nolock.LIBCMT ref: 00007FF7DDF118FE

Part of subcall function 00007FF7DDF1C954: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF1C968

Part of subcall function 00007FF7DDF12760: MessageBoxW.USER32 ref: 00007FF7DDF12831

Strings

Could not read full TOC!, xrefs: 00007FF7DDF11909
MEI, xrefs: 00007FF7DDF117DF
Cannot read Table of Contents., xrefs: 00007FF7DDF11985
Error on file., xrefs: 00007FF7DDF1192D
fread, xrefs: 00007FF7DDF1185E
malloc, xrefs: 00007FF7DDF118DA
Failed to seek to cookie position!, xrefs: 00007FF7DDF1181F
Failed to read cookie!, xrefs: 00007FF7DDF11857
Could not allocate buffer for TOC!, xrefs: 00007FF7DDF118D3
fseek, xrefs: 00007FF7DDF11826

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: _fread_nolock$Message_invalid_parameter_noinfo
String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
API String ID: 2153230061-4158440160
Opcode ID: a4e21bfb9890b1ab93ab310f7ac99d02a10967d8f8de6a41bf0c38dfa70191e7
Instruction ID: 69ecdabddc0b1e03575cac81605914108fc3c1d8ae547456295d97e5526f8542
Opcode Fuzzy Hash: a4e21bfb9890b1ab93ab310f7ac99d02a10967d8f8de6a41bf0c38dfa70191e7
Instruction Fuzzy Hash: D4517D72A0D60686EB54EF28D45027CB3A0FB88B58BD18137D92D87399EF7CE544C760

Function 00007FF7DDF30F7C Relevance: 13.8, APIs: 9, Instructions: 273
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7DDF30CAC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF30CED
Part of subcall function 00007FF7DDF30CAC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF30D6D
Part of subcall function 00007FF7DDF30CAC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF30DC1
Part of subcall function 00007FF7DDF30CAC: _get_daylight.LIBCMT ref: 00007FF7DDF30E19

CreateFileW.KERNELBASE ref: 00007FF7DDF31082
CreateFileW.KERNEL32 ref: 00007FF7DDF310D2
GetLastError.KERNEL32 ref: 00007FF7DDF31102
GetFileType.KERNELBASE ref: 00007FF7DDF31117
GetLastError.KERNEL32 ref: 00007FF7DDF31121
CloseHandle.KERNEL32 ref: 00007FF7DDF31154
CloseHandle.KERNEL32 ref: 00007FF7DDF312AF
CreateFileW.KERNEL32 ref: 00007FF7DDF312E4
GetLastError.KERNEL32 ref: 00007FF7DDF312F3

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type_get_daylight
String ID:
API String ID: 1330151763-0
Opcode ID: d121c7e434188e1b59c11ae7c5eb2a34e011b9b37a129bdee774847c0c4b5b89
Instruction ID: 7095c6657b689dd8ea34a6a5cad0fe4d80ff329a23e7a77fbbf1fcfa0256d42d
Opcode Fuzzy Hash: d121c7e434188e1b59c11ae7c5eb2a34e011b9b37a129bdee774847c0c4b5b89
Instruction Fuzzy Hash: 8AC1C337B28A4286EB10EF68C4901AC7761FB49B98B914236DE2E977D4EF78D551C320

Function 00007FF7DDF11000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 274
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7DDF13A40: GetModuleFileNameW.KERNEL32(?,00007FF7DDF1353B), ref: 00007FF7DDF13A71

SetDllDirectoryW.KERNEL32 ref: 00007FF7DDF13747

Part of subcall function 00007FF7DDF164E0: GetEnvironmentVariableW.KERNEL32(00007FF7DDF13589), ref: 00007FF7DDF1651A
Part of subcall function 00007FF7DDF164E0: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7DDF16537

Strings

Cannot open PyInstaller archive from executable (%s) or external archive (%s), xrefs: 00007FF7DDF13630
_MEIPASS2, xrefs: 00007FF7DDF13575, 00007FF7DDF135DE, 00007FF7DDF1388B, 00007FF7DDF1389B
Failed to convert DLL search path!, xrefs: 00007FF7DDF1372F
MEI, xrefs: 00007FF7DDF13689
Cannot side-load external archive %s (code %d)!, xrefs: 00007FF7DDF136CE
_PYI_ONEDIR_MODE, xrefs: 00007FF7DDF1359E, 00007FF7DDF135C9

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
API String ID: 2344891160-3602715111
Opcode ID: 81b65a4905ddbf8ee23dfcbb140cb81087030596d11c06d7e09b8ead5103a781
Instruction ID: a8ec140f16ed3ca7292c17de3b45ddbdd9c7df9ff776b3295a7f45d6ef8012e8
Opcode Fuzzy Hash: 81b65a4905ddbf8ee23dfcbb140cb81087030596d11c06d7e09b8ead5103a781
Instruction Fuzzy Hash: ECB17061A1CA8355EA24FB2194512FDA7A0BF947C8FC44133EA6D4779AFE2CE605C730

Function 00007FF7DDF26408 Relevance: 10.8, APIs: 7, Instructions: 291
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF2683E

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6d76600332cd51621babe51080adacafe0eb3a98da8a3fe18a99b7ec18543619
Instruction ID: d99335d6a16656109ead00d9292609770a8029256919ccae395884a6312403e6
Opcode Fuzzy Hash: 6d76600332cd51621babe51080adacafe0eb3a98da8a3fe18a99b7ec18543619
Instruction Fuzzy Hash: 31C1D322A0C78682E660BB15A4402BEFF61EF80B84FD54133DA6D87795FE7CE855C760

Function 00007FF7DDF1A754 Relevance: 7.6, APIs: 5, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF7DDF1A763

Part of subcall function 00007FF7DDF1ABB4: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7DDF1ABD6

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7DDF1A778
__scrt_release_startup_lock.LIBCMT ref: 00007FF7DDF1A7E6
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7DDF1A839
__scrt_is_managed_app.LIBCMT ref: 00007FF7DDF1A85C

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock
String ID:
API String ID: 4144305933-0
Opcode ID: 702f7c832cf0ba87b5ff8a943f0597e04a247d80620e40057ef95aeb345a1c99
Instruction ID: 703eceab95abef03ff169053490912d938d24e45361a0203fd8ae9439da2d49d
Opcode Fuzzy Hash: 702f7c832cf0ba87b5ff8a943f0597e04a247d80620e40057ef95aeb345a1c99
Instruction Fuzzy Hash: B3314B22E0C50385FA24BB61E4213BDB691AF91794FC44037E97D4B2D7FE6DB9068231

Function 00007FF7DDF12760 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7DDF17490: MultiByteToWideChar.KERNEL32 ref: 00007FF7DDF174CA

MessageBoxW.USER32 ref: 00007FF7DDF12831
MessageBoxA.USER32 ref: 00007FF7DDF1284D

Strings

Fatal error detected, xrefs: 00007FF7DDF12805, 00007FF7DDF1283F

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Fatal error detected
API String ID: 1878133881-4025702859
Opcode ID: 2b61138d8ba7e34161e8adb61536ce26b4d2be66a0e24b62ca542749820394dc
Instruction ID: 6d9a4bb8861fd32dbec2df8b35dccf3b0424e6e4c60d630e6353ab0042b136b3
Opcode Fuzzy Hash: 2b61138d8ba7e34161e8adb61536ce26b4d2be66a0e24b62ca542749820394dc
Instruction Fuzzy Hash: B921887262C68281EB30A710F4517EEA354FB94788FC44137EA9D47A99EF3CD205C760

Function 00007FF7DDF24394 Relevance: 4.5, APIs: 3, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF7DDF24393), ref: 00007FF7DDF243BD
TerminateProcess.KERNEL32(?,?,?,00007FF7DDF24393), ref: 00007FF7DDF243C8
ExitProcess.KERNEL32 ref: 00007FF7DDF243D7

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: f5bd35b994d705466abf85fcadaa355dadbc0a36878a45ce859ff20c5e8e7d7d
Instruction ID: 5407be2cbfb1ee8763bccbff89224d35f9b5e54fb2400c7ae0c6eb649b5c8ced
Opcode Fuzzy Hash: f5bd35b994d705466abf85fcadaa355dadbc0a36878a45ce859ff20c5e8e7d7d
Instruction Fuzzy Hash: 13E04820B0D70552F71477309C9527D66555F95741FD1553ADC2E82352FDBDF8848320

Function 00007FF7DDF1C980 Relevance: 3.2, APIs: 2, Instructions: 175
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF1C9BC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF1CAB9

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 418abc046f0238a7e4161840f51ccb75892871292d6ebbe86ace378d7f50b21f
Instruction ID: 58a1bdeae3656c1f81f53e1a4a64eeb813f027064c4b2a201bc99dd289bad99e
Opcode Fuzzy Hash: 418abc046f0238a7e4161840f51ccb75892871292d6ebbe86ace378d7f50b21f
Instruction Fuzzy Hash: AE51D522B0D24185F629FE25981077EEA92BF44BA8FC44232DE7D577D9EE3CE4119630

Function 00007FF7DDF26ABC Relevance: 3.0, APIs: 2, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(?,?,?,00007FF7DDF277DF,?,?,?,?,?,?,?,?,?,?,?,00007FF7DDF27707), ref: 00007FF7DDF26B00
GetLastError.KERNEL32(?,?,?,00007FF7DDF277DF,?,?,?,?,?,?,?,?,?,?,?,00007FF7DDF27707), ref: 00007FF7DDF26B0A

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 1070729c18fb5a550bb7979bd9dd777fb7470f3e740498ab44d3ee6d69d9d9f5
Instruction ID: af7d47877b18c59c84507cf960d94e5d69c0cfbc1af4d0e0597e640ba1556a25
Opcode Fuzzy Hash: 1070729c18fb5a550bb7979bd9dd777fb7470f3e740498ab44d3ee6d69d9d9f5
Instruction Fuzzy Hash: 5701C462B1CA8281EA10AB25E84407DA651AF84BF4FD44333EA3E4B7D4FF7CD4958710

Function 00007FF7DDF25B24 Relevance: 2.6, APIs: 2, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF7DDF25A57,?,?,00000000,00007FF7DDF25AFF,?,?,?,?,?,?,00007FF7DDF1C892), ref: 00007FF7DDF25B8A
GetLastError.KERNEL32(?,?,?,00007FF7DDF25A57,?,?,00000000,00007FF7DDF25AFF,?,?,?,?,?,?,00007FF7DDF1C892), ref: 00007FF7DDF25B94

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 482a02ddfad1f0d1748aaf476af5d25a2817b8fdf229cc618c88afa72f650b78
Instruction ID: 2c3e2e1b86336a62b5a3b4dc745b107378644e9b9d9a7ce34342cbad0cf388a6
Opcode Fuzzy Hash: 482a02ddfad1f0d1748aaf476af5d25a2817b8fdf229cc618c88afa72f650b78
Instruction Fuzzy Hash: 77118621F0C64241FEA4776499A537D9A829F847A8FD84637DA3D873C2FE6CE4848320

Function 00007FF7DDF26860 Relevance: 1.6, APIs: 1, Instructions: 104
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF26888

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c5dd71678ec1c3fccfd7b12bb33d50ac5b5a91bc82f8ec354b455621dbb7ad32
Instruction ID: ec9a8720d545e5955443cb8a49ac3a0e9eed706925a59436a625c885f8189ab5
Opcode Fuzzy Hash: c5dd71678ec1c3fccfd7b12bb33d50ac5b5a91bc82f8ec354b455621dbb7ad32
Instruction Fuzzy Hash: 7E41D132A1D20587EA14EB18D64027CBBA0FB55B58FC00132DBADC7790FF69E462C7A1

Function 00007FF7DDF2309C Relevance: 1.6, APIs: 1, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF230BE

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 18b213fde59874ac87f85e5de4d39c2b719f2023920e8f19be70c6083ce6ebcb
Instruction ID: 7d0b132d4df9a5e702b90d4d4aa7d294acdbb9ac4b0dc7dd102bd1cc80923999
Opcode Fuzzy Hash: 18b213fde59874ac87f85e5de4d39c2b719f2023920e8f19be70c6083ce6ebcb
Instruction Fuzzy Hash: 7631B262E0CA4691EA10AA25C45537CABD09F41FD8FC4413BC92D8B7D5FF2CE8458361

Function 00007FF7DDF16CF0 Relevance: 1.6, APIs: 1, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fread_nolock.LIBCMT ref: 00007FF7DDF16D9A

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 9a14401c5a825ed978c4862b406d3329acfe2ce1b9a010578fd99a48839cd6ad
Instruction ID: 3ab9af4eb6754eeaf76326955d0a15e1cdb7c76ee04b91775f347ed21daee38c
Opcode Fuzzy Hash: 9a14401c5a825ed978c4862b406d3329acfe2ce1b9a010578fd99a48839cd6ad
Instruction Fuzzy Hash: 05219421B1D29242FA14AB1299043BEE751BF45BC8FC84032EE2C07786EE3CE446C730

Function 00007FF7DDF262EC Relevance: 1.6, APIs: 1, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF263E3

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: fc9ed733c9531663f2a1fa64f5afa218c335b2449458d7cf86e62dd5dbc485b9
Instruction ID: 149b8722b3ff2440ecc575ca96994738612d32bf9fc69ca0c7eeb47fde9a3baf
Opcode Fuzzy Hash: fc9ed733c9531663f2a1fa64f5afa218c335b2449458d7cf86e62dd5dbc485b9
Instruction Fuzzy Hash: 85318422A1C60286E7117F55984137DAA50AF80BA4FD10237E93D473E2FFBCEA859731

Function 00007FF7DDF269CC Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c1c2126216073ca25d245121089a136ff3a7aa371bcd7b64ec763e68947bfc6
Instruction ID: 44884710d865f95b6c43ddd461c249cea6ee3f2ef20ca2df7e553477f8ace79e
Opcode Fuzzy Hash: 1c1c2126216073ca25d245121089a136ff3a7aa371bcd7b64ec763e68947bfc6
Instruction Fuzzy Hash: 59218C62A0C64246E6017F12984177DBA60AF40BB0FD58636ED3D8B3D2FE7CE9458B30

Function 00007FF7DDF20C88 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF20BED

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6a0c664ea0f4c756350c608c231ff57430cf4264c82a4fdbd8aab7f477704700
Instruction ID: e8bcce1a3eaf026c8ddf5cec75065fa746e3a3d2b84ea94e9b9844f89b505384
Opcode Fuzzy Hash: 6a0c664ea0f4c756350c608c231ff57430cf4264c82a4fdbd8aab7f477704700
Instruction Fuzzy Hash: 65115123A5C64182EA60BF51980027DEA60FF84B88FD44433EA5CC7B96FF3CD5418760

Function 00007FF7DDF30954 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF30977

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c350cc26a48ec555f8fe80a66dafdb4ca60a247c62ca8753b8880114feebe66c
Instruction ID: 2c0a62dd153ad7aeb9181adf7484622e2f1bb08e18c30bf75b3adbc8086d37e0
Opcode Fuzzy Hash: c350cc26a48ec555f8fe80a66dafdb4ca60a247c62ca8753b8880114feebe66c
Instruction Fuzzy Hash: C221533260CA8286EB61AF19E44077DB6A0FB84B94FD54236E66D476D9FF7CD8408B10

Function 00007FF7DDF242D8 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7DDF242F7

Part of subcall function 00007FF7DDF243E0: GetModuleHandleExW.KERNEL32 ref: 00007FF7DDF243FC
Part of subcall function 00007FF7DDF243E0: GetProcAddress.KERNEL32 ref: 00007FF7DDF24412
Part of subcall function 00007FF7DDF243E0: FreeLibrary.KERNEL32 ref: 00007FF7DDF2442F

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 43a0ca25b5b6844c1e1db732f007f001f54d2ff9bdd56d7814c1d6215129c12c
Instruction ID: ed4f937de1b02fbb861683884a7a8ea186b59178d06b1d5c08453ba401210394
Opcode Fuzzy Hash: 43a0ca25b5b6844c1e1db732f007f001f54d2ff9bdd56d7814c1d6215129c12c
Instruction Fuzzy Hash: 9B217131A0970589EB11AF64D4402AC7AA8EB55708FC44536D61D82A85FF7CDA85CB90

Function 00007FF7DDF1CC00 Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF1CC54

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 050f2a8f569f90b9d9de9d5361addb679e72bb7a6764323921c2888df917ddcb
Instruction ID: cc444c7fe8def9329bf73ac71dda73c21c534d73834c3ad06515bb90d7c590db
Opcode Fuzzy Hash: 050f2a8f569f90b9d9de9d5361addb679e72bb7a6764323921c2888df917ddcb
Instruction Fuzzy Hash: EB018261A0C78240E604AB52980016DE695AF95FE0FC88632DE7C57BD6EE3CD4014720

Function 00007FF7DDF25A80 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66a92c8017b1c3694242cf642bf5e48a42ebde1ff1b4540aa1cd3d890f4142b9
Instruction ID: 0e35b11cb3fd8e62e4b27ad18cf929207837ecf12952d60cfbbcacf4a218a6e2
Opcode Fuzzy Hash: 66a92c8017b1c3694242cf642bf5e48a42ebde1ff1b4540aa1cd3d890f4142b9
Instruction Fuzzy Hash: 27114F72A1C64286EA05AF50D8412ADFB60EF80768FD04237E66D463E5FF7CE509CB20

Function 00007FF7DDF1C840 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF1C85D

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e6931b6c3aa3e516f0ec126b93670d8baae33747ede93eb3b693a768aeb603a6
Instruction ID: 8e428fce62462c1be6a553ac313c0d36afbe0851ab1d2ac86f935c397de61b9a
Opcode Fuzzy Hash: e6931b6c3aa3e516f0ec126b93670d8baae33747ede93eb3b693a768aeb603a6
Instruction Fuzzy Hash: F0018F21E0D60241FE14BA76A89137DD5519F857B8FE84732E93E8B3D2FE2CE8418270

Function 00007FF7DDF1CCA8 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF1CCD5

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d27ab3f074c20aa396e25fcbfc74d5af21bb4413395d19741f8897ba95156ec4
Instruction ID: c8e41804ded1f31d7b4bbc72c4e0b14e55292ebc27005e10d5b318a9003fc3fb
Opcode Fuzzy Hash: d27ab3f074c20aa396e25fcbfc74d5af21bb4413395d19741f8897ba95156ec4
Instruction Fuzzy Hash: DBF09022B1C68241EA14BA5AA81107DE551AFC6BE0FD85132FA7D57B86EE6CD8414730

Function 00007FF7DDF1C8C4 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF1C8E6

Part of subcall function 00007FF7DDF1C840: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF1C85D

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 543a764d24b90672a05431dc1a130dac9a0496b5ba23ca517f68794dfbf99782
Instruction ID: fda0dd7cccc9aaf08d5e081471598431df5e02f377e241641805935e4e426cdb
Opcode Fuzzy Hash: 543a764d24b90672a05431dc1a130dac9a0496b5ba23ca517f68794dfbf99782
Instruction Fuzzy Hash: F3F0E231A0C20341EA14BB79A85127DE6919F803A4FD84232FA3D863C3FE2CE4419330

Function 00007FF7DDF23048 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF2306A

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: dccd32863e6f506b4f301f1450c7bfa29d8f33399d9aa950cae963106b31457f
Instruction ID: 526d78a53f550c1a8ef0056367807695314a85494dd3b6530fdc5849a8113544
Opcode Fuzzy Hash: dccd32863e6f506b4f301f1450c7bfa29d8f33399d9aa950cae963106b31457f
Instruction Fuzzy Hash: 57E06D21A4D64380E914FBA6A41117DA5905F85BF4FC81731EA7E4A7C6FE6CE0548734

Function 00007FF7DDF29550 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF7DDF286BD,?,?,00000000,00007FF7DDF1FC79,?,?,?,?,00007FF7DDF259F1), ref: 00007FF7DDF295A5

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: afbdb11ed1b08d377bc5fadb4004119812ee57a7d3acb3d5a3c71706b847d8e8
Instruction ID: b95dea25bd5558954d9537b10f7cba5dc4f2d9dea99b8461faa9eab99f1de355
Opcode Fuzzy Hash: afbdb11ed1b08d377bc5fadb4004119812ee57a7d3acb3d5a3c71706b847d8e8
Instruction Fuzzy Hash: A5F0F954B8E20741FE54766699622BD9AD55F98B80FC84432CD2EC7391FE6CE5848270

Non-executed Functions

Function 00007FF7DDF13C90 Relevance: 285.7, APIs: 54, Strings: 109, Instructions: 443libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,00007FF7DDF12E7E), ref: 00007FF7DDF13CA0
GetProcAddress.KERNEL32(?,?,00000000,00007FF7DDF12E7E), ref: 00007FF7DDF13CDA
GetProcAddress.KERNEL32(?,?,00000000,00007FF7DDF12E7E), ref: 00007FF7DDF13CFF
GetProcAddress.KERNEL32(?,?,00000000,00007FF7DDF12E7E), ref: 00007FF7DDF13D24
GetProcAddress.KERNEL32(?,?,00000000,00007FF7DDF12E7E), ref: 00007FF7DDF13D4C
GetProcAddress.KERNEL32(?,?,00000000,00007FF7DDF12E7E), ref: 00007FF7DDF13D74
GetProcAddress.KERNEL32(?,?,00000000,00007FF7DDF12E7E), ref: 00007FF7DDF13D9C
GetProcAddress.KERNEL32(?,?,00000000,00007FF7DDF12E7E), ref: 00007FF7DDF13DC4
GetProcAddress.KERNEL32(?,?,00000000,00007FF7DDF12E7E), ref: 00007FF7DDF13DEC
GetProcAddress.KERNEL32(?,?,00000000,00007FF7DDF12E7E), ref: 00007FF7DDF13E14

Strings

Failed to get address for PyObject_GetAttrString, xrefs: 00007FF7DDF14236
PyObject_Str, xrefs: 00007FF7DDF14242
Py_IncRef, xrefs: 00007FF7DDF13E82
PyList_Append, xrefs: 00007FF7DDF14102
PyUnicode_Decode, xrefs: 00007FF7DDF1444A
Failed to get address for PyErr_Fetch, xrefs: 00007FF7DDF1402E
Failed to get address for PyErr_Print, xrefs: 00007FF7DDF14006
GetProcAddress, xrefs: 00007FF7DDF13CB9
Failed to get address for Py_SetPath, xrefs: 00007FF7DDF13EEE
Py_FrozenFlag, xrefs: 00007FF7DDF13CF5
Py_Initialize, xrefs: 00007FF7DDF13EAA
Failed to get address for PySys_SetObject, xrefs: 00007FF7DDF14326
Failed to get address for PyObject_SetAttrString, xrefs: 00007FF7DDF1420E
PyLong_AsLong, xrefs: 00007FF7DDF14152
Py_FileSystemDefaultEncoding, xrefs: 00007FF7DDF13CD0
PyErr_Restore, xrefs: 00007FF7DDF1403A
Failed to get address for PyUnicode_Join, xrefs: 00007FF7DDF144DE
PySys_SetPath, xrefs: 00007FF7DDF14332
Failed to get address for PyObject_CallFunction, xrefs: 00007FF7DDF141BE
Py_UnbufferedStdioFlag, xrefs: 00007FF7DDF13DE2
Failed to get address for PyErr_Occurred, xrefs: 00007FF7DDF13FDE
Failed to get address for PySys_GetObject, xrefs: 00007FF7DDF142FE
Failed to get address for PyUnicode_Replace, xrefs: 00007FF7DDF14506
PyObject_CallFunction, xrefs: 00007FF7DDF141A2
PyErr_Fetch, xrefs: 00007FF7DDF14012
PyUnicode_Join, xrefs: 00007FF7DDF144C2
Failed to get address for Py_Initialize, xrefs: 00007FF7DDF13EC6
PySys_GetObject, xrefs: 00007FF7DDF142E2
Failed to get address for Py_NoUserSiteDirectory, xrefs: 00007FF7DDF13D86
Failed to get address for PyModule_GetDict, xrefs: 00007FF7DDF14196
Failed to get address for Py_IncRef, xrefs: 00007FF7DDF13E9E
PySys_SetObject, xrefs: 00007FF7DDF1430A
PyObject_SetAttrString, xrefs: 00007FF7DDF141F2
Py_NoSiteFlag, xrefs: 00007FF7DDF13D42
Failed to get address for Py_Finalize, xrefs: 00007FF7DDF13E76
Failed to get address for PyUnicode_AsUTF8, xrefs: 00007FF7DDF144B6
Py_DontWriteBytecodeFlag, xrefs: 00007FF7DDF13C96
Failed to get address for PyImport_ExecCodeModule, xrefs: 00007FF7DDF140CE
Failed to get address for Py_BuildValue, xrefs: 00007FF7DDF13E26
Failed to get address for PyErr_Restore, xrefs: 00007FF7DDF14056
PyImport_ImportModule, xrefs: 00007FF7DDF140DA
Failed to get address for PySys_AddWarnOption, xrefs: 00007FF7DDF142AE
PyImport_ExecCodeModule, xrefs: 00007FF7DDF140B2
Failed to get address for PyLong_AsLong, xrefs: 00007FF7DDF1416E
PyObject_CallFunctionObjArgs, xrefs: 00007FF7DDF141CA
PyUnicode_DecodeFSDefault, xrefs: 00007FF7DDF14472
Failed to get address for Py_VerboseFlag, xrefs: 00007FF7DDF13DD6
Failed to get address for PyDict_GetItemString, xrefs: 00007FF7DDF13F8E
Failed to get address for Py_DecRef, xrefs: 00007FF7DDF13E4E
Failed to get address for Py_FrozenFlag, xrefs: 00007FF7DDF13D11
Py_SetPath, xrefs: 00007FF7DDF13ED2
Failed to get address for PyUnicode_FromString, xrefs: 00007FF7DDF143C6
PyErr_Print, xrefs: 00007FF7DDF13FEA
Failed to get address for PyImport_AddModule, xrefs: 00007FF7DDF140A6
Failed to get address for PyUnicode_FromFormat, xrefs: 00007FF7DDF1443E
Failed to get address for PyRun_SimpleStringFlags, xrefs: 00007FF7DDF14286
Failed to get address for PyObject_CallFunctionObjArgs, xrefs: 00007FF7DDF141E6
PyUnicode_Replace, xrefs: 00007FF7DDF144EA
Failed to get address for PyMem_RawFree, xrefs: 00007FF7DDF14416
Py_VerboseFlag, xrefs: 00007FF7DDF13DBA
Failed to get address for PySys_SetArgvEx, xrefs: 00007FF7DDF142D6
Failed to get address for PyImport_ImportModule, xrefs: 00007FF7DDF140F6
Py_NoUserSiteDirectory, xrefs: 00007FF7DDF13D6A
PyEval_EvalCode, xrefs: 00007FF7DDF1435A
Failed to get address for Py_FileSystemDefaultEncoding, xrefs: 00007FF7DDF13CEC
PyMem_RawFree, xrefs: 00007FF7DDF143FA
PyList_New, xrefs: 00007FF7DDF1412A
Py_GetPath, xrefs: 00007FF7DDF13EFA
Failed to get address for PyUnicode_Decode, xrefs: 00007FF7DDF14466
PyMarshal_ReadObjectFromString, xrefs: 00007FF7DDF14382
PySys_AddWarnOption, xrefs: 00007FF7DDF14292
PySys_SetArgvEx, xrefs: 00007FF7DDF142BA
Py_SetPythonHome, xrefs: 00007FF7DDF13F4A
Failed to get address for Py_DecodeLocale, xrefs: 00007FF7DDF143EE
Failed to get address for PyList_New, xrefs: 00007FF7DDF14146
Failed to get address for Py_IgnoreEnvironmentFlag, xrefs: 00007FF7DDF13D36
Failed to get address for Py_GetPath, xrefs: 00007FF7DDF13F16
Py_OptimizeFlag, xrefs: 00007FF7DDF13D92
Py_BuildValue, xrefs: 00007FF7DDF13E0A
PyRun_SimpleStringFlags, xrefs: 00007FF7DDF1426A
Py_DecRef, xrefs: 00007FF7DDF13E32
PyUnicode_FromString, xrefs: 00007FF7DDF143AA
Failed to get address for PyList_Append, xrefs: 00007FF7DDF1411E
Failed to get address for Py_UnbufferedStdioFlag, xrefs: 00007FF7DDF13DFE
Failed to get address for PyMarshal_ReadObjectFromString, xrefs: 00007FF7DDF1439E
PyUnicode_AsUTF8, xrefs: 00007FF7DDF1449A
Failed to get address for PyErr_Clear, xrefs: 00007FF7DDF13FB6
PyUnicode_FromFormat, xrefs: 00007FF7DDF14422
Failed to get address for Py_SetProgramName, xrefs: 00007FF7DDF13F3E
PyDict_GetItemString, xrefs: 00007FF7DDF13F72
Failed to get address for Py_NoSiteFlag, xrefs: 00007FF7DDF13D5E
Failed to get address for PySys_SetPath, xrefs: 00007FF7DDF1434E
Failed to get address for PyEval_EvalCode, xrefs: 00007FF7DDF14376
PyImport_AddModule, xrefs: 00007FF7DDF1408A
Py_DecodeLocale, xrefs: 00007FF7DDF143D2
PyErr_NormalizeException, xrefs: 00007FF7DDF14062
Py_Finalize, xrefs: 00007FF7DDF13E5A
PyObject_GetAttrString, xrefs: 00007FF7DDF1421A
Failed to get address for PyUnicode_DecodeFSDefault, xrefs: 00007FF7DDF1448E
PyErr_Occurred, xrefs: 00007FF7DDF13FC2
Failed to get address for PyErr_NormalizeException, xrefs: 00007FF7DDF1407E
Py_SetProgramName, xrefs: 00007FF7DDF13F22
Failed to get address for Py_DontWriteBytecodeFlag, xrefs: 00007FF7DDF13CB2
Py_IgnoreEnvironmentFlag, xrefs: 00007FF7DDF13D1A
PyErr_Clear, xrefs: 00007FF7DDF13F9A
Failed to get address for PyObject_Str, xrefs: 00007FF7DDF1425E
Failed to get address for Py_SetPythonHome, xrefs: 00007FF7DDF13F66
PyModule_GetDict, xrefs: 00007FF7DDF1417A
Failed to get address for Py_OptimizeFlag, xrefs: 00007FF7DDF13DAE

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for PyDict_GetItemString$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyList_New$Failed to get address for PyLong_AsLong$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PySys_AddWarnOption$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetArgvEx$Failed to get address for PySys_SetObject$Failed to get address for PySys_SetPath$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_BuildValue$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_DontWriteBytecodeFlag$Failed to get address for Py_FileSystemDefaultEncoding$Failed to get address for Py_Finalize$Failed to get address for Py_FrozenFlag$Failed to get address for Py_GetPath$Failed to get address for Py_IgnoreEnvironmentFlag$Failed to get address for Py_IncRef$Failed to get address for Py_Initialize$Failed to get address for Py_NoSiteFlag$Failed to get address for Py_NoUserSiteDirectory$Failed to get address for Py_OptimizeFlag$Failed to get address for Py_SetPath$Failed to get address for Py_SetProgramName$Failed to get address for Py_SetPythonHome$Failed to get address for Py_UnbufferedStdioFlag$Failed to get address for Py_VerboseFlag$GetProcAddress$PyDict_GetItemString$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyList_New$PyLong_AsLong$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyRun_SimpleStringFlags$PySys_AddWarnOption$PySys_GetObject$PySys_SetArgvEx$PySys_SetObject$PySys_SetPath$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_BuildValue$Py_DecRef$Py_DecodeLocale$Py_DontWriteBytecodeFlag$Py_FileSystemDefaultEncoding$Py_Finalize$Py_FrozenFlag$Py_GetPath$Py_IgnoreEnvironmentFlag$Py_IncRef$Py_Initialize$Py_NoSiteFlag$Py_NoUserSiteDirectory$Py_OptimizeFlag$Py_SetPath$Py_SetProgramName$Py_SetPythonHome$Py_UnbufferedStdioFlag$Py_VerboseFlag
API String ID: 190572456-139387903
Opcode ID: 25571350705606e69c6884172ef84a6fbccfbccdf8a43baf74e4d03ce1e63489
Instruction ID: 5a1faf552da3e7aa6990a86334eee9a4fe181e99ca412e0da329a2e6f0a4ff4a
Opcode Fuzzy Hash: 25571350705606e69c6884172ef84a6fbccfbccdf8a43baf74e4d03ce1e63489
Instruction Fuzzy Hash: 2A3262A4A0EF1390FA55FB04A95417CA3E5AF49780BD55437C86E0A3A8FFBDB548C270

Function 00007FF7DDF11B80 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 188windowCOMMON

Download Yara Rule

APIs

GetDialogBaseUnits.USER32 ref: 00007FF7DDF11BCE
MulDiv.KERNEL32 ref: 00007FF7DDF11BE2
MulDiv.KERNEL32 ref: 00007FF7DDF11C03
SystemParametersInfoW.USER32 ref: 00007FF7DDF11C4B
CreateFontIndirectW.GDI32 ref: 00007FF7DDF11C5F
#380.COMCTL32 ref: 00007FF7DDF11C83
CreateWindowExW.USER32 ref: 00007FF7DDF11CD6
CreateWindowExW.USER32 ref: 00007FF7DDF11D30
CreateWindowExW.USER32 ref: 00007FF7DDF11D8D
CreateWindowExW.USER32 ref: 00007FF7DDF11DEF
SendMessageW.USER32 ref: 00007FF7DDF11E0F
SendMessageW.USER32 ref: 00007FF7DDF11E29
SendMessageW.USER32 ref: 00007FF7DDF11E48
SendMessageW.USER32 ref: 00007FF7DDF11E67
SendMessageW.USER32 ref: 00007FF7DDF11E85
SendMessageW.USER32 ref: 00007FF7DDF11EA3
SendMessageW.USER32 ref: 00007FF7DDF11EC1
SendMessageW.USER32 ref: 00007FF7DDF11ED9
SendMessageW.USER32 ref: 00007FF7DDF11EF1
GetClientRect.USER32 ref: 00007FF7DDF11F00

Part of subcall function 00007FF7DDF12020: GetDC.USER32 ref: 00007FF7DDF1204B
Part of subcall function 00007FF7DDF12020: SelectObject.GDI32 ref: 00007FF7DDF12096
Part of subcall function 00007FF7DDF12020: DrawTextW.USER32 ref: 00007FF7DDF120B9
Part of subcall function 00007FF7DDF12020: SelectObject.GDI32 ref: 00007FF7DDF120CF
Part of subcall function 00007FF7DDF12020: ReleaseDC.USER32 ref: 00007FF7DDF120DF
Part of subcall function 00007FF7DDF12020: MoveWindow.USER32 ref: 00007FF7DDF1212F
Part of subcall function 00007FF7DDF12020: MoveWindow.USER32 ref: 00007FF7DDF1216F
Part of subcall function 00007FF7DDF12020: MoveWindow.USER32 ref: 00007FF7DDF121C2

Strings

EDIT, xrefs: 00007FF7DDF11D3B
STATIC, xrefs: 00007FF7DDF11C8C, 00007FF7DDF11CE1
Failed to execute script '%ls' due to unhandled exception: %ls, xrefs: 00007FF7DDF11BAD
BUTTON, xrefs: 00007FF7DDF11DA6
Close, xrefs: 00007FF7DDF11D98

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: MessageSend$Window$Create$Move$ObjectSelect$#380BaseClientDialogDrawFontIndirectInfoParametersRectReleaseSystemTextUnits
String ID: BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
API String ID: 2446303242-1601438679
Opcode ID: 405cae881102fd9b4288b25694fdcb7e510b233441f66b6cc7a0f1c85a4d260d
Instruction ID: ca349538fc326480de8f5a400ceaa88bb3fac54c3a6b2019471448f66cd59b1b
Opcode Fuzzy Hash: 405cae881102fd9b4288b25694fdcb7e510b233441f66b6cc7a0f1c85a4d260d
Instruction Fuzzy Hash: 02A16A32208B8187E7189F61E45479EB371F788B94F90452ADB9D03B24DFBDE1A4CB50

Function 00007FF7DDF2E4EC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1209COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF7DDF2E531
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF2EB31
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF2ECE8
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF2EEFC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF2F1A5
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF2F3A2
memcpy_s.LIBCPMT ref: 00007FF7DDF2F48D
memcpy_s.LIBCPMT ref: 00007FF7DDF2F538
memcpy_s.LIBCPMT ref: 00007FF7DDF2F5FE

Strings

1#SNAN, xrefs: 00007FF7DDF2F6B0
1#INF, xrefs: 00007FF7DDF2F6CF
1#IND, xrefs: 00007FF7DDF2F6A4
1#QNAN, xrefs: 00007FF7DDF2F6BC

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 22e86934e9aa7124c19ddb337e70a2f8114e375dd55049989a6c0d29b15b255f
Instruction ID: 64fec5f5b0fd3f594ebb1cda819a4db2b866d9fa691ea29dca5b425d3cf032cf
Opcode Fuzzy Hash: 22e86934e9aa7124c19ddb337e70a2f8114e375dd55049989a6c0d29b15b255f
Instruction Fuzzy Hash: 0BB2D672E1C2828BE7649F65D4407FDBBA1FB44348FD45136DA2D9BA84FB38A904CB50

Function 00007FF7DDF16FA0 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00007FF7DDF12690), ref: 00007FF7DDF16FC7
FormatMessageW.KERNEL32(00000000,00007FF7DDF12690), ref: 00007FF7DDF16FF6
WideCharToMultiByte.KERNEL32 ref: 00007FF7DDF1704C

Part of subcall function 00007FF7DDF12610: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7DDF17233,?,?,?,?,?,?,?,?,?,?,?,00007FF7DDF1101D), ref: 00007FF7DDF12644
Part of subcall function 00007FF7DDF12610: MessageBoxW.USER32 ref: 00007FF7DDF1271C

Strings

Failed to encode wchar_t as UTF-8., xrefs: 00007FF7DDF17056
PyInstaller: FormatMessageW failed., xrefs: 00007FF7DDF17013
WideCharToMultiByte, xrefs: 00007FF7DDF1705D
PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 00007FF7DDF17069
FormatMessageW, xrefs: 00007FF7DDF17007
No error messages generated., xrefs: 00007FF7DDF17000

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: ErrorLastMessage$ByteCharFormatMultiWide
String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
API String ID: 2920928814-2573406579
Opcode ID: 3a12c33edb148940672c099e74b863588d93d4457ec079783bd0d804bbb9806a
Instruction ID: 681543b4515f39614d93a0174149023e004d555c24f52d52dc095792bb1b3d44
Opcode Fuzzy Hash: 3a12c33edb148940672c099e74b863588d93d4457ec079783bd0d804bbb9806a
Instruction Fuzzy Hash: B7215071A1CA8391EB60BF15F84466EA3A5BF88384FC40136D5AD826A8FF7CE545C730

Function 00007FF7DDF162D0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 139COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(?,00000000,?,00007FF7DDF1629D), ref: 00007FF7DDF1636A

Part of subcall function 00007FF7DDF164E0: GetEnvironmentVariableW.KERNEL32(00007FF7DDF13589), ref: 00007FF7DDF1651A
Part of subcall function 00007FF7DDF164E0: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7DDF16537

Part of subcall function 00007FF7DDF21D4C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF21D65

SetEnvironmentVariableW.KERNEL32(?,TokenIntegrityLevel), ref: 00007FF7DDF16421

Part of subcall function 00007FF7DDF12760: MessageBoxW.USER32 ref: 00007FF7DDF12831

Strings

_MEI%d, xrefs: 00007FF7DDF16378
LOADER: Failed to set the TMP environment variable., xrefs: 00007FF7DDF16348
TMP, xrefs: 00007FF7DDF1632E
TMP, xrefs: 00007FF7DDF16308, 00007FF7DDF163C9, 00007FF7DDF16457

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
API String ID: 3752271684-1116378104
Opcode ID: 2633e2f9f0d4dd96eeae635a19a113b42d19681f9234dfd4b9a2ea8617ccad62
Instruction ID: 6c44685569863438f01a6978ddd733a380d339617fd51ec377083ab97fdb6fdc
Opcode Fuzzy Hash: 2633e2f9f0d4dd96eeae635a19a113b42d19681f9234dfd4b9a2ea8617ccad62
Instruction Fuzzy Hash: 33516F11B0D69385FE54BB22A9652BED2515F89BC4FC40037EC6E8BBA6FD2CE5058730

Function 00007FF7DDF182D8 Relevance: 12.0, Strings: 9, Instructions: 730COMMON

Download Yara Rule

Strings

invalid code -- missing end-of-block, xrefs: 00007FF7DDF186B9
invalid bit length repeat, xrefs: 00007FF7DDF186D2
invalid literal/lengths set, xrefs: 00007FF7DDF18740
invalid distance code, xrefs: 00007FF7DDF18B8A
invalid literal/length code, xrefs: 00007FF7DDF189D8
too many length or distance symbols, xrefs: 00007FF7DDF18460
invalid code lengths set, xrefs: 00007FF7DDF18447
invalid distances set, xrefs: 00007FF7DDF187AD
invalid distance too far back, xrefs: 00007FF7DDF18C3C

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 049921a658be687a5ad71860aa43a6d749bd02c33d2519cf778dba4da53bf44e
Instruction ID: c114f094e88b6082f89e664ce035bc48fea8cd7af85f34330c03d93dee8d6ea9
Opcode Fuzzy Hash: 049921a658be687a5ad71860aa43a6d749bd02c33d2519cf778dba4da53bf44e
Instruction Fuzzy Hash: 1D521672A186A697D7949F14D588A7E77ADFB84340FC1413AEA9983780EF3CD844CB60

Function 00007FF7DDF1AEE0 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7DDF1AEFC
RtlCaptureContext.KERNEL32 ref: 00007FF7DDF1AF29
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7DDF1AF43
RtlVirtualUnwind.KERNEL32 ref: 00007FF7DDF1AF84
IsDebuggerPresent.KERNEL32 ref: 00007FF7DDF1AFD8
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7DDF1AFF9
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7DDF1B004

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: e440e0af2a8a59d969f9bdb60f36ca4ebaa98fd206effc6c2ec9c6feadcd0944
Instruction ID: 79a168240560ac5cdf3e8bbfcac4bd2217c8cab5d4684d916d13d1636539076c
Opcode Fuzzy Hash: e440e0af2a8a59d969f9bdb60f36ca4ebaa98fd206effc6c2ec9c6feadcd0944
Instruction Fuzzy Hash: 49314F72609B819AEB60AF60E8403EDB364FB84744FC4403ADA5E47B94EF7CD548C720

Function 00007FF7DDF30010 Relevance: 9.3, APIs: 6, Instructions: 280timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7DDF3005A

Part of subcall function 00007FF7DDF2F9B0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF2F9C4

_get_daylight.LIBCMT ref: 00007FF7DDF30049

Part of subcall function 00007FF7DDF2FA10: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF2FA24

_get_daylight.LIBCMT ref: 00007FF7DDF302D2
_get_daylight.LIBCMT ref: 00007FF7DDF302E3
_get_daylight.LIBCMT ref: 00007FF7DDF302F4
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7DDF30500), ref: 00007FF7DDF3031B

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$InformationTimeZone
String ID:
API String ID: 435049134-0
Opcode ID: 2ad49692c65a9643aff4bf0dd6164fb5e4ae0d0b7e62790cc916ec93dee904d3
Instruction ID: 16410e9b26465545b93a6fb6c601f14de66815071e50c23758096b26b3fe523d
Opcode Fuzzy Hash: 2ad49692c65a9643aff4bf0dd6164fb5e4ae0d0b7e62790cc916ec93dee904d3
Instruction Fuzzy Hash: 33B1AE22A1C64286E720FF22D8415BEA760EF84794FC54137EE6D87A96FF3CE4418760

Function 00007FF7DDF2C06C Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF2C0B5

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 70381fada3c5ae93ba7192b4a4a2bb5ed24ec96e14593e64572d2cabae56ca17
Instruction ID: d4b92443162f2167ebca606b830b74d8511e5fe06d82d7b3a5b175ae881db660
Opcode Fuzzy Hash: 70381fada3c5ae93ba7192b4a4a2bb5ed24ec96e14593e64572d2cabae56ca17
Instruction Fuzzy Hash: CFA1A072A1D68181EA20EB6698011BEABA1FB44BD4FD44537DE6D87BC4FF7CE4458320

Function 00007FF7DDF25750 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7DDF257C9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7DDF257E1
RtlVirtualUnwind.KERNEL32 ref: 00007FF7DDF2581C
IsDebuggerPresent.KERNEL32 ref: 00007FF7DDF25855
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7DDF2585F
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7DDF2586A

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 7af9a718ba771edf7e69dad524d47659ead305be643fa1df24af60c020ca3b2e
Instruction ID: 9ee7c96eafe187c3585b9b04b8d20c38da6b04c47c1341e16a2c2fd5715ee151
Opcode Fuzzy Hash: 7af9a718ba771edf7e69dad524d47659ead305be643fa1df24af60c020ca3b2e
Instruction Fuzzy Hash: F431843260CB8196DB60EF25E8402AEB7A0FB88758FD40136EAAD47B54EF7CD145CB10

Function 00007FF7DDF26DE0 Relevance: 7.8, APIs: 5, Instructions: 328fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF7DDF26E4F
WriteFile.KERNEL32 ref: 00007FF7DDF27106
WriteFile.KERNEL32 ref: 00007FF7DDF27158
GetLastError.KERNEL32 ref: 00007FF7DDF2725A
GetLastError.KERNEL32 ref: 00007FF7DDF272BA

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: ErrorFileLastWrite$ConsoleOutput
String ID:
API String ID: 1443284424-0
Opcode ID: 0a19410c419814db5db070c5d12a1b78bfb040d79319ef459e0b6fcfc05cf743
Instruction ID: 30dede0b38ceb05db06dd7dd20cac2fec4a9cecb5326acfc73deb7e158191775
Opcode Fuzzy Hash: 0a19410c419814db5db070c5d12a1b78bfb040d79319ef459e0b6fcfc05cf743
Instruction Fuzzy Hash: 99E1F462B0C6819AE700DF64D0401ADBBB1FB45788FD44136EEAE97B99FE38D416C710

Function 00007FF7DDF302A4 Relevance: 6.1, APIs: 4, Instructions: 149timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7DDF302D2

Part of subcall function 00007FF7DDF2FA10: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF2FA24

_get_daylight.LIBCMT ref: 00007FF7DDF302E3

Part of subcall function 00007FF7DDF2F9B0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF2F9C4

_get_daylight.LIBCMT ref: 00007FF7DDF302F4

Part of subcall function 00007FF7DDF2F9E0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF2F9F4

Part of subcall function 00007FF7DDF259CC: HeapFree.KERNEL32 ref: 00007FF7DDF259E2

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7DDF30500), ref: 00007FF7DDF3031B

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$FreeHeapInformationTimeZone
String ID:
API String ID: 428190724-0
Opcode ID: 76810fb177e4db148eeb30994ff645ccd78b16a1d3bce7f3da4ec91dfb23b20f
Instruction ID: d94b5f3e5da4da123864334b8aae9b605cc147f51782cc6bfa2388acd5268466
Opcode Fuzzy Hash: 76810fb177e4db148eeb30994ff645ccd78b16a1d3bce7f3da4ec91dfb23b20f
Instruction Fuzzy Hash: 02614C22A1C64286E720FF22D9815ADB760FB48784FC54137EA6D87A95FF3CE5418B60

Function 00007FF7DDF2FF2C Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 244COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7DDF2BF74: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF2BFA2

_get_daylight.LIBCMT ref: 00007FF7DDF30049
_get_daylight.LIBCMT ref: 00007FF7DDF3005A

Strings

?, xrefs: 00007FF7DDF2FFD5

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 0c884086102c4b45e394e5883d44db676d981fc4a610e566de8c3fbbb4b0ead5
Instruction ID: 7b4002b46d6b49499c48393ccdf509c4045fa1fedc6a1e0c1742013afc5bd847
Opcode Fuzzy Hash: 0c884086102c4b45e394e5883d44db676d981fc4a610e566de8c3fbbb4b0ead5
Instruction Fuzzy Hash: 2E91D326E1C25285EB20BF26D44027EAA61EF81BD4FD54133EEAC87AD5FE7CD4418750

Function 00007FF7DDF17AA4 Relevance: 5.4, Strings: 4, Instructions: 399COMMON

Download Yara Rule

Strings

unknown compression method, xrefs: 00007FF7DDF17AD8
unknown header flags set, xrefs: 00007FF7DDF17AF9
header crc mismatch, xrefs: 00007FF7DDF17F3E
, xrefs: 00007FF7DDF17B89

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown compression method$unknown header flags set
API String ID: 0-4074041902
Opcode ID: 3ccf8dfa57ebed5ae874e87ea7e697ea666599418b435e4c2251ebe5a9e21131
Instruction ID: 6c4593d9f6f3428dbf119c9099bed771049782c8eb74c47918372b4c60fc52bf
Opcode Fuzzy Hash: 3ccf8dfa57ebed5ae874e87ea7e697ea666599418b435e4c2251ebe5a9e21131
Instruction Fuzzy Hash: 32F1A47261C3C996E795AF05C088A3EBBA9FF54740FC5453ADAAD07390EB38E944C760

Function 00007FF7DDF2E0C0 Relevance: 4.8, APIs: 3, Instructions: 317COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF7DDF2E126
memcpy_s.LIBCPMT ref: 00007FF7DDF2E151

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 61c8d48a73c74d7b2b5693099c23eccbf95a4682f3061de545b2f75f73c9d44c
Instruction ID: eb13faf2dac4b50f465daa9dfc984ddd84d8e94356f6dcfb63461fcccc74b70b
Opcode Fuzzy Hash: 61c8d48a73c74d7b2b5693099c23eccbf95a4682f3061de545b2f75f73c9d44c
Instruction Fuzzy Hash: E0C1F572B1C28687E724DF99E044A6EBB91F794784FD48136DB5A83784FA3CE941CB40

Function 00007FF7DDF1A060 Relevance: 4.1, Strings: 3, Instructions: 384COMMON

Download Yara Rule

Strings

invalid distance code, xrefs: 00007FF7DDF1A4B3
invalid literal/length code, xrefs: 00007FF7DDF1A496
invalid distance too far back, xrefs: 00007FF7DDF1A4D0

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID:
String ID: invalid distance code$invalid distance too far back$invalid literal/length code
API String ID: 0-3255898291
Opcode ID: 5ccc26b74eac166d3016146671465d669a63232148addc042f7b457501de7681
Instruction ID: ce8e7c2d4b3e8401f2337e52e24d651abcc86f311317f10c3369392aa0757db6
Opcode Fuzzy Hash: 5ccc26b74eac166d3016146671465d669a63232148addc042f7b457501de7681
Instruction Fuzzy Hash: 49D15B33A0C5D14BD7699F39D40427CBBE1E795750F848136EAAA437C1EA3CDA4AC720

Function 00007FF7DDF1790D Relevance: 4.0, Strings: 3, Instructions: 219COMMON

Download Yara Rule

Strings

invalid window size, xrefs: 00007FF7DDF17A72
unknown compression method, xrefs: 00007FF7DDF179F7
incorrect header check, xrefs: 00007FF7DDF17A8B

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size$unknown compression method
API String ID: 0-1186847913
Opcode ID: 933fdda2a0a693fb4704c872a706b9889a7611392e337090ac754fb873cc17c4
Instruction ID: 32c9cdf7a8a6d86d987b97e3e0220070094ef9c1dad7103927e6e6978635f5d3
Opcode Fuzzy Hash: 933fdda2a0a693fb4704c872a706b9889a7611392e337090ac754fb873cc17c4
Instruction Fuzzy Hash: FF91D672A1C2C687E7A4AF15D488B3E76A9FF54340FD1413ADA6D46780EB38E944CB60

Function 00007FF7DDF17FCC Relevance: 3.9, Strings: 3, Instructions: 161COMMON

Download Yara Rule

Strings

, xrefs: 00007FF7DDF17FEA
, xrefs: 00007FF7DDF17FCC
invalid block type, xrefs: 00007FF7DDF180CF

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID:
String ID: $ $invalid block type
API String ID: 0-2056396358
Opcode ID: 6941b897d4e00403c18809f6a673ff2f5a89638ff58ad76ef09c7e80b304dd39
Instruction ID: fd083caae1a1fdd977a67db562325f1b090d0c108e046c473bcb65570df5e2f8
Opcode Fuzzy Hash: 6941b897d4e00403c18809f6a673ff2f5a89638ff58ad76ef09c7e80b304dd39
Instruction Fuzzy Hash: 9461C77390C78A9BE760AF15D98C63EBAACFB40350FD1453AD66882390EF39D544CB60

Function 00007FF7DDF287F4 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 251COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF28858

Strings

gfffffff, xrefs: 00007FF7DDF28B09

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfffffff
API String ID: 3215553584-1523873471
Opcode ID: 6e6b374e358ffb98ed3835fe1ad345463b8c13656902312dc80815bb4bc071b0
Instruction ID: 31284a5690ec330e8eeb92d881051f7e32df5009b73cde64d85c1303631924ba
Opcode Fuzzy Hash: 6e6b374e358ffb98ed3835fe1ad345463b8c13656902312dc80815bb4bc071b0
Instruction Fuzzy Hash: 9F912562B0D3C686EB11DB2994003ADAF90EB51BC4F858433CE5D9B785FE3DE5018721

Function 00007FF7DDF29200 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 220COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF29236

Part of subcall function 00007FF7DDF25984: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7DDF25961), ref: 00007FF7DDF2598D
Part of subcall function 00007FF7DDF25984: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7DDF25961), ref: 00007FF7DDF259B2

Strings

-, xrefs: 00007FF7DDF29428

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor_invalid_parameter_noinfo
String ID: -
API String ID: 4036615347-2547889144
Opcode ID: 9a225e88cd471c9f0d28c8492e0b3f4a847acdc232b1f098b5a0036e8607a1c4
Instruction ID: ae5cecfc824481caa043765b8260a463d2befa2944d77b0810f6346eb8adb3fd
Opcode Fuzzy Hash: 9a225e88cd471c9f0d28c8492e0b3f4a847acdc232b1f098b5a0036e8607a1c4
Instruction Fuzzy Hash: 0891F472A0C78586E660EB15954076EFBA1FB89BD4FC44236DAAD83BD8FB3CD5408710

Function 00007FF7DDF33C18 Relevance: 3.2, APIs: 2, Instructions: 232COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF7DDF33E67
RaiseException.KERNEL32 ref: 00007FF7DDF33E78

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: cc44eefe37f4df5582d82a49112138722456b84e82797c40e34ba7e475433f75
Instruction ID: 10eaf039fcb16e109df9eea3109c84830ddf796b05b3d08a4c6c594f209dc3bd
Opcode Fuzzy Hash: cc44eefe37f4df5582d82a49112138722456b84e82797c40e34ba7e475433f75
Instruction Fuzzy Hash: B3B15C73608B888BEB15CF29C48636C77E0F744B88F968922DA6D877B4DB79D451C710

Function 00007FF7DDF2B13C Relevance: 1.9, APIs: 1, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3327727410ba43267f1818fc1ca42ebba00638f48a1b01f7df25d5506b79be8b
Instruction ID: 6e065a92672b3d8225f0f75f542fd28060ce0d7c31c256f5c50f02684fe3c305
Opcode Fuzzy Hash: 3327727410ba43267f1818fc1ca42ebba00638f48a1b01f7df25d5506b79be8b
Instruction Fuzzy Hash: 9C029E21A1E74745FA65BB21A50127DAAA0AF01BA4FC84637DE7D873D9FE3CB5018330

Function 00007FF7DDF30A18 Relevance: 1.7, APIs: 1, Instructions: 195COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7DDF30A7C

Part of subcall function 00007FF7DDF20EB0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF20EC4

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo
String ID:
API String ID: 474895018-0
Opcode ID: 243d5d21dcd28f2a06ead8b026a9aab18a2fb0d1a5646949e8ba3d48c892d882
Instruction ID: 3a8d8ce8433e36bba0541984210fc090828e4b36e745b83bb1c94134571e3266
Opcode Fuzzy Hash: 243d5d21dcd28f2a06ead8b026a9aab18a2fb0d1a5646949e8ba3d48c892d882
Instruction Fuzzy Hash: 9B710722E4C2824AFB246E69945077DE681EF403A4FD60637DA7D877D1FEBDE8408720

Function 00007FF7DDF1E80C Relevance: 1.5, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

0, xrefs: 00007FF7DDF1E9DB

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: a375ce7d8ac190a774d9db1b0bbd49aa5845f631dc9fe3244db92a46c16961f0
Instruction ID: 91c1f6cf026f2343302aff7b6d89acbd49f29e45a57f242a0d1d381c79f588ff
Opcode Fuzzy Hash: a375ce7d8ac190a774d9db1b0bbd49aa5845f631dc9fe3244db92a46c16961f0
Instruction Fuzzy Hash: 8B71D425A1C24382FBA8BA6980007BDA291EF40758FC45037DDAE17699EF3DE847C775

Function 00007FF7DDF22BE0 Relevance: 1.5, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF7DDF22BFF

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: 3772542ea4a4b3d8e13b1332826cfc2d2f2f0438b04aa7ee1bd917f2c6869f8a
Instruction ID: 4f3f6b73d58fb6c3591afb26dac907f09f989187540e2bbaa84d1b07457531c1
Opcode Fuzzy Hash: 3772542ea4a4b3d8e13b1332826cfc2d2f2f0438b04aa7ee1bd917f2c6869f8a
Instruction Fuzzy Hash: 4961C615B0D65241FA68BB2299119BEEA91AF44BD8FC84037DD2DC7BD5FE3CF4528220

Function 00007FF7DDF1E5A4 Relevance: 1.4, Strings: 1, Instructions: 196COMMON

Download Yara Rule

Strings

0, xrefs: 00007FF7DDF1E73D

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: b79696a407a2e1f99417375bab57c27b4c70aed7112a41bb3197fc5d58abf242
Instruction ID: dd0ac6d57dd6035ea97c6c9cc912f6df726826fd5ce7276251873ca01afa60be
Opcode Fuzzy Hash: b79696a407a2e1f99417375bab57c27b4c70aed7112a41bb3197fc5d58abf242
Instruction Fuzzy Hash: 4D612711F2C24346FA686AA960003BEE7929F81748FD41137DCBD172D9EE2DE8478B31

Function 00007FF7DDF2DB48 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7DDF2DB4C

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 8801fbc29237cde97098c2992bb5712ac8fa4bdca70bfcd9b7dcc25e25bd9bb3
Instruction ID: a539a9354197e480d22a005d2dd8ec1edf75231d543ac8b7c42cdd4b461650dd
Opcode Fuzzy Hash: 8801fbc29237cde97098c2992bb5712ac8fa4bdca70bfcd9b7dcc25e25bd9bb3
Instruction Fuzzy Hash: 29B09220E1FA02D2EA083B11AC8221862A57F88700FC9007AC85C40320EF6C21A59B21

Function 00007FF7DDF19760 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1385a6dc4bf741762803ad4c6cf90cf37c55bf401a043c8da06b4fed85b1e8de
Instruction ID: 0f87f06cc59328b468e737ec27fe531745feed2f4d1c37a9d2613092a9cf1140
Opcode Fuzzy Hash: 1385a6dc4bf741762803ad4c6cf90cf37c55bf401a043c8da06b4fed85b1e8de
Instruction Fuzzy Hash: A471A1B27341749BEB648B2EA514AB93390F36A349FC56115EB8447B81CE3EB921CB50

Function 00007FF7DDF20700 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6ef73793ea1788ae08d57b95515db7d43b127d7364744ae73512ded182e4f5a
Instruction ID: 1eecb799a2a7b52ed01c1d387467b74a1ff6bb1228226516e0992df1ffb02214
Opcode Fuzzy Hash: d6ef73793ea1788ae08d57b95515db7d43b127d7364744ae73512ded182e4f5a
Instruction Fuzzy Hash: 8341D653C8E78F04ED95A91815107FDAE80EF12BA1DD893B2DDB9933C7FD0C25868520

Function 00007FF7DDF24684 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 1d994b37b1cf4f1169b7266f25e6acd6a53ff83a833236cbbcbb6c3045857a73
Instruction ID: a46d1317675cc2c602af346e2a14d4c2c63c6e4e3b41952819a7528858fd95bb
Opcode Fuzzy Hash: 1d994b37b1cf4f1169b7266f25e6acd6a53ff83a833236cbbcbb6c3045857a73
Instruction Fuzzy Hash: 07410322719A5482EF04DF2AE9145ADB7A5B749FE4B899033DE5D87B58EF3CD0418340

Function 00007FF7DDF33A60 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bd83198f846778d29d018d0185ecddc9eeca64a8fdced8fb6dbde6c39c1dffb
Instruction ID: b01fe34aa81c09c87ac1128af5907cf71780952d2521dd822a8fac44ae0f3963
Opcode Fuzzy Hash: 4bd83198f846778d29d018d0185ecddc9eeca64a8fdced8fb6dbde6c39c1dffb
Instruction Fuzzy Hash: EEF06871B1C2958AEB94DF29E80262D77D0F708390FD0803AD9DD83B14D63C91518F14

Function 00007FF7DDF1B0C4 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d3e1ff0ce676b4cbccc0a96f9ce58280626e59de3549e9ee2853c98f0f76dbb
Instruction ID: 42c96060d93a03887d1bca49397e6c09f8b1839c3982c516c51ccd4d0f57e634
Opcode Fuzzy Hash: 5d3e1ff0ce676b4cbccc0a96f9ce58280626e59de3549e9ee2853c98f0f76dbb
Instruction Fuzzy Hash: A9A0016190C902E0E604AB00A95006CA220AB91300BD60032C12D411A4AE7EB5008320

Function 00007FF7DDF151F0 Relevance: 166.5, APIs: 31, Strings: 64, Instructions: 287libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7DDF16CA0: LoadLibraryExW.KERNEL32(?,?,00000000,00007FF7DDF12E7E), ref: 00007FF7DDF16CC3

GetProcAddress.KERNEL32 ref: 00007FF7DDF15AD7
GetProcAddress.KERNEL32 ref: 00007FF7DDF15B16
GetProcAddress.KERNEL32 ref: 00007FF7DDF15B3B
GetProcAddress.KERNEL32 ref: 00007FF7DDF15B60
GetProcAddress.KERNEL32 ref: 00007FF7DDF15B88
GetProcAddress.KERNEL32 ref: 00007FF7DDF15BB0
GetProcAddress.KERNEL32 ref: 00007FF7DDF15BD8
GetProcAddress.KERNEL32 ref: 00007FF7DDF15C00
GetProcAddress.KERNEL32 ref: 00007FF7DDF15C28

Strings

Failed to get address for Tcl_MutexUnlock, xrefs: 00007FF7DDF15C8A
Tcl_Alloc, xrefs: 00007FF7DDF15F16
Tcl_MutexUnlock, xrefs: 00007FF7DDF15C6E
Failed to get address for Tcl_MutexLock, xrefs: 00007FF7DDF15C62
GetProcAddress, xrefs: 00007FF7DDF15AF0
Tcl_ThreadQueueEvent, xrefs: 00007FF7DDF15D0E
Tcl_GetString, xrefs: 00007FF7DDF15DD6
Failed to get address for Tcl_NewStringObj, xrefs: 00007FF7DDF15E1A
Tcl_GetCurrentThread, xrefs: 00007FF7DDF15C1E
Failed to get address for Tcl_Init, xrefs: 00007FF7DDF15AE9
Failed to get address for Tcl_ThreadQueueEvent, xrefs: 00007FF7DDF15D2A
Tcl_ThreadAlert, xrefs: 00007FF7DDF15D36
Failed to get address for Tcl_CreateThread, xrefs: 00007FF7DDF15C12
Tcl_SetVar2, xrefs: 00007FF7DDF15D86
Tcl_ConditionNotify, xrefs: 00007FF7DDF15CBE
Failed to get address for Tcl_SetVar2Ex, xrefs: 00007FF7DDF15E6A
Failed to get address for Tcl_DoOneEvent, xrefs: 00007FF7DDF15B72
Failed to get address for Tcl_DeleteInterp, xrefs: 00007FF7DDF15BEA
Tcl_SetVar2Ex, xrefs: 00007FF7DDF15E4E
Tcl_CreateInterp, xrefs: 00007FF7DDF15B0C
Tcl_NewByteArrayObj, xrefs: 00007FF7DDF15E26
Tcl_EvalEx, xrefs: 00007FF7DDF15EC6
Failed to get address for Tcl_EvalFile, xrefs: 00007FF7DDF15EBA
Tcl_CreateThread, xrefs: 00007FF7DDF15BF6
Failed to get address for Tcl_FindExecutable, xrefs: 00007FF7DDF15B4D
Tcl_FinalizeThread, xrefs: 00007FF7DDF15BA6
Failed to get address for Tcl_EvalEx, xrefs: 00007FF7DDF15EE2
Failed to get address for Tcl_SetVar2, xrefs: 00007FF7DDF15DA2
Tcl_FindExecutable, xrefs: 00007FF7DDF15B31
Tk_Init, xrefs: 00007FF7DDF15F66
Tcl_GetObjResult, xrefs: 00007FF7DDF15E76
Tcl_Free, xrefs: 00007FF7DDF15F3E
Failed to get address for Tcl_ThreadAlert, xrefs: 00007FF7DDF15D52
Failed to get address for Tcl_GetCurrentThread, xrefs: 00007FF7DDF15C3A
Tcl_EvalObjv, xrefs: 00007FF7DDF15EEE
Failed to get address for Tcl_GetVar2, xrefs: 00007FF7DDF15D7A
Tcl_DoOneEvent, xrefs: 00007FF7DDF15B56
Failed to get address for Tcl_NewByteArrayObj, xrefs: 00007FF7DDF15E42
Tcl_ConditionFinalize, xrefs: 00007FF7DDF15C96
Tcl_Finalize, xrefs: 00007FF7DDF15B7E
Tk_GetNumMainWindows, xrefs: 00007FF7DDF15F8E
Failed to get address for Tcl_GetObjResult, xrefs: 00007FF7DDF15E92
Tcl_CreateObjCommand, xrefs: 00007FF7DDF15DAE
Tcl_DeleteInterp, xrefs: 00007FF7DDF15BCE
Failed to get address for Tcl_ConditionFinalize, xrefs: 00007FF7DDF15CB2
Tcl_GetVar2, xrefs: 00007FF7DDF15D5E
Failed to get address for Tcl_FinalizeThread, xrefs: 00007FF7DDF15BC2
Failed to get address for Tcl_CreateInterp, xrefs: 00007FF7DDF15B28
LOADER: Failed to load tcl/tk libraries, xrefs: 00007FF7DDF1523A
Failed to get address for Tk_GetNumMainWindows, xrefs: 00007FF7DDF15FAA
Tcl_ConditionWait, xrefs: 00007FF7DDF15CE6
Tcl_MutexLock, xrefs: 00007FF7DDF15C46
Failed to get address for Tk_Init, xrefs: 00007FF7DDF15F82
Failed to get address for Tcl_EvalObjv, xrefs: 00007FF7DDF15F0A
Failed to get address for Tcl_Finalize, xrefs: 00007FF7DDF15B9A
Failed to get address for Tcl_GetString, xrefs: 00007FF7DDF15DF2
Tcl_Init, xrefs: 00007FF7DDF15AD0
Failed to get address for Tcl_CreateObjCommand, xrefs: 00007FF7DDF15DCA
Tcl_EvalFile, xrefs: 00007FF7DDF15E9E
Failed to get address for Tcl_Alloc, xrefs: 00007FF7DDF15F32
Failed to get address for Tcl_Free, xrefs: 00007FF7DDF15F5A
Failed to get address for Tcl_ConditionNotify, xrefs: 00007FF7DDF15CDA
Failed to get address for Tcl_ConditionWait, xrefs: 00007FF7DDF15D02
Tcl_NewStringObj, xrefs: 00007FF7DDF15DFE

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$LOADER: Failed to load tcl/tk libraries$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 2238633743-1453502826
Opcode ID: f96951eaef3e1a62858032ea02cb2edabc398db729e2fb31a297987f2eff23a8
Instruction ID: bc5afa0a61496e981023eaf699112088ff895bf160179b3589de7aae33a96f24
Opcode Fuzzy Hash: f96951eaef3e1a62858032ea02cb2edabc398db729e2fb31a297987f2eff23a8
Instruction Fuzzy Hash: ACE1A1A4A4DB0391EA59EB18E89017CA2B5BF45740BD95037C86E0A3A4FFBCF558D270

Function 00007FF7DDF11440 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 133COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7DDF115D5
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7DDF114CA
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7DDF115E5
fwrite, xrefs: 00007FF7DDF115DC
Failed to extract %s: failed to open target file!, xrefs: 00007FF7DDF1148A
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF7DDF11559
fread, xrefs: 00007FF7DDF115EC
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7DDF114F9
malloc, xrefs: 00007FF7DDF11560
fseek, xrefs: 00007FF7DDF11500
fopen, xrefs: 00007FF7DDF11491

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID:
String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 0-666925554
Opcode ID: 6c41c365be8cfabf673c4a31a4534a87377e14776b52482b9a643b9dab18ecd8
Instruction ID: 4e3e5e289c069edb7a434233aac8c77af850e1089bd480e01b9ed6132dc3f42f
Opcode Fuzzy Hash: 6c41c365be8cfabf673c4a31a4534a87377e14776b52482b9a643b9dab18ecd8
Instruction Fuzzy Hash: 1A517861A0CA4281EA10FB25E4506BDE3A1AF86B98FC54533DE2D47796FE7DE6448330

Function 00007FF7DDF17300 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,00007FF7DDF163AA,?,00007FF7DDF1629D), ref: 00007FF7DDF17340
OpenProcessToken.ADVAPI32(?,00007FF7DDF1629D), ref: 00007FF7DDF17351
GetTokenInformation.ADVAPI32(?,00007FF7DDF1629D(TokenIntegrityLevel)), ref: 00007FF7DDF17373
GetLastError.KERNEL32(?,TokenIntegrityLevel), ref: 00007FF7DDF1737D
GetTokenInformation.ADVAPI32(?,TokenIntegrityLevel), ref: 00007FF7DDF173BA
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7DDF173CC
CloseHandle.KERNEL32(?,00007FF7DDF1629D), ref: 00007FF7DDF173E4
LocalFree.KERNEL32(?,00007FF7DDF1629D), ref: 00007FF7DDF17416
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF7DDF1743D
CreateDirectoryW.KERNEL32(?,00007FF7DDF1629D), ref: 00007FF7DDF1744E

Strings

D:(A;;FA;;;%s), xrefs: 00007FF7DDF173F9
S-1-3-4, xrefs: 00007FF7DDF173EF

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen
String ID: D:(A;;FA;;;%s)$S-1-3-4
API String ID: 4998090-2855260032
Opcode ID: 9b298aaea292c1306737245ebaf89eee88d932f02e0e3e31ec4600088d9fae39
Instruction ID: b1850b9d845a4b7b1ef33432768e61f6936bd42507e94a99f2e2d4c074ff4057
Opcode Fuzzy Hash: 9b298aaea292c1306737245ebaf89eee88d932f02e0e3e31ec4600088d9fae39
Instruction Fuzzy Hash: 8041843261C68382E750AF51E4546AEB361FF84754FC40232EAAD476D9EF7CE548C760

Function 00007FF7DDF12020 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7DDF1204B
SelectObject.GDI32 ref: 00007FF7DDF12096
DrawTextW.USER32 ref: 00007FF7DDF120B9
SelectObject.GDI32 ref: 00007FF7DDF120CF
ReleaseDC.USER32 ref: 00007FF7DDF120DF
MoveWindow.USER32 ref: 00007FF7DDF1212F
MoveWindow.USER32 ref: 00007FF7DDF1216F
MoveWindow.USER32 ref: 00007FF7DDF121C2
MoveWindow.USER32 ref: 00007FF7DDF1220A

Strings

P%, xrefs: 00007FF7DDF120A3

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: aae4e62fcfd093211e570d6b90d2c8fdd41e88a62d8dc34d7df732e47f0cc643
Instruction ID: 2938a4356892442f5527c4814ffba5eb541b6bf1725a32880f741c42024670a8
Opcode Fuzzy Hash: aae4e62fcfd093211e570d6b90d2c8fdd41e88a62d8dc34d7df732e47f0cc643
Instruction Fuzzy Hash: 3151EA225187A186D6389F26B0181BEF7A1FB98B61F804126EFDE43744EF7CD085DB20

Function 00007FF7DDF112B0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 106COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7DDF1134C
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7DDF112E2
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7DDF113E2
fread, xrefs: 00007FF7DDF113E9
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7DDF11312
malloc, xrefs: 00007FF7DDF11353
fseek, xrefs: 00007FF7DDF11319

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: 893327c25544294db0ce57e4e76bbee404f2b937f3b806eda0ecf8d55bcdde89
Instruction ID: 5df36721c4bccc45d5c0cf781054db020b00f46b98aa42f4c099322cf34b34d7
Opcode Fuzzy Hash: 893327c25544294db0ce57e4e76bbee404f2b937f3b806eda0ecf8d55bcdde89
Instruction Fuzzy Hash: 81417A22A0CA5282EA24FB15E8406AEE3A1FB45B94FC44433DE6D07B55FE7CE581C730

Function 00007FF7DDF11050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7DDF110F1
1.2.11, xrefs: 00007FF7DDF1107E
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF7DDF11249
malloc, xrefs: 00007FF7DDF110F8, 00007FF7DDF11126
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF7DDF110B4
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF7DDF1111F

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: Message
String ID: 1.2.11$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-1060636955
Opcode ID: a83e5eb93ccfa6d0927fc27f652f3a0c4e2fd39bdd86852540d8cc23d0df4bb2
Instruction ID: 97bc2331d6d3929b1bb11d1f2a9ac7ec160fa9d15dfd2cea26a249751bde0244
Opcode Fuzzy Hash: a83e5eb93ccfa6d0927fc27f652f3a0c4e2fd39bdd86852540d8cc23d0df4bb2
Instruction Fuzzy Hash: 69519D22A0D68285EA60BB51E8403BEE291BB85798FC44137EE6D87795FF3CE545C730

Function 00007FF7DDF170F0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 104COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7DDF1101D), ref: 00007FF7DDF1718F
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7DDF1101D), ref: 00007FF7DDF171DF

Strings

Failed to encode wchar_t as UTF-8., xrefs: 00007FF7DDF17207
WideCharToMultiByte, xrefs: 00007FF7DDF17227
Out of memory., xrefs: 00007FF7DDF17210
win32_utils_to_utf8, xrefs: 00007FF7DDF17217
Failed to get UTF-8 buffer size., xrefs: 00007FF7DDF17220

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 626452242-27947307
Opcode ID: 3b661c5e2e4b14a94d3802b2374cba9a1ba559b57611e88a2a5647d6c947ac9c
Instruction ID: 30245b1e33e1a29a5d1b35b13d78a4e548993efcbaf99a18c0acea051d23f076
Opcode Fuzzy Hash: 3b661c5e2e4b14a94d3802b2374cba9a1ba559b57611e88a2a5647d6c947ac9c
Instruction Fuzzy Hash: 5341803260CB8281D620AF15A44016EE7A4FB94794FD44136EEED47BA4EF7CD0568B20

Function 00007FF7DDF16AC0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 93processsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7DDF17490: MultiByteToWideChar.KERNEL32 ref: 00007FF7DDF174CA

Part of subcall function 00007FF7DDF229DC: SetConsoleCtrlHandler.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF7DDF24CC0), ref: 00007FF7DDF22A49

Part of subcall function 00007FF7DDF229DC: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF7DDF24CC0), ref: 00007FF7DDF22A64

GetStartupInfoW.KERNEL32 ref: 00007FF7DDF16B47

Part of subcall function 00007FF7DDF24C20: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF24C34

Part of subcall function 00007FF7DDF22590: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF225F7

GetCommandLineW.KERNEL32 ref: 00007FF7DDF16BCF
CreateProcessW.KERNEL32 ref: 00007FF7DDF16C11
WaitForSingleObject.KERNEL32 ref: 00007FF7DDF16C25
GetExitCodeProcess.KERNEL32 ref: 00007FF7DDF16C35

Strings

Error creating child process!, xrefs: 00007FF7DDF16C41
CreateProcessW, xrefs: 00007FF7DDF16C48

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlErrorExitHandlerInfoLastLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Error creating child process!
API String ID: 1742298069-3524285272
Opcode ID: 34d3020eba07ba2d97dcf2fb01128670c0ea838258e1194f51c279e9e3a7fdcb
Instruction ID: 6f451144c9c03a1d9dc1a0108c77f4b7f66b2b893fabd62d75bc7cd73f3da734
Opcode Fuzzy Hash: 34d3020eba07ba2d97dcf2fb01128670c0ea838258e1194f51c279e9e3a7fdcb
Instruction Fuzzy Hash: DC414F32A0C68286D620FB64E4552AEF3A0FF94354FC0453AE6AD43B99FF7CE0558B50

Function 00007FF7DDF175A0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00007FF7DDF1353B), ref: 00007FF7DDF175E1

Part of subcall function 00007FF7DDF12610: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7DDF17233,?,?,?,?,?,?,?,?,?,?,?,00007FF7DDF1101D), ref: 00007FF7DDF12644
Part of subcall function 00007FF7DDF12610: MessageBoxW.USER32 ref: 00007FF7DDF1271C

WideCharToMultiByte.KERNEL32(?,00007FF7DDF1353B), ref: 00007FF7DDF17655

Strings

Failed to encode wchar_t as UTF-8., xrefs: 00007FF7DDF1765F
WideCharToMultiByte, xrefs: 00007FF7DDF175F5, 00007FF7DDF17666
Out of memory., xrefs: 00007FF7DDF1761B
win32_utils_to_utf8, xrefs: 00007FF7DDF17622
Failed to get UTF-8 buffer size., xrefs: 00007FF7DDF175EE

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 3723044601-27947307
Opcode ID: 876e027a4cacc52fbedee53ab5b0883d55d26bfb3ce5297f7f74826ea4c11575
Instruction ID: 2f4d6e6a59b492d03fc4a5a7767da5d960783ff11161deb2d20ba14b58c0b349
Opcode Fuzzy Hash: 876e027a4cacc52fbedee53ab5b0883d55d26bfb3ce5297f7f74826ea4c11575
Instruction Fuzzy Hash: E0218921B0CB4695EA10AF2AA85006DB3A1BB94BD0FD44537CAAD437A4FFBCE445C320

Function 00007FF7DDF17690 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 99COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF7DDF17725
MultiByteToWideChar.KERNEL32 ref: 00007FF7DDF17767

Strings

Failed to decode wchar_t from UTF-8, xrefs: 00007FF7DDF1778C
Failed to get wchar_t buffer size., xrefs: 00007FF7DDF177A5
MultiByteToWideChar, xrefs: 00007FF7DDF177AC
Out of memory., xrefs: 00007FF7DDF17795
win32_utils_from_utf8, xrefs: 00007FF7DDF1779C

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 626452242-876015163
Opcode ID: d8946689e90d7941f31e770f6102f5168e1351d9c486639fa26d30acca252d06
Instruction ID: 25566c230b1119e215a00f48fa40bb02176c2c06ad61acb03443a8ac7e255836
Opcode Fuzzy Hash: d8946689e90d7941f31e770f6102f5168e1351d9c486639fa26d30acca252d06
Instruction Fuzzy Hash: E8418F32A0DA4282E610EF19B84017EB6A5FB94790FD50236DEAD47BA4FF7CE055C720

Function 00007FF7DDF15FD0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7DDF17490: MultiByteToWideChar.KERNEL32 ref: 00007FF7DDF174CA

ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF7DDF1631F,?,00000000,?,TokenIntegrityLevel), ref: 00007FF7DDF1602F

Part of subcall function 00007FF7DDF12760: MessageBoxW.USER32 ref: 00007FF7DDF12831

Strings

LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7DDF1608A
LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7DDF16043
LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7DDF16006

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
API String ID: 1662231829-3498232454
Opcode ID: 94fa70ff3f4798ae99b7ccfec72e661d9022b619c83774a3babdcd63ded96e46
Instruction ID: 435a620ee54165fa11858c1743c4ea252dd8db483cf2e3bc465c641690db6045
Opcode Fuzzy Hash: 94fa70ff3f4798ae99b7ccfec72e661d9022b619c83774a3babdcd63ded96e46
Instruction Fuzzy Hash: 94318351B1DA8380FA64B725E9553BEE251AF997C4FC84037DA6E42796FE2CE1048730

Function 00007FF7DDF1C420 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF7DDF1C6D2,?,?,?,00007FF7DDF1C3CC,?,?,?,?,00007FF7DDF1C0ED), ref: 00007FF7DDF1C4A5
GetLastError.KERNEL32(?,?,?,00007FF7DDF1C6D2,?,?,?,00007FF7DDF1C3CC,?,?,?,?,00007FF7DDF1C0ED), ref: 00007FF7DDF1C4B3
LoadLibraryExW.KERNEL32(?,?,?,00007FF7DDF1C6D2,?,?,?,00007FF7DDF1C3CC,?,?,?,?,00007FF7DDF1C0ED), ref: 00007FF7DDF1C4DD
FreeLibrary.KERNEL32(?,?,?,00007FF7DDF1C6D2,?,?,?,00007FF7DDF1C3CC,?,?,?,?,00007FF7DDF1C0ED), ref: 00007FF7DDF1C523
GetProcAddress.KERNEL32(?,?,?,00007FF7DDF1C6D2,?,?,?,00007FF7DDF1C3CC,?,?,?,?,00007FF7DDF1C0ED), ref: 00007FF7DDF1C52F

Strings

api-ms-, xrefs: 00007FF7DDF1C4C5

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 1c453ae4bf38a437f7b70d8e644795e8176eb85b810932e67f5fd4f40fb0e1dd
Instruction ID: 9df7200d2cb16ff7890860040edd5c8d89ddc8a5369c2263a0ef741c0e608050
Opcode Fuzzy Hash: 1c453ae4bf38a437f7b70d8e644795e8176eb85b810932e67f5fd4f40fb0e1dd
Instruction Fuzzy Hash: E231AB61A1EA4291EE21BB06A80057DE395FF49BA4FDA0536ED3D4B384FE3CE4418330

Function 00007FF7DDF17490 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF7DDF174CA

Part of subcall function 00007FF7DDF12610: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7DDF17233,?,?,?,?,?,?,?,?,?,?,?,00007FF7DDF1101D), ref: 00007FF7DDF12644
Part of subcall function 00007FF7DDF12610: MessageBoxW.USER32 ref: 00007FF7DDF1271C

MultiByteToWideChar.KERNEL32 ref: 00007FF7DDF17550

Strings

Failed to decode wchar_t from UTF-8, xrefs: 00007FF7DDF1755A
Failed to get wchar_t buffer size., xrefs: 00007FF7DDF174D7
MultiByteToWideChar, xrefs: 00007FF7DDF174DE, 00007FF7DDF17561
Out of memory., xrefs: 00007FF7DDF17512
win32_utils_from_utf8, xrefs: 00007FF7DDF17519

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 3723044601-876015163
Opcode ID: c4110b2de02f7a5ffa56849697405ab86ad6fb27bfc0c3d14c80fc45a7395de6
Instruction ID: 2e618abede470c1160a61eb52283d77223c732bd207949a651fd4b28b8c39736
Opcode Fuzzy Hash: c4110b2de02f7a5ffa56849697405ab86ad6fb27bfc0c3d14c80fc45a7395de6
Instruction Fuzzy Hash: DD216521B0CA4291EB50EB19F44016EE3A1FB947C4FD84532DBAC43BA9FE7CE5468710

Function 00007FF7DDF32280 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7DDF322B1
GetLastError.KERNEL32 ref: 00007FF7DDF322BD
CloseHandle.KERNEL32 ref: 00007FF7DDF322D5
CreateFileW.KERNEL32 ref: 00007FF7DDF32300
WriteConsoleW.KERNEL32 ref: 00007FF7DDF3231F

Strings

CONOUT$, xrefs: 00007FF7DDF322E1

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: bcad4bfd22897d90546c83000e2a55e68d64a70218818eb37a662133ca5c2491
Instruction ID: abed82b9259262e5fddd24c9c7ea18feb8f3155ad90b7c040bb8be8819fd76cf
Opcode Fuzzy Hash: bcad4bfd22897d90546c83000e2a55e68d64a70218818eb37a662133ca5c2491
Instruction Fuzzy Hash: C3118131A1CB4186E350AB52F85472DA2A0FB88BE4FC50235EA6D87794EFBCE8448750

Function 00007FF7DDF12230 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00007FF7DDF1241F), ref: 00007FF7DDF12268
DialogBoxIndirectParamW.USER32 ref: 00007FF7DDF1232C
DeleteObject.GDI32 ref: 00007FF7DDF1235F
DestroyIcon.USER32 ref: 00007FF7DDF12371

Strings

Unhandled exception in script, xrefs: 00007FF7DDF12298

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 2617642130cb3c2885c8050bcfcfe7c95971074e5b05e943a74e7e47920840ec
Instruction ID: 88c5f1c41976d8e41d1f7487c65d7122e1cef17d1e9145e7ca93994c109f0d55
Opcode Fuzzy Hash: 2617642130cb3c2885c8050bcfcfe7c95971074e5b05e943a74e7e47920840ec
Instruction Fuzzy Hash: F6313F72A0DA8285EB24EB61E8551FDA360FF88794FC40136EA5E4BB59EF3CD145C720

Function 00007FF7DDF12610 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7DDF17233,?,?,?,?,?,?,?,?,?,?,?,00007FF7DDF1101D), ref: 00007FF7DDF12644

Part of subcall function 00007FF7DDF16FA0: GetLastError.KERNEL32(00000000,00007FF7DDF12690), ref: 00007FF7DDF16FC7
Part of subcall function 00007FF7DDF16FA0: FormatMessageW.KERNEL32(00000000,00007FF7DDF12690), ref: 00007FF7DDF16FF6

Part of subcall function 00007FF7DDF17490: MultiByteToWideChar.KERNEL32 ref: 00007FF7DDF174CA

MessageBoxW.USER32 ref: 00007FF7DDF1271C
MessageBoxA.USER32 ref: 00007FF7DDF12738

Strings

%s%s: %s, xrefs: 00007FF7DDF1269D
Fatal error detected, xrefs: 00007FF7DDF126F0, 00007FF7DDF1272A

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: Message$ErrorLast$ByteCharFormatMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 2806210788-2410924014
Opcode ID: 400fce4ea561395ecb7c9931c898940bca1409bd045f3b8d566701ceccfa415d
Instruction ID: 218cdf2052497cc16d5c7fa349884f9744e6b3b79a35d36cde9781b2815e9f1a
Opcode Fuzzy Hash: 400fce4ea561395ecb7c9931c898940bca1409bd045f3b8d566701ceccfa415d
Instruction Fuzzy Hash: 7F31237262C68291EA30AB10F4517EEA364FB94788FC44037E69D07A99EF7CD245CB60

Function 00007FF7DDF243E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7DDF243FC
GetProcAddress.KERNEL32 ref: 00007FF7DDF24412
FreeLibrary.KERNEL32 ref: 00007FF7DDF2442F

Strings

mscoree.dll, xrefs: 00007FF7DDF243F3
CorExitProcess, xrefs: 00007FF7DDF2440B

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 5a160c9bdce1f9d43ea406b437463d4fa60eb1ab7842eb725466103b76bc2848
Instruction ID: d009d97e6740d08fce67d2d9cb8f46027336f0a4f7614effe228363c32af70d7
Opcode Fuzzy Hash: 5a160c9bdce1f9d43ea406b437463d4fa60eb1ab7842eb725466103b76bc2848
Instruction Fuzzy Hash: E6F05461B1D64281EB48AF10E89437CA765EF84B41FC51437D96F86264FFBCE588C320

Function 00007FF7DDF27748 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF2778A
GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7DDF27707,?,?,?,00007FF7DDF2136B), ref: 00007FF7DDF27848
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7DDF27707,?,?,?,00007FF7DDF2136B), ref: 00007FF7DDF278D2

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: abf261f407780d73d122f22d6a8d00088c8cb71f7aeeba393a2ce32a2c31ccc9
Instruction ID: 08d20f368288646b940525ad931f8b2c6e4a30e747629f122368f3f62d644bce
Opcode Fuzzy Hash: abf261f407780d73d122f22d6a8d00088c8cb71f7aeeba393a2ce32a2c31ccc9
Instruction Fuzzy Hash: 3781AF22E1C65285F710BB6598402BDAAA0FF44B98FD44133DEAE97691FF3CA845C730

Function 00007FF7DDF33854 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7DDF3387C
_set_statfp.LIBCMT ref: 00007FF7DDF33897
_set_statfp.LIBCMT ref: 00007FF7DDF338B3
_set_statfp.LIBCMT ref: 00007FF7DDF338EF

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: b937517b4f482d0939308dbd49bace3de9952a95ba32e0c18fc8e236c2565ddb
Instruction ID: ba812ee5e5c35f46e5d46467f3502f31d4f7eb501e388d65077052ad793d17fd
Opcode Fuzzy Hash: b937517b4f482d0939308dbd49bace3de9952a95ba32e0c18fc8e236c2565ddb
Instruction Fuzzy Hash: 3A119423E1CA4343F658B1A8E45237DD0D06F54374FDA8636EB7E062F6AE9CA8844331

Function 00007FF7DDF2A940 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF2AC1F

Part of subcall function 00007FF7DDF30670: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF3068D

Strings

ccs, xrefs: 00007FF7DDF2AB5A
UTF-8, xrefs: 00007FF7DDF2AB9E
UTF-16LEUNICODE, xrefs: 00007FF7DDF2ABBD

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 55788242df50e1a30cd54507ff4bf163bc38528b1732f9cc2afaa672e73b8d51
Instruction ID: 5f3b4ee774e0f44a74ae3b781e409e9c2b36b4714a8f6a6cbd1bd242143a71e1
Opcode Fuzzy Hash: 55788242df50e1a30cd54507ff4bf163bc38528b1732f9cc2afaa672e73b8d51
Instruction Fuzzy Hash: D981A373E0C202A5F775BE258A1027CBEA1AF11B48FD58037CA2DD7294FB2DE841D621

Function 00007FF7DDF124C0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7DDF17490: MultiByteToWideChar.KERNEL32 ref: 00007FF7DDF174CA

MessageBoxW.USER32 ref: 00007FF7DDF125C7
MessageBoxA.USER32 ref: 00007FF7DDF125E3

Strings

%s%s: %s, xrefs: 00007FF7DDF12548
Fatal error detected, xrefs: 00007FF7DDF1259B, 00007FF7DDF125D5

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 1878133881-2410924014
Opcode ID: 69d8018c69fa0ba47995e0ce162d6b42525d4d2d5850a1053315e8c6180101b4
Instruction ID: 0af93ec3949f997c47224033f5f0dc350dc535f89f6aa4eff45f60891617c5be
Opcode Fuzzy Hash: 69d8018c69fa0ba47995e0ce162d6b42525d4d2d5850a1053315e8c6180101b4
Instruction Fuzzy Hash: 2131327262C68291E620B710E4517EEA364FF94788FC44037EA9D47A99EF3CD349CB60

Function 00007FF7DDF13A40 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00007FF7DDF1353B), ref: 00007FF7DDF13A71

Part of subcall function 00007FF7DDF12610: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7DDF17233,?,?,?,?,?,?,?,?,?,?,?,00007FF7DDF1101D), ref: 00007FF7DDF12644
Part of subcall function 00007FF7DDF12610: MessageBoxW.USER32 ref: 00007FF7DDF1271C

Strings

GetModuleFileNameW, xrefs: 00007FF7DDF13A82
Failed to convert executable path to UTF-8., xrefs: 00007FF7DDF13AAA
Failed to get executable path., xrefs: 00007FF7DDF13A7B

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: ErrorFileLastMessageModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
API String ID: 2581892565-1977442011
Opcode ID: 92334261f092cf2d1155b54ab5fcfe7084b86c2a9d62fcc169c45073f1b6a509
Instruction ID: 54e64801ae2a0db18e52eda835cb8b269d2a99a4308599f48f09452a2c2430fb
Opcode Fuzzy Hash: 92334261f092cf2d1155b54ab5fcfe7084b86c2a9d62fcc169c45073f1b6a509
Instruction Fuzzy Hash: D2018411B1DA4281FA60B720E8553BDA391BF88780FC40433D86D8A39AFE5CF1498730

Function 00007FF7DDF2A16C Relevance: 6.2, APIs: 4, Instructions: 161COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7DDF2A259
_get_daylight.LIBCMT ref: 00007FF7DDF2A26A
_get_daylight.LIBCMT ref: 00007FF7DDF2A27B
_isindst.LIBCMT ref: 00007FF7DDF2A341

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 1e89f32c8738a6adba9b4243f60db3606398dcc5d4dd087393c0fa2c4f991abe
Instruction ID: 7a4637d2e25e4c532300ac1e11da28b11cb6d3847ff231e7eb8c277074a9d2d5
Opcode Fuzzy Hash: 1e89f32c8738a6adba9b4243f60db3606398dcc5d4dd087393c0fa2c4f991abe
Instruction Fuzzy Hash: 19513C73F0C1129AFB38EB6898415BCBB61AB04358FD40137DE2D96AD5FB3DA9458710

Function 00007FF7DDF30CAC Relevance: 6.2, APIs: 4, Instructions: 159COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF30CED
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF30D6D
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF30DC1
_get_daylight.LIBCMT ref: 00007FF7DDF30E19

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_get_daylight
String ID:
API String ID: 72036449-0
Opcode ID: 37c70a1ef6a079ec95ee04a40b31ce5c5df444ed978d8de4477b5a7606ce7098
Instruction ID: 14c8d25c52d00d4f188454b164078a1aa620e3a3acf2f647bc62cd7b315a7abe
Opcode Fuzzy Hash: 37c70a1ef6a079ec95ee04a40b31ce5c5df444ed978d8de4477b5a7606ce7098
Instruction Fuzzy Hash: 4751A132E8C20386F7697E28941537EE690DB41754FDA8437EA2D462D5EEACF8808761

Function 00007FF7DDF20030 Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF7DDF20063
GetFileInformationByHandle.KERNEL32 ref: 00007FF7DDF200C5
GetLastError.KERNEL32 ref: 00007FF7DDF20156
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF7DDF1FF73), ref: 00007FF7DDF201A2

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 6dc1fe3e67db78ba05ff380342028693a4fa93987a2dd2de1e1e4c9ede446661
Instruction ID: f0a07767b702adcc795aa788d57c1d1e494cb845efe53a4849905d081c9135bc
Opcode Fuzzy Hash: 6dc1fe3e67db78ba05ff380342028693a4fa93987a2dd2de1e1e4c9ede446661
Instruction Fuzzy Hash: B4518E23A086418AFB14EFB0D8513BDABA1EB44B58FD44136DE1D9B799FF38D4858360

Function 00007FF7DDF11F60 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF7DDF11F94
SetWindowLongPtrW.USER32 ref: 00007FF7DDF11FB6
GetWindowLongPtrW.USER32 ref: 00007FF7DDF11FE0
InvalidateRect.USER32 ref: 00007FF7DDF12000

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 4a3e62a95b454dadb353150d352b283421c9113fe456df8e506f44dbb2775c65
Instruction ID: b52def1ecf736bf550e07cd8dc95127b7bd5222530722d38e177c9e8152bca2b
Opcode Fuzzy Hash: 4a3e62a95b454dadb353150d352b283421c9113fe456df8e506f44dbb2775c65
Instruction Fuzzy Hash: 13110C21E0C18642FB54B76AF5443BD9252EFC4BC0FC84432E96907B8DEE7DE4C58220

Function 00007FF7DDF1DD10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 145COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF1DD46
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF1DF0E

Strings

, xrefs: 00007FF7DDF1DE96

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-3916222277
Opcode ID: 7b11439edd9adaac7c4e013e5372446c9314c2fb78d936ab9d4898aaada9fb84
Instruction ID: 63acf05f5a3d0b2fdab2bfc9821d54514f68c5b0f0672477854ab369a57072db
Opcode Fuzzy Hash: 7b11439edd9adaac7c4e013e5372446c9314c2fb78d936ab9d4898aaada9fb84
Instruction Fuzzy Hash: AF518132D0C30286E768AF28884437CB7B5FB25B4AFD41137CA2A46295EF2DE585C730

Function 00007FF7DDF28C64 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF28CA7

Strings

e+000, xrefs: 00007FF7DDF28D4C
gfff, xrefs: 00007FF7DDF28DC9

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: 9b165a6006e8c8b6c2028c6ade3b602bb750e690e74d828472ce81c508c8919f
Instruction ID: 1c98a558dabaf568b0572580e3f9b642354048419b2da629ab54a2c24a4939ee
Opcode Fuzzy Hash: 9b165a6006e8c8b6c2028c6ade3b602bb750e690e74d828472ce81c508c8919f
Instruction Fuzzy Hash: A5510A62B1C7C186E7659B25984036DEE91EB51B90FC89632C6AC87BD6EE2CD444C710

Function 00007FF7DDF148D0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 123COMMON

Download Yara Rule

APIs

mbstowcs.LIBCMT ref: 00007FF7DDF149B7

Strings

pyi-, xrefs: 00007FF7DDF1496C
Failed to convert Wflag %s using mbstowcs (invalid multibyte string), xrefs: 00007FF7DDF14AD2

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: mbstowcs
String ID: Failed to convert Wflag %s using mbstowcs (invalid multibyte string)$pyi-
API String ID: 103190477-3625900369
Opcode ID: 44298b2597042ed1f4765d06e6ba261b942b1130dda733e6c1315838163e3a23
Instruction ID: 8c5e058c410d3243189312a52e9dac8af3793916d43ea7fdd9ceeea4ee4b9710
Opcode Fuzzy Hash: 44298b2597042ed1f4765d06e6ba261b942b1130dda733e6c1315838163e3a23
Instruction Fuzzy Hash: 9851BE22A0C60245FB14BB25E4553BEA6A5EF84B94FC04137DA6D473DAFE7CE84183B0

Function 00007FF7DDF239A8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF239DA

Part of subcall function 00007FF7DDF259CC: HeapFree.KERNEL32 ref: 00007FF7DDF259E2

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7DDF1A6C5), ref: 00007FF7DDF239F8

Strings

C:\Users\user\Desktop\diCTAJuHTs.exe, xrefs: 00007FF7DDF239E6

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: FileFreeHeapModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\diCTAJuHTs.exe
API String ID: 13503096-2059439171
Opcode ID: 42781f58a5dd844ab671a5851bd5fe7d0f4f51e497937ca85619c6fe76df429d
Instruction ID: dcf6a938023ff3a2571f4c05d96adb84314ae04c180d55c194ed89c7137918d0
Opcode Fuzzy Hash: 42781f58a5dd844ab671a5851bd5fe7d0f4f51e497937ca85619c6fe76df429d
Instruction Fuzzy Hash: EE416F76A0D71286E714FF21A4410BCBAA4EB44798BD4403BE96E8BB95FE3DE5418720

Function 00007FF7DDF274EC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF7DDF27603
GetLastError.KERNEL32 ref: 00007FF7DDF27625

Strings

U, xrefs: 00007FF7DDF275AF

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: f42627c61a7f25b683248ff20e1504dd0ed5ade7a377c0ec61c80a04a1b4700a
Instruction ID: e3b58768d85438ec954aa91a313393bb03d6ef191ddefdae6d36ad0e4aa38e90
Opcode Fuzzy Hash: f42627c61a7f25b683248ff20e1504dd0ed5ade7a377c0ec61c80a04a1b4700a
Instruction Fuzzy Hash: C241B162A1CA4182DB20AF25E4453AEBBA0FB88794FC54032EE9D87788FF3CD441C750

Function 00007FF7DDF29DD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF7DDF29E14
GetCurrentDirectoryW.KERNEL32 ref: 00007FF7DDF29E66

Strings

:, xrefs: 00007FF7DDF29E2A

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: c4a2b5a5518626f88fa0b707d726c254c873bc95232582f93e82de54877482e1
Instruction ID: dfdefd0c5bb6611df7ba0151c86e282c8b8ca0cddc55648b2df79b0b41a6ac0e
Opcode Fuzzy Hash: c4a2b5a5518626f88fa0b707d726c254c873bc95232582f93e82de54877482e1
Instruction Fuzzy Hash: 8021B472A0CA4281FB20AB15D44426DB7B1FB88B54FC54036DAAD87684FF7CEA458771

Function 00007FF7DDF12870 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7DDF17490: MultiByteToWideChar.KERNEL32 ref: 00007FF7DDF174CA

MessageBoxW.USER32 ref: 00007FF7DDF12941
MessageBoxA.USER32 ref: 00007FF7DDF1295D

Strings

Error detected, xrefs: 00007FF7DDF12915, 00007FF7DDF1294F

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error detected
API String ID: 1878133881-3513342764
Opcode ID: 5ed7caf57bd188301ead484277fc77409bb9e70f87c7d7e6d20278c1c0f354ae
Instruction ID: 2f47e17f16ed5f048048bbb1688cb296a60e95b08b4b98da9607ab3eae89f76d
Opcode Fuzzy Hash: 5ed7caf57bd188301ead484277fc77409bb9e70f87c7d7e6d20278c1c0f354ae
Instruction Fuzzy Hash: 0121887262C68281EB30AB10F4517EEA354FB98788FC04137EA9D47A99EF3CD205C760

Function 00007FF7DDF2982C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF7DDF29865
CompareStringW.KERNEL32 ref: 00007FF7DDF298ED

Strings

CompareStringEx, xrefs: 00007FF7DDF29848, 00007FF7DDF29859

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: CompareStringtry_get_function
String ID: CompareStringEx
API String ID: 3328479835-2590796910
Opcode ID: b38ec196671d9afb90d7824daebd837d8761de2e7fc61caa139df7cd0b58523b
Instruction ID: d32772156a238f5a9cf17ec6ee1a2b6e981ce51b61d1949f3a1d0d17df296385
Opcode Fuzzy Hash: b38ec196671d9afb90d7824daebd837d8761de2e7fc61caa139df7cd0b58523b
Instruction Fuzzy Hash: 0F113E32A0CB8186D764DB15F4402AAB7A1FBC9BD0F944136EE9D83B19EF7CD5908B40

Function 00007FF7DDF29A98 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF7DDF29AD1
LCMapStringW.KERNEL32 ref: 00007FF7DDF29B59

Strings

LCMapStringEx, xrefs: 00007FF7DDF29AB4, 00007FF7DDF29AC5

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: f6cc7dc4c18284a5f607d832a4838958271fd3e644fb08c6973070f79d4d0757
Instruction ID: da22a56522ffc0e8a6c87c2d777cdcb3e2c00aefd9e8fb87d34318e61d0b6ff6
Opcode Fuzzy Hash: f6cc7dc4c18284a5f607d832a4838958271fd3e644fb08c6973070f79d4d0757
Instruction Fuzzy Hash: 03113E32A0CB8186D760DB15B4402AAF7A1FBC9B90F944136EE9D83B19EF7CD5808B40

Function 00007FF7DDF2A7E8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7DDF2A818

Strings

:, xrefs: 00007FF7DDF2A830

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: :
API String ID: 3215553584-336475711
Opcode ID: ac9e6cf1ee5af4ee396f22b42a5cc566f50753507a16ff94a4f2570f0bd7836c
Instruction ID: 57f427410a80a7a5b842e72b8d9e6f1135fa56572f6b62eb37b70c98506f0082
Opcode Fuzzy Hash: ac9e6cf1ee5af4ee396f22b42a5cc566f50753507a16ff94a4f2570f0bd7836c
Instruction Fuzzy Hash: FF01AD6390C20286F730BB60A4512BEB7A0EF48754FC04037D96D86695FF3CE5098A34

Function 00007FF7DDF29A34 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF7DDF29A65
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,-00000018,00007FF7DDF25D0E,?,?,?,00007FF7DDF25C06,?,?,?,00007FF7DDF20C32,?,?,00000000,00007FF7DDF13BA9), ref: 00007FF7DDF29A7F

Strings

InitializeCriticalSectionEx, xrefs: 00007FF7DDF29A59

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: fc613323f04bb19a95fccbb7a97f89168904b09938c4ff9a868c3f34c5850709
Instruction ID: b6e40be56f6c4ef84f7b194ac3aad211e44384d488370f4dc72464d352c9775a
Opcode Fuzzy Hash: fc613323f04bb19a95fccbb7a97f89168904b09938c4ff9a868c3f34c5850709
Instruction Fuzzy Hash: 46F05E22B1D74282E614AB41F4400ADA662EF88B90FC95437EE6D07B54EEBCE9958760

Function 00007FF7DDF299E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF7DDF29A09
TlsSetValue.KERNEL32(?,?,00000000,00007FF7DDF286AA,?,?,00000000,00007FF7DDF1FC79,?,?,?,?,00007FF7DDF259F1), ref: 00007FF7DDF29A20

Strings

FlsSetValue, xrefs: 00007FF7DDF299F6

Memory Dump Source

Source File: 00000000.00000002.2086673379.00007FF7DDF11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7DDF10000, based on PE: true

Associated: 00000000.00000002.2086661250.00007FF7DDF10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086694381.00007FF7DDF35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF47000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086712402.00007FF7DDF56000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086743695.00007FF7DDF58000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ddf10000_diCTAJuHTs.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: bd8a3b7dfe699e95648d1a6f597fab97cbf9c501d19f7925580fd405873d9e1a
Instruction ID: 8035b988ea93d5735858fcdc32786644fe310aa02ac6f6fa248fd4cbbab2b071
Opcode Fuzzy Hash: bd8a3b7dfe699e95648d1a6f597fab97cbf9c501d19f7925580fd405873d9e1a
Instruction Fuzzy Hash: D4E06D62E1D60382EA086B55F8000BCA222EF88780FCA4033D93D4B354FEBCE8D4C720

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report diCTAJuHTs.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: diCTAJuHTs.exePID: 7120, Parent PID: 1028

General

Chronological Activities

Disassembly

Analysis Process: diCTAJuHTs.exePID: 7120, Parent PID: 1028COMMON

Execution Graph

Graph

Executed Functions

Function 00007FF7DDF117A0 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 144COMMON

Control-flow Graph

Function 00007FF7DDF30F7C Relevance: 13.8, APIs: 9, Instructions: 273fileCOMMON

Control-flow Graph

Function 00007FF7DDF11000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 274COMMON

Windows Analysis Report
diCTAJuHTs.exe

Function 00007FF7DDF117A0 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 144
COMMON

Function 00007FF7DDF30F7C Relevance: 13.8, APIs: 9, Instructions: 273
fileCOMMON

Function 00007FF7DDF11000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 274
COMMON

Function 00007FF7DDF26408 Relevance: 10.8, APIs: 7, Instructions: 291
COMMONLIBRARYCODE

Function 00007FF7DDF1A754 Relevance: 7.6, APIs: 5, Instructions: 94
COMMON

Function 00007FF7DDF12760 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55
windowCOMMON

Function 00007FF7DDF24394 Relevance: 4.5, APIs: 3, Instructions: 19
COMMON

Function 00007FF7DDF1C980 Relevance: 3.2, APIs: 2, Instructions: 175
COMMONLIBRARYCODE

Function 00007FF7DDF26ABC Relevance: 3.0, APIs: 2, Instructions: 42
COMMON

Function 00007FF7DDF25B24 Relevance: 2.6, APIs: 2, Instructions: 55
COMMON

Function 00007FF7DDF26860 Relevance: 1.6, APIs: 1, Instructions: 104
COMMONLIBRARYCODE

Function 00007FF7DDF2309C Relevance: 1.6, APIs: 1, Instructions: 89
COMMON

Function 00007FF7DDF16CF0 Relevance: 1.6, APIs: 1, Instructions: 85
COMMON

Function 00007FF7DDF262EC Relevance: 1.6, APIs: 1, Instructions: 74
COMMONLIBRARYCODE

Function 00007FF7DDF269CC Relevance: 1.6, APIs: 1, Instructions: 67
COMMON