Edit tour

Windows Analysis Report
90m2xwxCOf.exe

Overview

General Information

Sample name:	90m2xwxCOf.exe renamed because original name is a hash value
Original sample name:	3327701929db65a98836f1241b3218ff.exe
Analysis ID:	1580927
MD5:	3327701929db65a98836f1241b3218ff
SHA1:	43e1532366295da9e3729355fddb0c1be60065e0
SHA256:	77b74d8f3ad5c7058ac3742324341f17060d89a82b3545bbd357b191e9a2b5ef
Tags:	exeuser-abuse_ch
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Tries to detect virtualization through RDTSC time measurements

Contains functionality to query CPU information (cpuid)

Detected potential crypto function

Found potential string decryption / allocating functions

PE file contains an invalid checksum

Program does not show much activity (idle)

Classification

Process Tree

System is w10x64

90m2xwxCOf.exe (PID: 1384 cmdline: "C:\Users\user\Desktop\90m2xwxCOf.exe" MD5: 3327701929DB65A98836F1241B3218FF)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 90m2xwxCOf.exe	ReversingLabs: Detection: 34%
Source: 90m2xwxCOf.exe	Virustotal: Detection: 19%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 94.8% probability

Source: 90m2xwxCOf.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Code function: 1_2_00007FF716211740	1_2_00007FF716211740
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Code function: 1_2_00007FF716229728	1_2_00007FF716229728
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Code function: 1_2_00007FF716218794	1_2_00007FF716218794
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Code function: 1_2_00007FF716211F60	1_2_00007FF716211F60
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Code function: 1_2_00007FF716201000	1_2_00007FF716201000
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Code function: 1_2_00007FF716209800	1_2_00007FF716209800
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Code function: 1_2_00007FF716221874	1_2_00007FF716221874
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Code function: 1_2_00007FF7162208C8	1_2_00007FF7162208C8
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Code function: 1_2_00007FF7162240AC	1_2_00007FF7162240AC
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Code function: 1_2_00007FF7162180E4	1_2_00007FF7162180E4
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Code function: 1_2_00007FF716211D54	1_2_00007FF716211D54
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Code function: 1_2_00007FF716215D30	1_2_00007FF716215D30
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Code function: 1_2_00007FF71621E570	1_2_00007FF71621E570
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Code function: 1_2_00007FF716249D66	1_2_00007FF716249D66
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Code function: 1_2_00007FF7162135A0	1_2_00007FF7162135A0
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Code function: 1_2_00007FF716225E7C	1_2_00007FF716225E7C
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Code function: 1_2_00007FF716219EA0	1_2_00007FF716219EA0
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Code function: 1_2_00007FF71621DEF0	1_2_00007FF71621DEF0
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Code function: 1_2_00007FF716211B50	1_2_00007FF716211B50
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Code function: 1_2_00007FF716223C10	1_2_00007FF716223C10
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Code function: 1_2_00007FF716212C10	1_2_00007FF716212C10
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Code function: 1_2_00007FF716225C00	1_2_00007FF716225C00
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Code function: 1_2_00007FF716226418	1_2_00007FF716226418
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Code function: 1_2_00007FF7162208C8	1_2_00007FF7162208C8
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Code function: 1_2_00007FF71620A47B	1_2_00007FF71620A47B
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Code function: 1_2_00007FF71620ACAD	1_2_00007FF71620ACAD
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Code function: 1_2_00007FF716211944	1_2_00007FF716211944
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Code function: 1_2_00007FF716226964	1_2_00007FF716226964
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Code function: 1_2_00007FF716212164	1_2_00007FF716212164
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Code function: 1_2_00007FF7162139A4	1_2_00007FF7162139A4
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Code function: 1_2_00007FF7162089E0	1_2_00007FF7162089E0
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Code function: 1_2_00007FF71621DA5C	1_2_00007FF71621DA5C
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Code function: 1_2_00007FF71620A2DB	1_2_00007FF71620A2DB
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Code function: 1_2_000002A639ECFBD8	1_2_000002A639ECFBD8
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Code function: 1_2_000002A639EC3AD8	1_2_000002A639EC3AD8
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Code function: 1_2_000002A639ECD9AC	1_2_000002A639ECD9AC

Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Code function: String function: 00007FF716202710 appears 52 times
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Code function: String function: 00007FF7162EF548 appears 77 times

Source: 90m2xwxCOf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal56.evad.winEXE@1/0@0/0

Source: 90m2xwxCOf.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 90m2xwxCOf.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\90m2xwxCOf.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 90m2xwxCOf.exe	ReversingLabs: Detection: 34%
Source: 90m2xwxCOf.exe	Virustotal: Detection: 19%

Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\90m2xwxCOf.exe	Section loaded: wintypes.dll	Jump to behavior

Source: 90m2xwxCOf.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 90m2xwxCOf.exe

Static file information: File size 3273105 > 1048576

Source: 90m2xwxCOf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 90m2xwxCOf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 90m2xwxCOf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 90m2xwxCOf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 90m2xwxCOf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 90m2xwxCOf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 90m2xwxCOf.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: 90m2xwxCOf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: 90m2xwxCOf.exe

Static PE information: real checksum: 0x712ccf should be: 0x322503

Source: 90m2xwxCOf.exe

Static PE information: section name: .text entropy: 7.308139118973473

Malware Analysis System Evasion

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\90m2xwxCOf.exe

RDTSC instruction interceptor: First address: 7FF716262B1B second address: 7FF716261D6A instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 dec eax 0x00000004 add ebp, 01h 0x00000007 popfd 0x00000008 dec eax 0x00000009 lea ebp, dword ptr [ebp-01h] 0x0000000c dec eax 0x0000000d and eax, 00000001h 0x00000012 dec eax 0x00000013 lea ebx, dword ptr [ebx] 0x00000015 dec eax 0x00000016 xchg esi, edx 0x00000018 dec eax 0x00000019 xchg dword ptr [esp], esi 0x0000001c dec eax 0x0000001d xchg esi, edx 0x0000001f dec eax 0x00000020 lea esp, dword ptr [esp+08h] 0x00000024 dec eax 0x00000025 xchg eax, edx 0x00000026 dec eax 0x00000027 xchg dword ptr [esp], edx 0x0000002a dec eax 0x0000002b xchg eax, edx 0x0000002c dec eax 0x0000002d lea esp, dword ptr [esp+08h] 0x00000031 je 00007F64251C6F24h 0x00000037 popfd 0x00000038 push edi 0x00000039 dec eax 0x0000003a mov edi, dword ptr [esp+08h] 0x0000003e dec eax 0x0000003f lea edi, dword ptr [edi+0Eh] 0x00000042 dec eax 0x00000043 xchg dword ptr [esp+08h], edi 0x00000047 dec eax 0x00000048 mov dword ptr [esp+08h], edi 0x0000004c dec eax 0x0000004d mov edi, dword ptr [esp] 0x00000050 dec eax 0x00000051 lea esp, dword ptr [esp+08h] 0x00000055 je 00007F64252743F2h 0x0000005b jne 00007F64252743ECh 0x00000061 jns 00007F6425100938h 0x00000067 pushfd 0x00000068 push esi 0x00000069 dec eax 0x0000006a mov esi, dword ptr [esp+08h] 0x0000006e dec eax 0x0000006f lea esi, dword ptr [esi+3Dh] 0x00000072 dec eax 0x00000073 xchg dword ptr [esp+08h], esi 0x00000077 dec eax 0x00000078 mov dword ptr [esp+08h], esi 0x0000007c dec eax 0x0000007d mov esi, dword ptr [esp] 0x00000080 dec eax 0x00000081 lea esp, dword ptr [esp+08h] 0x00000085 dec eax 0x00000086 xchg eax, ecx 0x00000087 dec eax 0x00000088 lea esp, dword ptr [esp-08h] 0x0000008c dec eax 0x0000008d mov dword ptr [esp], ecx 0x00000090 dec eax 0x00000091 mov ecx, eax 0x00000093 dec eax 0x00000094 mov eax, dword ptr [esp] 0x00000097 dec eax 0x00000098 xchg eax, edx 0x00000099 dec eax 0x0000009a lea esp, dword ptr [esp-08h] 0x0000009e dec eax 0x0000009f mov dword ptr [esp], eax 0x000000a2 dec eax 0x000000a3 mov eax, edx 0x000000a5 dec eax 0x000000a6 mov edx, dword ptr [esp] 0x000000a9 rdtsc

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\90m2xwxCOf.exe

Code function: 1_2_00007FF716229570 cpuid

1_2_00007FF716229570

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	2 Software Packing	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Deobfuscate/Decode Files or Information	LSASS Memory	111 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
90m2xwxCOf.exe	34%	ReversingLabs
90m2xwxCOf.exe	20%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580927
Start date and time:	2024-12-26 13:15:19 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	90m2xwxCOf.exe renamed because original name is a hash value
Original Sample Name:	3327701929db65a98836f1241b3218ff.exe
Detection:	MAL
Classification:	mal56.evad.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, otelrules.afd.azureedge.net, azureedge-t-prod.trafficmanager.net

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0035.t-0009.t-msedge.net	tFDKSN3TdH.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	V2s8yjvIJw.exe	Get hash	malicious	Iris Stealer	Browse	13.107.246.63
	z3IxCpcpg4.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	GtEVo1eO2p.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	E6rBvcWFWu.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	k6olCJyvIj.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	BeoHXxE7q3.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	4KDKJjRzm8.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	9InQHaM8hT.exe	Get hash	malicious	Stealc	Browse	13.107.246.63
	b0ho5YYSdo.exe	Get hash	malicious	LummaC	Browse	13.107.246.63

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.7226336070570945
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	90m2xwxCOf.exe
File size:	3'273'105 bytes
MD5:	3327701929db65a98836f1241b3218ff
SHA1:	43e1532366295da9e3729355fddb0c1be60065e0
SHA256:	77b74d8f3ad5c7058ac3742324341f17060d89a82b3545bbd357b191e9a2b5ef
SHA512:	196f74c100bdfbe24554599c868f4eb0ff8681fec597bd50ad2c3e77b12d70709b4fa112ed9dd64f2287ea28a900271ecd83cc298d3a087bdbcf57c81f3861eb
SSDEEP:	49152:QF1Vrv/5gYZ5rS1dexg5qJYaAQTG35GqgRZBtS6keBp4TfnPSjkU:QFrxgYZ5rEuvJJDIGfLkmSvajh
TLSH:	99E5AEC931D51079C36EC3BE8D11356E7B203BD25228A74628D94E41BB336BEA93DB35
File Content Preview:	MZ......................@...............SENS............................!..L.!This program cannot be run in DOS mode....$...........Zpc.Zpc.Zpc...`.]pc...f..pc...g.Ppc.....Ypc...`.Spc...g.Kpc...f.rpc...b.Qpc.Zpb..pc.O.g.Cpc.O.a.[pc.RichZpc.........PE..d..

File Icon


Icon Hash:	0f3391d999f17117

Static PE Info

General

Entrypoint:	0x140117898
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66C6DF60 [Thu Aug 22 06:49:04 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d21e351310836af6b870c53243cea736

Entrypoint Preview

Instruction
jmp 00007F6424ABAE28h
push ebp
push ebx
jnle 00007F6424AFEF89h
xor bh, byte ptr [ecx-17h]
aas
les esi, esp
jmp far fword ptr [esi+20h]
push ebp
retn FAADh
push esp
call 00007F6424AE0278h
push ecx
dec eax
mov eax, 0003F6B4h
add byte ptr [eax], al
add byte ptr [eax], al
call 00007F6424B30C80h
call 00007F6424B05FBBh
or eax, BA3BBD16h
aaa
test eax, E54A30A3h
mov cl, A8h
inc edi
add dword ptr [esp+ecx], ebx
add byte ptr [esp], bl
or al, 00h
sbb al, 54h
or eax, dword ptr [eax]
sbb al, 34h
or al, byte ptr [eax]
sbb al, 32h
sbb al, dh
push ss
loopne 00007F6424AFEF26h
rcl byte ptr [edx], 1
rcl byte ptr [eax], 00000070h
add byte ptr [eax], al
add byte ptr [eax], al
pushfd
pushfd
dec eax
add ebp, 13h
popfd
dec eax
lea ebp, dword ptr [ebp-13h]
call 00007F6424AFEF15h
push edx
dec eax
mov edx, dword ptr [esp+04h]
pop edx
dec eax
add dword ptr [esp+00h], FFFC32EDh
dec eax
xchg dword ptr [esp+00h], ebx
dec eax
mov eax, eax
dec eax
xchg dword ptr [esp+08h], ebx
push esi
dec eax
mov esi, dword ptr [esp+08h]
dec eax
lea esi, dword ptr [esi+7Dh]
dec eax
xchg dword ptr [esp+08h], esi
dec eax
mov dword ptr [esp+08h], esi
dec eax
mov esi, dword ptr [esp]
dec eax
lea esp, dword ptr [esp+08h]
dec eax
xchg dword ptr [esp+00h], ebx
pushfd
dec eax
add ebp, 1Dh
popfd
dec eax
lea ebp, dword ptr [ebp-1Dh]
popfd
push esi
dec eax
mov esi, ebx
pop esi
jmp 00007F6424AC21AEh
adc ecx, ebx
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1547a8	0x78	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x160000	0x10e34	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x44000	0x2250	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x15f000	0xd98	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3a080	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x39f40	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x4a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29f00	0x2a000	9b3176f739b33206e45a84d232c8adcd	False	0.5520193917410714	data	6.499379146650062	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x12a50	0x12c00	3f1a1721d605a8cee94b0556584d2fd9	False	0.5018489583333333	data	5.54333127102241	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x53f8	0xe00	dba0caeecab624a0ccc0d577241601d1	False	0.134765625	data	1.8392217063172436	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x44000	0x2250	0x2400	181312260a85d10a1454ba38901c499b	False	0.4705946180555556	data	5.290347578351011	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x47000	0x11000	0x11000	e033defec470b9ce6e057b3370ac2783	False	0.07585592830882353	data	3.3250246885737624	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.text	0x58000	0xfc908	0xfca00	feab23da9e95e73b1f452c540ba7a962	False	0.7092163146338446	data	7.308139118973473	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x155000	0x9a68	0x9c00	696954a151a7ad2d9ca86207ed0ed038	False	0.23337339743589744	data	4.037993337931208	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x15f000	0xd98	0xe00	13a7b84aa3f34bea42b74ed5c20291cd	False	0.572265625	data	5.620738830469574	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x160000	0x10e34	0x11000	f766e7fc8f58c288eb777d0451fc1d79	False	0.075927734375	data	3.261933371506805	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x160068	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	0.06589376552703183
RT_GROUP_ICON	0x1708d0	0x14	data	1.15
RT_MANIFEST	0x170924	0x50d	XML 1.0 document, ASCII text	0.4694508894044857

Imports

DLL	Import
GDI32.dll	CreateFontIndirectW
ADVAPI32.dll	ConvertSidToStringSidW
KERNEL32.dll	FlsGetValue
COMCTL32.dll
USER32.dll	SendMessageW

Network Behavior

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 26, 2024 13:16:08.164377928 CET	1.1.1.1	192.168.2.9	0x8fbe	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 13:16:08.164377928 CET	1.1.1.1	192.168.2.9	0x8fbe	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false

Target ID:	1
Start time:	07:16:11
Start date:	26/12/2024
Path:	C:\Users\user\Desktop\90m2xwxCOf.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\90m2xwxCOf.exe"
Imagebase:	0x7ff716200000
File size:	3'273'105 bytes
MD5 hash:	3327701929DB65A98836F1241B3218FF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.6%
Dynamic/Decrypted Code Coverage:	68.8%
Signature Coverage:	0%
Total number of Nodes:	16
Total number of Limit Nodes:	1

Executed Functions

Function 000002A639EC1000 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 171
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32 ref: 000002A639EC11D2

Strings

N, xrefs: 000002A639EC10E3

Memory Dump Source

Source File: 00000001.00000002.1397741841.000002A639EC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A639EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2a639ec1000_90m2xwxCOf.jbxd

Similarity

API ID: Message
String ID: N
API String ID: 2030045667-1130791706
Opcode ID: c1a520171089c764a1bf883e299eb6064c341f4b9d475d0fc402adb0e6589623
Instruction ID: 8a198ac8c414f790276df306a77fa0c14dc1315a726f07f8303cbfeb041068d4
Opcode Fuzzy Hash: c1a520171089c764a1bf883e299eb6064c341f4b9d475d0fc402adb0e6589623
Instruction Fuzzy Hash: 3B513935608B848FE754DB28C458BAABBE1FF99305F444A6EE4CAD3261DB38D541CF06

Function 000002A639EC2FAC Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,?,?,?,?,?,000002A639EC2FAB), ref: 000002A639EC2FEF

Memory Dump Source

Source File: 00000001.00000002.1397741841.000002A639EC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A639EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2a639ec1000_90m2xwxCOf.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 4ef83a503b000693640d6e8f7b2307ed38ce45d25f5a8b0d95bc93309ba74388
Instruction ID: 1a7f4571c5736a07b551602da081e78f4964c68625d41ce5e8141dc17a5649e7
Opcode Fuzzy Hash: 4ef83a503b000693640d6e8f7b2307ed38ce45d25f5a8b0d95bc93309ba74388
Instruction Fuzzy Hash: 2BE0123074424C8BEA68A7749CADBAD3A96FF45351F044868E946D73A6CE39D8458F02

Non-executed Functions

Function 00007FF716201000 Relevance: 35.5, Strings: 28, Instructions: 515
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF716203E9E
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF716203A0B, 00007FF716203CD4, 00007FF716203F63
Failed to start splash screen!, xrefs: 00007FF716203ECC
Failed to remove temporary directory: %s, xrefs: 00007FF716203FC7
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF716203C61
Py_GIL_DISABLED, xrefs: 00007FF716203AF4
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF716203D35
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF7162039DE
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF716203A17, 00007FF716203A2F, 00007FF716203A9B
Failed to convert DLL search path!, xrefs: 00007FF716203DD4
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF716203EB3
pkg, xrefs: 00007FF7162039BE
pyi-python-flag, xrefs: 00007FF716203AD6
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF716203E02
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF716203BE8
Could not create temporary directory!, xrefs: 00007FF716203CBF
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF716203D12
pyi-disable-windowed-traceback, xrefs: 00007FF716203BB2
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF716203B32
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF716203971
pyi-contents-directory, xrefs: 00007FF716203B8D
Failed to load splash screen resources!, xrefs: 00007FF716203E7D
_PYI_SPLASH_IPC, xrefs: 00007FF716203A23, 00007FF716203EED
MEI, xrefs: 00007FF716203933
pyi-runtime-tmpdir, xrefs: 00007FF716203B68
_PYI_ARCHIVE_FILE, xrefs: 00007FF7162038D2, 00007FF7162039FF
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF716203882, 00007FF7162038AF
VCRUNTIME140.dll, xrefs: 00007FF716203DA9

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID:
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
API String ID: 0-4232158417
Opcode ID: f5774766a75c864224054ee403c32c156fcc5e29a78fa51771fbd3df4c043d0d
Instruction ID: b8ac593fa3a83f147e11086fb28598096905daf0a14e2775271fff459e3386f1
Opcode Fuzzy Hash: f5774766a75c864224054ee403c32c156fcc5e29a78fa51771fbd3df4c043d0d
Instruction Fuzzy Hash: 5D328A61A0CE8391FA29FB259C553FBA2A1AF457A4FC44036DA4D436D6EF2CE55CC320

Function 00007FF7162240AC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF7162240FA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF716224766
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7162248DC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF716224B9A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF716224DBA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF716224FF7
memcpy_s.LIBCPMT ref: 00007FF7162250D2
memcpy_s.LIBCPMT ref: 00007FF71622517D
memcpy_s.LIBCPMT ref: 00007FF71622524C

Strings

1#INF, xrefs: 00007FF716224223
1#IND, xrefs: 00007FF7162241E7
1#QNAN, xrefs: 00007FF716224213
1#SNAN, xrefs: 00007FF71622420A

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 274013df7cd615f3446597befe559c8a5fa80bc1e0456f2fc32aadd6811bd1ac
Instruction ID: d8b7247a1e86a377cd794ec1176c5af1cabed5e18ed25f1c09f1673a61dd0baf
Opcode Fuzzy Hash: 274013df7cd615f3446597befe559c8a5fa80bc1e0456f2fc32aadd6811bd1ac
Instruction Fuzzy Hash: 14B2F972E19A824BE724DF64DD407FEB7B2FB54398F805139DA0D57A84DB38A908CB50

Function 00007FF71620ACAD Relevance: 12.0, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

invalid literal/length code, xrefs: 00007FF71620B3E2
invalid code -- missing end-of-block, xrefs: 00007FF71620B0C6
invalid code lengths set, xrefs: 00007FF71620AE2D
invalid distances set, xrefs: 00007FF71620B1A0
invalid distance too far back, xrefs: 00007FF71620B670
too many length or distance symbols, xrefs: 00007FF71620AE46
invalid bit length repeat, xrefs: 00007FF71620B099
invalid distance code, xrefs: 00007FF71620B5B4
invalid literal/lengths set, xrefs: 00007FF71620B133

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 14409f6b5173d9f28888b9fb9c68bcc2b54b8e7def706e6c40ef53002486e1ba
Instruction ID: db5e723c99d4e07e0b56497c422d614a625ec97f5cfe15a8c6b806d29c5b9f5d
Opcode Fuzzy Hash: 14409f6b5173d9f28888b9fb9c68bcc2b54b8e7def706e6c40ef53002486e1ba
Instruction Fuzzy Hash: 4D521872A14AA647D7A4AF14C858B7F7BE9FB44351F814139EA4A877C0DB3DD848CB10

Function 00007FF716225C00 Relevance: 7.8, APIs: 5, Instructions: 335COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF716225C45

Part of subcall function 00007FF716225598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7162255AC

_get_daylight.LIBCMT ref: 00007FF716225C34

Part of subcall function 00007FF7162255F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71622560C

_get_daylight.LIBCMT ref: 00007FF716225EAA
_get_daylight.LIBCMT ref: 00007FF716225EBB
_get_daylight.LIBCMT ref: 00007FF716225ECC

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID:
API String ID: 1286766494-0
Opcode ID: 01c2eb1307ee358dd51d4cfaa153f6bd8fa3820bf955cab56f0a87d0391dd347
Instruction ID: 03b0fcbed3b4b951642dcbc8576d80952ee77c284a9bc6563e67637211f5e7b0
Opcode Fuzzy Hash: 01c2eb1307ee358dd51d4cfaa153f6bd8fa3820bf955cab56f0a87d0391dd347
Instruction Fuzzy Hash: 9ED1B236A08A5246E720FF22DC411BBA752EF847A4FC48139EE0E57A95DF3CE449C760

Function 00007FF7162089E0 Relevance: 5.3, Strings: 4, Instructions: 293COMMON

Download Yara Rule

Strings

Failed to create child process!, xrefs: 00007FF716208B30
CreateProcessW, xrefs: 00007FF716208B37
PyInstallerOnefileHiddenWindow, xrefs: 00007FF716208B54
PyInstaller Onefile Hidden Window, xrefs: 00007FF716208B95

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3215553584-3165540532
Opcode ID: 112b2cf12cdc3a191c93ca37d30556e7707750e3094662ff9bdd8f0d8ca4d711
Instruction ID: a33c0bd47e56de4ef9e4398a25f63af5954377f8bfc391b4799e95b104eb555a
Opcode Fuzzy Hash: 112b2cf12cdc3a191c93ca37d30556e7707750e3094662ff9bdd8f0d8ca4d711
Instruction Fuzzy Hash: 42C1B032A09E8245EB10BB349C516FFA7A4FF85768F901239EA5D53AD6DF3CD5088720

Function 00007FF716223C10 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF716223C76
memcpy_s.LIBCPMT ref: 00007FF716223CA1

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: ee79868302b1c941275c0cce9f489ce6055043019d07640c6735408ca62a73bb
Instruction ID: 6a226992e89a0b7e75ac3ca7c304d6dc82f626a559d59b441f97bc821bc1a242
Opcode Fuzzy Hash: ee79868302b1c941275c0cce9f489ce6055043019d07640c6735408ca62a73bb
Instruction Fuzzy Hash: 87C12572B19A8687D734DF15E44466BF7A2FB94B94F808138DB4A43784CB3DE949CB40

Function 00007FF716225E7C Relevance: 4.6, APIs: 3, Instructions: 144COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF716225EAA

Part of subcall function 00007FF7162255F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF71622560C

_get_daylight.LIBCMT ref: 00007FF716225EBB

Part of subcall function 00007FF716225598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7162255AC

_get_daylight.LIBCMT ref: 00007FF716225ECC

Part of subcall function 00007FF7162255C8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7162255DC

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo
String ID:
API String ID: 474895018-0
Opcode ID: f407c6c1e9b5c4be2678f094eab68ade84efea367f281159f9e28505f81f694a
Instruction ID: b5ee01ddca3740813fce2694ea6c180218bc5331594f1039325f4cf698eaabda
Opcode Fuzzy Hash: f407c6c1e9b5c4be2678f094eab68ade84efea367f281159f9e28505f81f694a
Instruction Fuzzy Hash: 31514432A08E4246E720FF22DC815BBE761BF487A4FC08139EA4D57A95DF3CE4498760

Function 00007FF71620A47B Relevance: 4.1, Strings: 3, Instructions: 397COMMON

Download Yara Rule

Strings

header crc mismatch, xrefs: 00007FF71620A921
unknown header flags set, xrefs: 00007FF71620A4C5
, xrefs: 00007FF71620A55B

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown header flags set
API String ID: 0-1127688429
Opcode ID: e32b299fc273864699ec3bddfbf8fc958dab4a7742ffdf8f0166f3b43fcc42d1
Instruction ID: c2c1032cd6241a3583a4be037f2153885dc8d585c7fff17f04b6cdc709f00c27
Opcode Fuzzy Hash: e32b299fc273864699ec3bddfbf8fc958dab4a7742ffdf8f0166f3b43fcc42d1
Instruction Fuzzy Hash: E5F19272A18BC94BE7A5BF188888A3FBAA9FF44750F854238DE4947791CB38D448C750

Function 00007FF7162139A4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF716213B12
, xrefs: 00007FF716213D54

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
Instruction ID: eb38383f70a52235d770c7e37099dfd8d93f1184fd8e8b4800f78a999e739980
Opcode Fuzzy Hash: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
Instruction Fuzzy Hash: D6E1E6B2A0CE4681EB68AF258C5013FB3A2FF45B68FA44135CA4E077D4DF29E849C350

Function 00007FF71620A2DB Relevance: 2.7, Strings: 2, Instructions: 218COMMON

Download Yara Rule

Strings

incorrect header check, xrefs: 00007FF71620A462
invalid window size, xrefs: 00007FF71620A449

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size
API String ID: 0-900081337
Opcode ID: e8ec78490181e4ccec650f854842bb3e08bcfae3bf2db5596c2af0d8e2ff5899
Instruction ID: 2e54da71d5667565fa0aa0b3e93b187822b77e105ddcf4cb9d687b2ca1b207e3
Opcode Fuzzy Hash: e8ec78490181e4ccec650f854842bb3e08bcfae3bf2db5596c2af0d8e2ff5899
Instruction Fuzzy Hash: A291DD72A186C987E7B4BF15C848B7F7AA9FF44360F818239DA4A467C1CB39E544CB10

Function 00007FF71621DEF0 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF71621E07A
e+000, xrefs: 00007FF71621DFFD

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
Instruction ID: fe44b45530944f5f986ff39bef15540ea59de9537af4c409a81b11e9d7360d46
Opcode Fuzzy Hash: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
Instruction Fuzzy Hash: 225168A3B1CAC586E7259E359C0176AEB91F744BA4F888631CBAC4BAC5CE3DD1488710

Function 000002A639ECFBD8 Relevance: 1.8, APIs: 1, Instructions: 326COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 000002A639ECFE27

Memory Dump Source

Source File: 00000001.00000002.1397741841.000002A639EC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A639EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2a639ec1000_90m2xwxCOf.jbxd

Similarity

API ID: _clrfp
String ID:
API String ID: 3618594692-0
Opcode ID: 57c0aad7674539f30f3b5eb1b32e0dbdf3af3d9e6d373f3973137eb903cdae01
Instruction ID: 3bc7a009f94152259ad754013c3072665160795cb6c79b2bec17f1123886bf0d
Opcode Fuzzy Hash: 57c0aad7674539f30f3b5eb1b32e0dbdf3af3d9e6d373f3973137eb903cdae01
Instruction Fuzzy Hash: 3BC15D31A10A4D8FEBA8CF1CC49AB557BE0FF4A314F194999E899CB2A5C735D852CF01

Function 00007FF716221874 Relevance: 1.8, APIs: 1, Instructions: 286COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7162218C0

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: b1e464fc850b8064c24b6b861928ec408d4c1656d056e3a04d07bd96ab05ec55
Instruction ID: ea5c3ec703fe4932fd00aa6c401d4c4f6b7c08cdc936b4a426d3bb216925957b
Opcode Fuzzy Hash: b1e464fc850b8064c24b6b861928ec408d4c1656d056e3a04d07bd96ab05ec55
Instruction Fuzzy Hash: F6A1F866B18A8241EA61BB219D049BBE3A2EB44BF1FA45135EF4D07BC5DE3CE449C310

Function 00007FF716229728 Relevance: 1.7, APIs: 1, Instructions: 228COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF716229977

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID: _clrfp
String ID:
API String ID: 3618594692-0
Opcode ID: 10bdc0aef22281e2c3bf2c24ae13a449422a775620643f1596252de5feb350ab
Instruction ID: 4bb343688a525c9c247d2d4504895a29614c8e6713297e1ea8e4bc133391bb8d
Opcode Fuzzy Hash: 10bdc0aef22281e2c3bf2c24ae13a449422a775620643f1596252de5feb350ab
Instruction Fuzzy Hash: 26B19E73A00B898BEB15CF2AC84636D7BE1F744B98F588825DB5D837A4CB39D455C710

Function 000002A639EC3AD8 Relevance: 1.5, Strings: 1, Instructions: 260COMMON

Download Yara Rule

Strings

0, xrefs: 000002A639EC3C71

Memory Dump Source

Source File: 00000001.00000002.1397741841.000002A639EC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A639EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2a639ec1000_90m2xwxCOf.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 7795948cfd765bef9381294a4e1b829f89c49aa63f3f1a464909e031b2790c9f
Instruction ID: 031b1e840dafcf5d0c2b3551366eeb8c02481623a72120665ef8f8f32cec22d4
Opcode Fuzzy Hash: 7795948cfd765bef9381294a4e1b829f89c49aa63f3f1a464909e031b2790c9f
Instruction Fuzzy Hash: AD71A316B186454BEEB89A1C44AD3E96BC2EF57B04F6C3199ECC6872C6CF118C078E57

Function 00007FF71621DA5C Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF71621DD9E

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction ID: 94d7e46a28990561d892b7f6d0971a65e369a7088435c8c9b2c37d46d684a999
Opcode Fuzzy Hash: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction Fuzzy Hash: CEA157A3A0CBC986EB21EF25AC007ABB791AB51BA4F448431DE4D477C5DE3DE509C710

Function 00007FF716218794 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF7162187B3

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: 405b9769b8a986946faf73e500ffb4ce1780379e6f9b934ce1cdce4b063a5bb7
Instruction ID: 2849c2eb0fb66d505edcc05f9dd3d39330dfe93f30eaada105087947576b7920
Opcode Fuzzy Hash: 405b9769b8a986946faf73e500ffb4ce1780379e6f9b934ce1cdce4b063a5bb7
Instruction Fuzzy Hash: F451DF85F0CE0642FA64BA265D9157BD291AF45BF4FDA8034DE0E477C6EE7CE44A8220

Function 000002A639ECD9AC Relevance: .5, Instructions: 520COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1397741841.000002A639EC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A639EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2a639ec1000_90m2xwxCOf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 724baf72195310b1dc216f7aa84dc3b548b0c8b89f03789b1ede33962e9eb6f3
Instruction ID: 52b4829765efc75cbb76fc48e45e48ea9113500fd95fb3dd6086e06feefda6f8
Opcode Fuzzy Hash: 724baf72195310b1dc216f7aa84dc3b548b0c8b89f03789b1ede33962e9eb6f3
Instruction Fuzzy Hash: AAF10632A08A4C4BDB29DF98C8987E9BBE1EF95710F1842AED886C7151DF31D5478F81

Function 00007FF7162208C8 Relevance: .5, Instructions: 462COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 595334a42f08af57c0a06d01f3192a900b6e8ba0f9f897347145e7bfe280db29
Instruction ID: 966cf8a81433e8943ef73e2b74f64d4063a7eb7926612e1b896f026cd291278e
Opcode Fuzzy Hash: 595334a42f08af57c0a06d01f3192a900b6e8ba0f9f897347145e7bfe280db29
Instruction Fuzzy Hash: 6002B061A1EE4641FA65BB129C1027BE683BF41BB0FD58638ED6D4A3D1DE3DA449C330

Function 00007FF7162135A0 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6953e196ddb05ff7f74cd889691ab2d661dc7abd12c14b9ae78539541f5d55fd
Instruction ID: 39766610fa5feb9a6e3faeed6c82d765fd765e5fa0102418a0e9977e63ed1022
Opcode Fuzzy Hash: 6953e196ddb05ff7f74cd889691ab2d661dc7abd12c14b9ae78539541f5d55fd
Instruction Fuzzy Hash: 59D1E8A2A0CE4786EB28AF258C5023FA792AF45B68F954235CE0D477D5CF39D849C760

Function 00007FF716209800 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f585d0828744060ce3ac2c29acc9446c2d71e0c438b7a0c7fc404ffa74e15ff0
Instruction ID: b7a6dce2e203d2102ecb5e8237abcb755822d44bcfaddc82e10e19d34c0d54a1
Opcode Fuzzy Hash: f585d0828744060ce3ac2c29acc9446c2d71e0c438b7a0c7fc404ffa74e15ff0
Instruction Fuzzy Hash: 9EC1AD766181E08BD28AEB29E86947A73E1F78930DBD5406BEF87477C5C73CA414DB20

Function 00007FF716226964 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e94f908cfc2f44f0ebd5e3e636be20b3a38a3e858241def26ac47fd63ac7c98a
Instruction ID: 06addfca287b5e002e98fb1419a2010b43b33b9b6e116ac6ebb15ff15e31f8e8
Opcode Fuzzy Hash: e94f908cfc2f44f0ebd5e3e636be20b3a38a3e858241def26ac47fd63ac7c98a
Instruction Fuzzy Hash: 04C10533B29E5186EB20EF64C8806AE7762E749BA8F915239DE1E573D5CF38D019C310

Function 00007FF716212C10 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
Instruction ID: 81cf0c9664222fe17991abf61558ea5404566c06ca688ee13abd2dccd46bb20a
Opcode Fuzzy Hash: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
Instruction Fuzzy Hash: A6B1B0F250DB4585E7649F39CC4023EBBA0EB4AB58FA48135EA4E47395CF39E485C760

Function 00007FF71621E570 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
Instruction ID: 32f7dcbbadb8ebbf5a8a72abd7b7163f8d1ca05a51c91ed80ed8dc82b34bc08c
Opcode Fuzzy Hash: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
Instruction Fuzzy Hash: 6A81D3B2A0CB8286E774EB199C4037BAA91FB457A4F904235DBDD47B95DE3CE4488B10

Function 00007FF716226418 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c638a679969e01e5b94e7dfefc78eaeeaf1a73f6c60bc93d488d721839fa988c
Instruction ID: 7b2bc746406dd55c32b9848ca010e9598288f3cc676fb69506e88c3a8a6f9bdc
Opcode Fuzzy Hash: c638a679969e01e5b94e7dfefc78eaeeaf1a73f6c60bc93d488d721839fa988c
Instruction Fuzzy Hash: A161E663E0CA6247F774AA689C5063FE682AF40770FD4423DE65D43AC5DE6DE848C720

Function 00007FF716249D66 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cf341ecbc00ded8be85b9825063baed7e6207ccbfb6003808ff7d57c928fbef
Instruction ID: 8007d94f9e5145fb9093d386afadb05b2b6e4aa25c95249ca556708fe14773e3
Opcode Fuzzy Hash: 1cf341ecbc00ded8be85b9825063baed7e6207ccbfb6003808ff7d57c928fbef
Instruction Fuzzy Hash: E14102A2506F43EA6A00677945185CD73969E0BB9DB461061DB862C008AF2188576121

Function 00007FF716211D54 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction ID: febb6e8932d9aa36635f297f317bae53b0b02968f55cbbd2ab281112b74b06c3
Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction Fuzzy Hash: 0F5190B6A1CE5182EB249B29CC4822AB3A0EB45B79F744131DE4D07BD4CB3AE857C750

Function 00007FF716211944 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction ID: c2802a3017c235b8eb1b9cfe76b890a699f54fb225072941b00fc6c54488566a
Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction Fuzzy Hash: 8E51A7B6A1CE5181E7249B29CC5833AB7A0EB44B79F748131CE8D17794CB3AE84BC750

Function 00007FF716212164 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction ID: 5f2e8daf2cc865673944ae7e2a0a5a3b9dd9401cacbb8907ebf15f204b2174c2
Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction Fuzzy Hash: 6351B7F6A1DE5185E7249B28CC4027E73A1EB56B78F648131DE4C07795CB3AE887C750

Function 00007FF716211740 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction ID: a8054fe63cafac4e5951cde2e4d2e32ba866a0c075f930ac60a12807d8cdafdc
Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction Fuzzy Hash: 3451C7B6A1CE5186E7249B29CC4823AB7A1EB45BB9F748131CE4C07794CF3AE847C750

Function 00007FF716211F60 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction ID: b1de90b779f66fdd54b65a630a0e7365d8e4c575011a0691bd33c37d742ce6bc
Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction Fuzzy Hash: 335103B6A1DE5182E7249B29CC4433AB3A0EB55B68F748131DE4C073A5CB3AE887C750

Function 00007FF716211B50 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction ID: da5316d3367f39ba46dde27b6262e416d1504b4418a9faa43f6c575e315be1a9
Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction Fuzzy Hash: BC51BFB6A1CE5182E7249F28CC4833AA7A0EB45B69FB44131CE4C07794DB3AE947C750

Function 00007FF716215D30 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: b1197c22a00629b5bc0f1c6f16faf529d3617fb23cce7d7cae816d91365d6371
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: DE4160E2C0DF4E05E9A999184D086B6A6809F12BB0DDC52F8DD9D373D7C91D669EC220

Function 00007FF716219EA0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2fd4559255f10fba12f2fe7c3826a5d8d64873a79dc25e0e9bc72c34cfb8264
Instruction ID: a36bc85461610d66a5684db3dc1aaf50a1fbc0ce1e15ed8d98c95861719c5acc
Opcode Fuzzy Hash: e2fd4559255f10fba12f2fe7c3826a5d8d64873a79dc25e0e9bc72c34cfb8264
Instruction Fuzzy Hash: 6B41E662718E5582EF04DF2ADE1426AB391BB48FE0B899037EE4D97B54DF3DD0498700

Function 00007FF7162180E4 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a33e2c8dffc1328ccb3c79931647987677b9da288923bf574ced27deaffa7ee3
Instruction ID: 0b2456eacbd27b7a5ef3f9433d6cacdb4fd5b9eb31a85f2eb00c0d242d2d537d
Opcode Fuzzy Hash: a33e2c8dffc1328ccb3c79931647987677b9da288923bf574ced27deaffa7ee3
Instruction Fuzzy Hash: BA31E172B0CF4241E664AF256C8012FAAD5AB84BA0F954238EA9D57BD5DF3CD0058710

Function 00007FF716229570 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
Instruction ID: 374661d679bb3ece84aa3103ab3b55ed4d6e1990ccc6d53288f8e765ee958b72
Opcode Fuzzy Hash: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
Instruction Fuzzy Hash: 07F06872B186958BDB989F6DA80266A7BD0F7083D0F808039E58D83B04DA3CD0658F54

Function 00007FF716201950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF716207F90: _fread_nolock.LIBCMT ref: 00007FF71620803A

_fread_nolock.LIBCMT ref: 00007FF716201A1B

Strings

Failed to read cookie!, xrefs: 00007FF716201A2B
Could not read full TOC!, xrefs: 00007FF716201B55
calloc, xrefs: 00007FF716201A68
Could not allocate buffer for TOC!, xrefs: 00007FF716201B1B
fseek, xrefs: 00007FF7162019F5
MEI, xrefs: 00007FF716201991
Could not allocate memory for archive structure!, xrefs: 00007FF716201A61
Failed to seek to cookie position!, xrefs: 00007FF7162019EE
fread, xrefs: 00007FF716201A32, 00007FF716201B5C
Error on file., xrefs: 00007FF716201B8D
malloc, xrefs: 00007FF716201B22

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID: _fread_nolock
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 840049012-3497178890
Opcode ID: 85b25b29a176bc83ae3a1b74fdbb3e17cfe2198aa0bc5e09dcfbdbd9a14dfb03
Instruction ID: bc1c90cec9b7d473bcab9a3932af243cfa87d1cf25f3991abbf7746bb569d176
Opcode Fuzzy Hash: 85b25b29a176bc83ae3a1b74fdbb3e17cfe2198aa0bc5e09dcfbdbd9a14dfb03
Instruction Fuzzy Hash: 9081C071A0CE8686EB20FB64D8442FBA3A1AF487A5F904035E98D47785DF3CE58D8721

Function 00007FF716201600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to create symbolic link %s!, xrefs: 00007FF716201622
fwrite, xrefs: 00007FF7162017D1
Failed to extract %s: failed to open target file!, xrefs: 00007FF71620165C
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7162017DF
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7162016DA
fseek, xrefs: 00007FF7162016E1
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7162016A2
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7162017CA
fread, xrefs: 00007FF7162017E6
malloc, xrefs: 00007FF716201749
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF716201742
fopen, xrefs: 00007FF716201663

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID:
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 0-1550345328
Opcode ID: 10ad1ac658e299a32776e4f5c7df64e1b6feaa7ef6c238e08fbfef3a4424164a
Instruction ID: 6a94c8946526b422d51864dfaaa649d124f92af66bdbdbd9fd656d37aff36923
Opcode Fuzzy Hash: 10ad1ac658e299a32776e4f5c7df64e1b6feaa7ef6c238e08fbfef3a4424164a
Instruction Fuzzy Hash: EA518B61B09E4782EA10BBA19C001ABA3A1BF447B9FD48536EE1C47796DF3CE55DC720

Function 000002A639EC12D8 Relevance: 15.3, APIs: 10, Instructions: 300
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002A639EC1300
__scrt_acquire_startup_lock.LIBCMT ref: 000002A639EC1352
_RTC_Initialize.LIBCMT ref: 000002A639EC1380
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002A639EC13A6
__scrt_release_startup_lock.LIBCMT ref: 000002A639EC13D1
__scrt_fastfail.LIBCMT ref: 000002A639EC1437

Memory Dump Source

Source File: 00000001.00000002.1397741841.000002A639EC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A639EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2a639ec1000_90m2xwxCOf.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_fastfail__scrt_release_startup_lock
String ID:
API String ID: 2904100720-0
Opcode ID: bdc4e10cf2850800bad6ec58f36eb416631004feb4e78b6242bb27f2f577f552
Instruction ID: 7f2e96c2311ee74a5222fe86ea55e543e6b61126c99a9a0ca9824b1311c0bf5a
Opcode Fuzzy Hash: bdc4e10cf2850800bad6ec58f36eb416631004feb4e78b6242bb27f2f577f552
Instruction Fuzzy Hash: A0919A3AB186054BFF74A768946D3AB3AD1EF57B00F484199EC85C3292DF24D8468F43

Function 00007FF716216290 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 493COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7162162D3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7162166C0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF71621695C

Strings

p, xrefs: 00007FF716216385
-, xrefs: 00007FF716216369
:, xrefs: 00007FF71621648C
f, xrefs: 00007FF7162163F5
p, xrefs: 00007FF7162163FD

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: b7e22ce4f74af2d1023d9e5852fe48feb6e043baf8196cd40c3e1ea19e832e16
Instruction ID: 302697b32836dfeaa9e95c71c8aea30e8c4dc42595601834426ea08b7163490a
Opcode Fuzzy Hash: b7e22ce4f74af2d1023d9e5852fe48feb6e043baf8196cd40c3e1ea19e832e16
Instruction Fuzzy Hash: A41283A2E0DAA386FB307B14DD5427FF691FB50760FD48135D69946AC4DB3CE5888B20

Function 00007FF716210FC8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF716211008
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7162113D0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF71621166F

Strings

f, xrefs: 00007FF7162110A0
p, xrefs: 00007FF7162110AD
f, xrefs: 00007FF71621110A
p, xrefs: 00007FF716211112
f, xrefs: 00007FF716211255

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: aa0fbff0f347da908d5507dbb8c304165b2bf985efd8a5cf476f5df367044c76
Instruction ID: a18027168a3f5eb110eb9e973cd1a23ab66debd1c5fe32e6510428be8dc34373
Opcode Fuzzy Hash: aa0fbff0f347da908d5507dbb8c304165b2bf985efd8a5cf476f5df367044c76
Instruction Fuzzy Hash: 8E12A8F1E0C98386FB247A14EC482BBF6A5FB50765FE44031D69946AC8DB3CE5498B60

Function 00007FF716201050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7162011F6
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF716201108
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7162010CC
fseek, xrefs: 00007FF7162010D3
Failed to extract %s: failed to open archive file!, xrefs: 00007FF716201098
fread, xrefs: 00007FF7162011FD
malloc, xrefs: 00007FF71620110F

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID:
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 0-3659356012
Opcode ID: 7353426b42f42a82694b3592670e666301d967352ad9965b6266ed7fbff1557c
Instruction ID: dae7a643928080a4be44a9d7a0fd56cd1d013150a17a1c62b17aa6f2dfaf1ca2
Opcode Fuzzy Hash: 7353426b42f42a82694b3592670e666301d967352ad9965b6266ed7fbff1557c
Instruction Fuzzy Hash: A4419B61B09A5282EA04FB52AC046BBE391BF54BE5FE48432ED4C07796DE3CE5498760

Function 00007FF716201470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7162015DF
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF716201518
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7162014DE
fseek, xrefs: 00007FF7162014E5
Failed to extract %s: failed to open archive file!, xrefs: 00007FF71620149F
fread, xrefs: 00007FF7162015E6
malloc, xrefs: 00007FF71620151F

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID:
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 0-3659356012
Opcode ID: 8e50aaae5ab3d411fe7ab9835250eb0ac1eca1baedb3c6f350960e0e7df48aeb
Instruction ID: 4dd3c6ba6fb4091bf0d545c30397e67744a8fe3c2d5b12a07c70b7f9b8ba1bd0
Opcode Fuzzy Hash: 8e50aaae5ab3d411fe7ab9835250eb0ac1eca1baedb3c6f350960e0e7df48aeb
Instruction Fuzzy Hash: 31418E66A09A4286EB10FB619C405BBE391BF447A8FD48432ED4D0BB99DE3CE549C720

Function 00007FF71620EA08 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF71620EA65

Part of subcall function 00007FF71620F9BC: __GetUnwindTryBlock.LIBCMT ref: 00007FF71620F9FF
Part of subcall function 00007FF71620F9BC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF71620FA24

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF71620EB3D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF71620ED8B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF71620EE98

Strings

csm, xrefs: 00007FF71620EAE6
csm, xrefs: 00007FF71620EB60
csm, xrefs: 00007FF71620EA7F

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction ID: 7a9dbd9b87773f08580b91f63d1e5060516d88d28c96f5ad30b54390a70dccd8
Opcode Fuzzy Hash: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction Fuzzy Hash: 15D18272A08B4586EB20FF25D8403AEB7A0FB557A8F900135DE8D57B96DF38E489C710

Function 00007FF716201210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF71620141E
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF716201276
1.3.1, xrefs: 00007FF716201249
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF7162012EF
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7162012BA
malloc, xrefs: 00007FF7162012C1, 00007FF7162012F6

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID:
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 0-2813020118
Opcode ID: 5ad7029722e9e2f6923f5db6a59ac32f4b16dfce7729f192b8578fd94d2afe4f
Instruction ID: 60a3713afa7dc51009e3c560bc50e7a78225911850c0b43dfc95922a47d32c15
Opcode Fuzzy Hash: 5ad7029722e9e2f6923f5db6a59ac32f4b16dfce7729f192b8578fd94d2afe4f
Instruction Fuzzy Hash: 2751E162A09E4285EA20BB51AC403BBE291FF857A9FD44135ED4D47BD5EF3CE449C720

Function 00007FF716229368 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF716229390
_set_statfp.LIBCMT ref: 00007FF7162293AB
_set_statfp.LIBCMT ref: 00007FF7162293C7
_set_statfp.LIBCMT ref: 00007FF716229403

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 8f1a365b1b2877d86e2600fbdf08b7276319e6d8b8c86b0b036004076cacb762
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: F0114222F5CE0301FB68316BECA53BB9152BF593F4E84463CFA6E562D6CE6C68494121

Function 00007FF716215FA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF716215FDC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF716216106
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7162161BC

Strings

verbose, xrefs: 00007FF716215FB0

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: 547cf158481a8c18467cbe791500e9eddd6e0432bad87a819098196fbf1c1c96
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: 1791CFA2A0CE6681F771AF24DC5037FB6A1AB40BA4FD44136DA5D437D6DE3DE8498320

Function 00007FF71621FBC8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF71621FEA7

Part of subcall function 00007FF716217A3C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF716217A59

Strings

UTF-8, xrefs: 00007FF71621FE26
UTF-16LEUNICODE, xrefs: 00007FF71621FE45
ccs, xrefs: 00007FF71621FDE2

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction ID: 7e4c658be22cdb5910c33d9820bd7b5151d1d721db9d6f2310e558dbe6a123b3
Opcode Fuzzy Hash: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction Fuzzy Hash: 2281C2F2D0CE4385F764BE2D8D00A7BA6E0AB21B64FD54035CE19972D9CB2DE9099321

Function 000002A639EC363C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 171COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002A639EC3671
_invalid_parameter_noinfo.LIBCMT ref: 000002A639EC383D

Strings

*, xrefs: 000002A639EC3771
, xrefs: 000002A639EC37C6

Memory Dump Source

Source File: 00000001.00000002.1397741841.000002A639EC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002A639EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2a639ec1000_90m2xwxCOf.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: f29546d3a36cf79c47e3619aed576d9b14d69aabdb658179f5724d34d282a78c
Instruction ID: fd58a4a656b48a80eae1d957e420d9a6ebd8e5a9c9f33e75a94e9803e4d18eef
Opcode Fuzzy Hash: f29546d3a36cf79c47e3619aed576d9b14d69aabdb658179f5724d34d282a78c
Instruction Fuzzy Hash: B9615272A046448BEFB99F18C0ED3663EA1BF17715F5821D9CC828A1D6DB65C487CE42

Function 00007FF71620F288 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF71620F2B0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF71620F398

Strings

csm, xrefs: 00007FF71620F3EA
csm, xrefs: 00007FF71620F2D2

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction ID: cad14c079e34614be78506fb19d06dae0bb785237eccb5b81a82caef0136e6bc
Opcode Fuzzy Hash: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction Fuzzy Hash: C351A332A48B8286EB74BB29994476AB7A0FB54BA4F944135DF4C43BC5CF3CE458C711

Function 00007FF71621F98C Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF71621FA7C
_get_daylight.LIBCMT ref: 00007FF71621FA8D
_get_daylight.LIBCMT ref: 00007FF71621FA9E
_isindst.LIBCMT ref: 00007FF71621FB69

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction ID: a11e8672dc4ec30a3b255762d1c1cd3c7c2dac897d5d6045370f6e2981566bd4
Opcode Fuzzy Hash: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction Fuzzy Hash: DC514DB2F08A1186FB14EF688D51A7EA791AF14378F900235DD2D53AD4DF3CA50AC710

Function 00007FF71620D648 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 155COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF71620D673
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF71620D70A

Strings

csm, xrefs: 00007FF71620D6F1

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm
API String ID: 3242871069-1018135373
Opcode ID: 12afe3ddf8923ddabe2e4fbe2cdad78b5d93db4a8052962e6f126e70e1b0d1c2
Instruction ID: 9022e1c0b506310b57c5aa18ae4c331db8ef9b94664cf494a0ec9111b735be2a
Opcode Fuzzy Hash: 12afe3ddf8923ddabe2e4fbe2cdad78b5d93db4a8052962e6f126e70e1b0d1c2
Instruction Fuzzy Hash: E5519237B1AA028ADB14FF15E844A7EB391EB44BA8F908934EA4D47754DF7CE845C710

Function 00007FF71620EED8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 00007FF71620EF83

Strings

RCC, xrefs: 00007FF71620EF53
MOC, xrefs: 00007FF71620EF4B

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: 39c1f0c2e48683ae2c7761d12c305b0cd6275173a9a64f984acdc1fd1f3c1034
Instruction ID: fd41467d03469bf523cb0888a3b760e334591143ce18346c1fae21cba30ced30
Opcode Fuzzy Hash: 39c1f0c2e48683ae2c7761d12c305b0cd6275173a9a64f984acdc1fd1f3c1034
Instruction Fuzzy Hash: B9519072908BC585EB60AB15E8407AAF7A0FB857A4F444625EF9C03B99CF7CD194CB10

Function 00007FF716225B1C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF716221760: _invalid_parameter_noinfo.LIBCMT ref: 00007FF716221793

_get_daylight.LIBCMT ref: 00007FF716225C34
_get_daylight.LIBCMT ref: 00007FF716225C45

Strings

?, xrefs: 00007FF716225BC5

Memory Dump Source

Source File: 00000001.00000002.1398094911.00007FF716201000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF716200000, based on PE: true

Associated: 00000001.00000002.1398073923.00007FF716200000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398119983.00007FF71622B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398166851.00007FF71623E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1398185994.00007FF716244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399013800.00007FF716258000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399104409.00007FF716355000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1399128153.00007FF71635F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff716200000_90m2xwxCOf.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 9a7f400d0f6806ffebb0fb5bd147589810dfa8003abc051b845f313caa71493e
Instruction ID: 80b08cbe7069b6de15468e050855375f53e0e9bb40001153d50bee8271c295f6
Opcode Fuzzy Hash: 9a7f400d0f6806ffebb0fb5bd147589810dfa8003abc051b845f313caa71493e
Instruction Fuzzy Hash: FC411B12A18A8245F760AB25DD0137BE792EB80BB4F948239EE5D06AD9DF3CD4458710

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 90m2xwxCOf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

DNS Answers

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: 90m2xwxCOf.exePID: 1384, Parent PID: 3504

General

Chronological Activities

Disassembly

Analysis Process: 90m2xwxCOf.exePID: 1384, Parent PID: 3504COMMON

Execution Graph

Graph

Executed Functions

Function 000002A639EC1000 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 171windowCOMMON

Control-flow Graph

Function 000002A639EC2FAC Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Control-flow Graph

Non-executed Functions

Function 00007FF716201000 Relevance: 35.5, Strings: 28, Instructions: 515COMMON

Windows Analysis Report
90m2xwxCOf.exe

Function 000002A639EC1000 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 171
windowCOMMON

Function 000002A639EC2FAC Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Function 00007FF716201000 Relevance: 35.5, Strings: 28, Instructions: 515
COMMON

Function 00007FF716201950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Function 00007FF716201600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145
COMMON

Function 000002A639EC12D8 Relevance: 15.3, APIs: 10, Instructions: 300
COMMON

Function 00007FF716201050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119
COMMON

Function 00007FF716201470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107
COMMON

Function 00007FF71620EA08 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310
COMMON

Function 00007FF716201210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON