Edit tour

Windows Analysis Report
AdobePDF.exe

Overview

General Information

Sample name:	AdobePDF.exe
Analysis ID:	1587430
MD5:	44cc93b896b10417f5d231088ffe6924
SHA1:	5def3a0114a71e6affd57d9bc7b9757bf4b6eb14
SHA256:	587d10cf5d8c91fe31141bad01719e6a99914010659ef951b1680e97559e7910
Tags:	exeuser-zhuzhu0009
Infos:

Detection

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

AI detected suspicious sample

Allocates memory in foreign processes

Drops PE files to the document folder of the user

Drops large PE files

Injects a PE file into a foreign processes

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Writes to foreign memory regions

Yara detected Costura Assembly Loader

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

AdobePDF.exe (PID: 7332 cmdline: "C:\Users\user\Desktop\AdobePDF.exe" MD5: 44CC93B896B10417F5D231088FFE6924)

csc.exe (PID: 7544 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

csc.exe (PID: 7876 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.2523646930.00000000075A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000002.00000002.4207828082.0000000006FA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000002.00000002.4208782145.0000000009850000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000005.00000002.2524199967.0000000008743000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000005.00000002.2525223078.0000000009EC0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000002.00000002.4208342328.0000000008143000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: csc.exe PID: 7544	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: csc.exe PID: 7544	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: csc.exe PID: 7876	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: csc.exe PID: 7876	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
2.2.csc.exe.81c92a0.1.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
2.2.csc.exe.9850000.3.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
5.2.csc.exe.87c92a0.1.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
5.2.csc.exe.9ec0000.3.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\Documents\Elaborate Bytes\HD Tach\hdtach.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\AdobePDF.exe, ProcessId: 7332, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\QualysDLP

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: AdobePDF.exe	Virustotal: Detection: 12%			Perma Link
Source: AdobePDF.exe	ReversingLabs: Detection: 15%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Users\user\Desktop\AdobePDF.exe

Code function: 0_2_00530E10 TlsGetValue,TlsGetValue,TlsSetValue,BCryptGenRandom,TlsGetValue,TlsGetValue,

0_2_00530E10

Source: AdobePDF.exe, 00000000.00000002.2226482063.000000007FFF0000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_d1d47d12-4

Source: AdobePDF.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: AdobePDF.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: protobuf-net.pdbSHA256}Lq source: csc.exe, 00000002.00000003.1976044441.0000000008421000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.1976044441.000000000855B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000002.4208830088.00000000098B0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.2245075144.0000000008A21000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2245075144.0000000008B5B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2525264064.0000000009F20000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: E:\builds\CST-RED-LCW\target\i686-pc-windows-msvc\release\deps\bdredline.pdb source: AdobePDF.exe, hdtach.exe.0.dr
Source:	Binary string: protobuf-net.pdb source: csc.exe, 00000002.00000003.1976044441.0000000008421000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.1976044441.000000000855B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000002.4208830088.00000000098B0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.2245075144.0000000008A21000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2245075144.0000000008B5B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2525264064.0000000009F20000.00000004.08000000.00040000.00000000.sdmp

Source: global traffic

TCP traffic: 192.168.2.4:49736 -> 181.71.216.203:30203

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: newstaticfreepoint24.ddns-ip.net

Source: csc.exe, 00000002.00000002.4207828082.0000000006FA1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000002.4207828082.0000000007223000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2523646930.00000000077FB000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2523646930.00000000075A1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2523646930.0000000007621000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: AdobePDF.exe, hdtach.exe.0.dr	String found in binary or memory: http://www.w3.or
Source: AdobePDF.exe, hdtach.exe.0.dr	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: AdobePDF.exe, hdtach.exe.0.dr	String found in binary or memory: https://curl.se/docs/hsts.html
Source: AdobePDF.exe, hdtach.exe.0.dr	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: hdtach.exe.0.dr	String found in binary or memory: https://github.com/clap-rs/clap/issues
Source: AdobePDF.exe, hdtach.exe.0.dr	String found in binary or memory: https://github.com/clap-rs/clap/issues46
Source: hdtach.exe.0.dr	String found in binary or memory: https://github.com/clap-rs/clap/issuesC:
Source: hdtach.exe.0.dr	String found in binary or memory: https://github.com/clap-rs/clap/issuesSUBCOMMAND
Source: AdobePDF.exe, hdtach.exe.0.dr	String found in binary or memory: https://github.com/clap-rs/clap/issuesunexpected
Source: csc.exe, 00000002.00000003.1976044441.0000000008421000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.1976044441.000000000855B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000002.4208830088.00000000098B0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.2245075144.0000000008A21000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2245075144.0000000008B5B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2525264064.0000000009F20000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: csc.exe, 00000002.00000003.1976044441.0000000008421000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.1976044441.000000000855B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000002.4208830088.00000000098B0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.2245075144.0000000008A21000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2245075144.0000000008B5B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2525264064.0000000009F20000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: csc.exe, 00000002.00000003.1976044441.0000000008421000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.1976044441.000000000855B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000002.4208830088.00000000098B0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.2245075144.0000000008A21000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2245075144.0000000008B5B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2525264064.0000000009F20000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: csc.exe, 00000002.00000003.1976044441.0000000008421000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.1976044441.000000000855B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000002.4208830088.00000000098B0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.2245075144.0000000008A21000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2245075144.0000000008B5B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2525264064.0000000009F20000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: csc.exe, 00000002.00000002.4207828082.0000000006FA1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.1976044441.0000000008421000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.1976044441.000000000855B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000002.4208830088.00000000098B0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000002.2523646930.00000000075A1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2245075144.0000000008A21000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2245075144.0000000008B5B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2525264064.0000000009F20000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: csc.exe, 00000002.00000003.1976044441.0000000008421000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.1976044441.000000000855B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000002.4208830088.00000000098B0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.2245075144.0000000008A21000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2245075144.0000000008B5B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2525264064.0000000009F20000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

System Summary

Drops large PE files

Source: C:\Users\user\Desktop\AdobePDF.exe

File dump: hdtach.exe.0.dr 959667331

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0054604D	0_2_0054604D
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_005B1060	0_2_005B1060
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00401000	0_2_00401000
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00547833	0_2_00547833
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_004B3020	0_2_004B3020
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00449900	0_2_00449900
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00484100	0_2_00484100
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_005011C0	0_2_005011C0
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_004859F0	0_2_004859F0
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_005479AE	0_2_005479AE
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00526A00	0_2_00526A00
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00548201	0_2_00548201
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0048B210	0_2_0048B210
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00428B50	0_2_00428B50
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00540B40	0_2_00540B40
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0042D370	0_2_0042D370
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0045CB20	0_2_0045CB20
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_004B3320	0_2_004B3320
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00502BD0	0_2_00502BD0
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_005473B9	0_2_005473B9
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00427C76	0_2_00427C76
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00545C16	0_2_00545C16
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_005264C0	0_2_005264C0
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_005434CC	0_2_005434CC
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0054849D	0_2_0054849D
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00500C80	0_2_00500C80
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0054648D	0_2_0054648D
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_004FFD50	0_2_004FFD50
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0042A560	0_2_0042A560
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00543579	0_2_00543579
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00502560	0_2_00502560
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00422570	0_2_00422570
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00501D10	0_2_00501D10
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_004BFD30	0_2_004BFD30
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00490DB0	0_2_00490DB0
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00547E43	0_2_00547E43
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_005486F1	0_2_005486F1
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_004FFEA0	0_2_004FFEA0
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0051FF00	0_2_0051FF00
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00542FD0	0_2_00542FD0
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_005027E0	0_2_005027E0
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00502F80	0_2_00502F80
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0054A7A0	0_2_0054A7A0
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00891402	0_2_00891402
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008B3783	0_2_008B3783
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0089380F	0_2_0089380F
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008A0805	0_2_008A0805
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0089983E	0_2_0089983E
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008A9199	0_2_008A9199
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0089212E	0_2_0089212E
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008952CE	0_2_008952CE
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00891AD9	0_2_00891AD9
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008922D5	0_2_008922D5
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00891AE8	0_2_00891AE8
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00895AE1	0_2_00895AE1
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00891AFF	0_2_00891AFF
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00891A43	0_2_00891A43
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0089B271	0_2_0089B271
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00891A75	0_2_00891A75
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00891B82	0_2_00891B82
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00895B99	0_2_00895B99
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0089B3C9	0_2_0089B3C9
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0089A3EB	0_2_0089A3EB
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008A93E5	0_2_008A93E5
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00892327	0_2_00892327
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0089736C	0_2_0089736C
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0089B36E	0_2_0089B36E
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00891B7B	0_2_00891B7B
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00891B76	0_2_00891B76
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0089B482	0_2_0089B482
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0089B49F	0_2_0089B49F
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0089B41D	0_2_0089B41D
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00891443	0_2_00891443
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0089F47A	0_2_0089F47A
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00893472	0_2_00893472
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008955F7	0_2_008955F7
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008B5500	0_2_008B5500
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008A0D16	0_2_008A0D16
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008A06BE	0_2_008A06BE
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0089AE03	0_2_0089AE03
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00892E2E	0_2_00892E2E
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00891657	0_2_00891657
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008A8FA8	0_2_008A8FA8
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0089B7A2	0_2_0089B7A2
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0089B7B0	0_2_0089B7B0
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0089B7D2	0_2_0089B7D2
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00895702	0_2_00895702
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0089B71C	0_2_0089B71C
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00891F1F	0_2_00891F1F
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0089B75E	0_2_0089B75E
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00891F55	0_2_00891F55
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E405B	0_2_008E405B
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008EFC6B	0_2_008EFC6B
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008ED6A3	0_2_008ED6A3
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E47BA	0_2_008E47BA
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E4886	0_2_008E4886
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008ED8A6	0_2_008ED8A6
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E48BD	0_2_008E48BD
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E68BA	0_2_008E68BA
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E40B6	0_2_008E40B6
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E20CF	0_2_008E20CF
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E48C5	0_2_008E48C5
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008F18C0	0_2_008F18C0
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008EE8E6	0_2_008EE8E6
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E481A	0_2_008E481A
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E0027	0_2_008E0027
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E4845	0_2_008E4845
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008EF054	0_2_008EF054
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008F818F	0_2_008F818F
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E419E	0_2_008E419E
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008F499C	0_2_008F499C
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E41A9	0_2_008E41A9
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008ED9A7	0_2_008ED9A7
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008F09A2	0_2_008F09A2
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E41E6	0_2_008E41E6
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E41F4	0_2_008E41F4
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E010B	0_2_008E010B
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008F4106	0_2_008F4106
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E491D	0_2_008E491D
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E4910	0_2_008E4910
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008ED92D	0_2_008ED92D
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008EF933	0_2_008EF933
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E515D	0_2_008E515D
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E4155	0_2_008E4155
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E9955	0_2_008E9955
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E4174	0_2_008E4174
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E3A9A	0_2_008E3A9A
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008F42A6	0_2_008F42A6
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008F0AF2	0_2_008F0AF2
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E3A14	0_2_008E3A14
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E9A2B	0_2_008E9A2B
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008EBA20	0_2_008EBA20
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008EDA3B	0_2_008EDA3B
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E4A32	0_2_008E4A32
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008EE24C	0_2_008EE24C
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008EDA68	0_2_008EDA68
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008F1A66	0_2_008F1A66
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E7261	0_2_008E7261
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E7276	0_2_008E7276
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E2388	0_2_008E2388
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008F1388	0_2_008F1388
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008EEB80	0_2_008EEB80
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008F8B94	0_2_008F8B94
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E4BA0	0_2_008E4BA0
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E3BC2	0_2_008E3BC2
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E4BDC	0_2_008E4BDC
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008F03E6	0_2_008F03E6
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E4B28	0_2_008E4B28
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E4B4D	0_2_008E4B4D
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008F0B45	0_2_008F0B45
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00900343	0_2_00900343
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E8B67	0_2_008E8B67
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E4C92	0_2_008E4C92
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E4CF9	0_2_008E4CF9
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E4CF6	0_2_008E4CF6
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E9455	0_2_008E9455
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E4C51	0_2_008E4C51
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E4C66	0_2_008E4C66
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008F9584	0_2_008F9584
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E4D9B	0_2_008E4D9B
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008ED596	0_2_008ED596
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E3DA8	0_2_008E3DA8
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E45B1	0_2_008E45B1
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008F0DDC	0_2_008F0DDC
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008EC5DD	0_2_008EC5DD
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008ED5D6	0_2_008ED5D6
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E3DE4	0_2_008E3DE4
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E3DF2	0_2_008E3DF2
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E4D08	0_2_008E4D08
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E4D1E	0_2_008E4D1E
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E751C	0_2_008E751C
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E3D70	0_2_008E3D70
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008ED685	0_2_008ED685
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008F0EA9	0_2_008F0EA9
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008F46C0	0_2_008F46C0
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E46DA	0_2_008E46DA
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008F0ED1	0_2_008F0ED1
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E46E5	0_2_008E46E5
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E86F3	0_2_008E86F3
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E46F1	0_2_008E46F1
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E3E09	0_2_008E3E09
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E661F	0_2_008E661F
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008F0E1E	0_2_008F0E1E
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E461C	0_2_008E461C
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008F4645	0_2_008F4645
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008F1640	0_2_008F1640
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E765A	0_2_008E765A
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E4666	0_2_008E4666
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008ED67C	0_2_008ED67C
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008F2E73	0_2_008F2E73
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008F4F81	0_2_008F4F81
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008F17A7	0_2_008F17A7
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E47A7	0_2_008E47A7
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008F07BC	0_2_008F07BC
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008F37C5	0_2_008F37C5
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E0FF2	0_2_008E0FF2
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008F472C	0_2_008F472C
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008ED725	0_2_008ED725
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008F0742	0_2_008F0742
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008E677A	0_2_008E677A
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD83783	0_2_3BD83783
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD6B7D2	0_2_3BD6B7D2
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD7A3CA	0_2_3BD7A3CA
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD6B3C9	0_2_3BD6B3C9
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD793E5	0_2_3BD793E5
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD79FEC	0_2_3BD79FEC
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD6A3EB	0_2_3BD6A3EB
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD65B99	0_2_3BD65B99
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD6B7B0	0_2_3BD6B7B0
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD6B7A2	0_2_3BD6B7A2
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD823A5	0_2_3BD823A5
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD78FA8	0_2_3BD78FA8
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD6B75E	0_2_3BD6B75E
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD84754	0_2_3BD84754
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD6B36E	0_2_3BD6B36E
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD6736C	0_2_3BD6736C
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD6B71C	0_2_3BD6B71C
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD65702	0_2_3BD65702
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD8172E	0_2_3BD8172E
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD842CD	0_2_3BD842CD
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD652CE	0_2_3BD652CE
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD65AE1	0_2_3BD65AE1
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD826E3	0_2_3BD826E3
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD706BE	0_2_3BD706BE
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD6B271	0_2_3BD6B271
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD6AE03	0_2_3BD6AE03
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD655F7	0_2_3BD655F7
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD805FA	0_2_3BD805FA
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD79199	0_2_3BD79199
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD7A164	0_2_3BD7A164
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD82964	0_2_3BD82964
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD70D16	0_2_3BD70D16
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD85500	0_2_3BD85500
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD6B49F	0_2_3BD6B49F
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD6B482	0_2_3BD6B482
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD80861	0_2_3BD80861
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD6B41D	0_2_3BD6B41D
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD70805	0_2_3BD70805
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD6380F	0_2_3BD6380F
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB47BA	0_2_3BEB47BA
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEBD6A3	0_2_3BEBD6A3
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEBFC6B	0_2_3BEBFC6B
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC03E6	0_2_3BEC03E6
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB3BC2	0_2_3BEB3BC2
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB4BDC	0_2_3BEB4BDC
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB4BA0	0_2_3BEB4BA0
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB2388	0_2_3BEB2388
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC1388	0_2_3BEC1388
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEBEB80	0_2_3BEBEB80
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC8B94	0_2_3BEC8B94
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB8B67	0_2_3BEB8B67
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB4B4D	0_2_3BEB4B4D
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC0B45	0_2_3BEC0B45
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BED0343	0_2_3BED0343
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB4B28	0_2_3BEB4B28
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC0AF2	0_2_3BEC0AF2
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC42A6	0_2_3BEC42A6
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB3A9A	0_2_3BEB3A9A
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEBDA68	0_2_3BEBDA68
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB7261	0_2_3BEB7261
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC1A66	0_2_3BEC1A66
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB7276	0_2_3BEB7276
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEBE24C	0_2_3BEBE24C
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB9A2B	0_2_3BEB9A2B
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEBBA20	0_2_3BEBBA20
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEBDA3B	0_2_3BEBDA3B
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB4A32	0_2_3BEB4A32
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB3A14	0_2_3BEB3A14
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB41E6	0_2_3BEB41E6
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB41F4	0_2_3BEB41F4
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB41A9	0_2_3BEB41A9
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEBD9A7	0_2_3BEBD9A7
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC09A2	0_2_3BEC09A2
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC499C	0_2_3BEC499C
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB419E	0_2_3BEB419E
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB4174	0_2_3BEB4174
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB515D	0_2_3BEB515D
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB4155	0_2_3BEB4155
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB9955	0_2_3BEB9955
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEBD92D	0_2_3BEBD92D
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEBF933	0_2_3BEBF933
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB010B	0_2_3BEB010B
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC4106	0_2_3BEC4106
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB491D	0_2_3BEB491D
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB4910	0_2_3BEB4910
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEBE8E6	0_2_3BEBE8E6
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB20CF	0_2_3BEB20CF
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC18C0	0_2_3BEC18C0
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB48C5	0_2_3BEB48C5
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEBD8A6	0_2_3BEBD8A6
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB68BA	0_2_3BEB68BA
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB48BD	0_2_3BEB48BD
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB40B6	0_2_3BEB40B6
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB4886	0_2_3BEB4886
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB4845	0_2_3BEB4845
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB405B	0_2_3BEB405B
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEBF054	0_2_3BEBF054
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB0027	0_2_3BEB0027
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB481A	0_2_3BEB481A
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB0FF2	0_2_3BEB0FF2
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC37C5	0_2_3BEC37C5
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC17A7	0_2_3BEC17A7
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB47A7	0_2_3BEB47A7
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC07BC	0_2_3BEC07BC
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC4F81	0_2_3BEC4F81
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB677A	0_2_3BEB677A
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC0742	0_2_3BEC0742
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC472C	0_2_3BEC472C
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEBD725	0_2_3BEBD725
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB46E5	0_2_3BEB46E5
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB86F3	0_2_3BEB86F3
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB46F1	0_2_3BEB46F1
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC46C0	0_2_3BEC46C0
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC7EC2	0_2_3BEC7EC2
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB46DA	0_2_3BEB46DA
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC0ED1	0_2_3BEC0ED1
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC0EA9	0_2_3BEC0EA9
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEBD685	0_2_3BEBD685
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB4666	0_2_3BEB4666
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEBD67C	0_2_3BEBD67C
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC2E73	0_2_3BEC2E73
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC4645	0_2_3BEC4645
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC1640	0_2_3BEC1640
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB765A	0_2_3BEB765A
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB3E09	0_2_3BEB3E09
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC0E1E	0_2_3BEC0E1E
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB661F	0_2_3BEB661F
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB461C	0_2_3BEB461C
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB3DE4	0_2_3BEB3DE4
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB3DF2	0_2_3BEB3DF2
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC0DDC	0_2_3BEC0DDC
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEBC5DD	0_2_3BEBC5DD
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEBD5D6	0_2_3BEBD5D6
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB3DA8	0_2_3BEB3DA8
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB45B1	0_2_3BEB45B1
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC9584	0_2_3BEC9584
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB4D9B	0_2_3BEB4D9B
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEBD596	0_2_3BEBD596
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB3D70	0_2_3BEB3D70
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB4D08	0_2_3BEB4D08
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB4D1E	0_2_3BEB4D1E
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB751C	0_2_3BEB751C
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB4CF9	0_2_3BEB4CF9
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB4CF6	0_2_3BEB4CF6
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB4C92	0_2_3BEB4C92
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB4C66	0_2_3BEB4C66
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB4C51	0_2_3BEB4C51
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB9455	0_2_3BEB9455
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 2_2_053B3008	2_2_053B3008
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 2_2_053B2FF8	2_2_053B2FF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 2_2_097DC5DF	2_2_097DC5DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 2_2_097DC917	2_2_097DC917
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 2_2_097D3D48	2_2_097D3D48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 2_2_097D3D38	2_2_097D3D38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 2_2_097DD688	2_2_097DD688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 2_2_099229F8	2_2_099229F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 2_2_09920910	2_2_09920910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 2_2_09926110	2_2_09926110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 2_2_09921528	2_2_09921528
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 2_2_099244C8	2_2_099244C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 2_2_099229E9	2_2_099229E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 2_2_09920C58	2_2_09920C58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 2_2_09922C76	2_2_09922C76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 2_2_09921EB8	2_2_09921EB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 2_2_09921EF0	2_2_09921EF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 2_2_09921EE0	2_2_09921EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 2_2_0994E850	2_2_0994E850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 2_2_0994CED8	2_2_0994CED8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_072F3008	5_2_072F3008
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_072F2FF8	5_2_072F2FF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09E4C5E7	5_2_09E4C5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09E4C917	5_2_09E4C917
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09E488F6	5_2_09E488F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09E4D688	5_2_09E4D688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09F929F8	5_2_09F929F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09F91528	5_2_09F91528
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09F90910	5_2_09F90910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09F929E9	5_2_09F929E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09F92C76	5_2_09F92C76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09F90C58	5_2_09F90C58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09F91EF0	5_2_09F91EF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09F91EEF	5_2_09F91EEF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09FBE850	5_2_09FBE850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09FBE84F	5_2_09FBE84F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09FBE818	5_2_09FBE818
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09FBD290	5_2_09FBD290

Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: String function: 005B1730 appears 34 times
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: String function: 005B1A30 appears 50 times

Source: AdobePDF.exe, 00000000.00000002.2200312594.00000000026DA000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameVppuhvl.exe" vs AdobePDF.exe

Source: AdobePDF.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal88.evad.winEXE@5/2@1/1

Source: C:\Users\user\Desktop\AdobePDF.exe

File created: C:\Users\user\Documents\Elaborate Bytes

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Mutant created: \Sessions\1\BaseNamedObjects\mono1234

Source: AdobePDF.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\AdobePDF.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: AdobePDF.exe	Virustotal: Detection: 12%
Source: AdobePDF.exe	ReversingLabs: Detection: 15%

Source: AdobePDF.exe	String found in binary or memory: error: --helphelp For more information try C:\Users\compile-bamboo\.cargo\registry\src\index.crates.io-6f17d22bba15001f\os_str_bytes-6.5.1\src\raw_str.rs
Source: AdobePDF.exe	String found in binary or memory: error: --helphelp For more information try C:\Users\compile-bamboo\.cargo\registry\src\index.crates.io-6f17d22bba15001f\os_str_bytes-6.5.1\src\raw_str.rs
Source: AdobePDF.exe	String found in binary or memory: error: --helphelp For more information try C:\Users\compile-bamboo\.cargo\registry\src\index.crates.io-6f17d22bba15001f\os_str_bytes-6.5.1\src\raw_str.rs
Source: AdobePDF.exe	String found in binary or memory: error: --helphelp For more information try C:\Users\compile-bamboo\.cargo\registry\src\index.crates.io-6f17d22bba15001f\os_str_bytes-6.5.1\src\raw_str.rs
Source: AdobePDF.exe	String found in binary or memory: --helphelp For more information try C:\Users\compile-bamboo\.cargo\registry\src\index.crates.io-6f17d22bba15001f\os_str_bytes-6.5.1\src\raw_str.rs
Source: AdobePDF.exe	String found in binary or memory: --helphelp For more information try C:\Users\compile-bamboo\.cargo\registry\src\index.crates.io-6f17d22bba15001f\os_str_bytes-6.5.1\src\raw_str.rs
Source: AdobePDF.exe	String found in binary or memory: --helphelp For more information try C:\Users\compile-bamboo\.cargo\registry\src\index.crates.io-6f17d22bba15001f\os_str_bytes-6.5.1\src\raw_str.rs
Source: AdobePDF.exe	String found in binary or memory: --helphelp For more information try C:\Users\compile-bamboo\.cargo\registry\src\index.crates.io-6f17d22bba15001f\os_str_bytes-6.5.1\src\raw_str.rs
Source: AdobePDF.exe	String found in binary or memory: --helphelp For more information try C:\Users\compile-bamboo\.cargo\registry\src\index.crates.io-6f17d22bba15001f\os_str_bytes-6.5.1\src\raw_str.rs
Source: AdobePDF.exe	String found in binary or memory: --helphelp For more information try C:\Users\compile-bamboo\.cargo\registry\src\index.crates.io-6f17d22bba15001f\os_str_bytes-6.5.1\src\raw_str.rs
Source: AdobePDF.exe	String found in binary or memory: error: --helphelpFor more information try C:\Users\compile-bamboo\.cargo\registry\src\index.crates.io-6f17d22bba15001f\os_str_bytes-6.5.1\src\raw_str.rs
Source: AdobePDF.exe	String found in binary or memory: error: --helphelpFor more information try C:\Users\compile-bamboo\.cargo\registry\src\index.crates.io-6f17d22bba15001f\os_str_bytes-6.5.1\src\raw_str.rs
Source: AdobePDF.exe	String found in binary or memory: --helphelpFor more information try C:\Users\compile-bamboo\.cargo\registry\src\index.crates.io-6f17d22bba15001f\os_str_bytes-6.5.1\src\raw_str.rs
Source: AdobePDF.exe	String found in binary or memory: --helphelpFor more information try C:\Users\compile-bamboo\.cargo\registry\src\index.crates.io-6f17d22bba15001f\os_str_bytes-6.5.1\src\raw_str.rs
Source: AdobePDF.exe	String found in binary or memory: --helpupdating self
Source: AdobePDF.exe	String found in binary or memory: --helpupdating self
Source: AdobePDF.exe	String found in binary or memory: iphlpapi.dllif_nametoindexkernel32LoadLibraryExA\/AddDllDirectoryh1h2h3%10s %512s %u %10s %512s %u "%64[^"]" %u %urt%s %s %u %s %s %u "%d%02d%02d %02d:%02d:%02d" %u %d
Source: AdobePDF.exe	String found in binary or memory: --helphelp
Source: AdobePDF.exe	String found in binary or memory: --helphelp
Source: AdobePDF.exe	String found in binary or memory: {before-help}{bin} {version}
Source: AdobePDF.exe	String found in binary or memory: {all-args}{after-help}{before-help}{bin} {version}
Source: AdobePDF.exe	String found in binary or memory: {usage}{after-help}
Source: AdobePDF.exe	String found in binary or memory: &{before-help}{bin} {version}
Source: AdobePDF.exe	String found in binary or memory: author-section}about-section}usage-heading}all-args}positionals}subcommands}after-help}before-help}
Source: AdobePDF.exe	String found in binary or memory: /author-section}about-section}usage-heading}all-args}positionals}subcommands}after-help}before-help}$W`k

Source: C:\Users\user\Desktop\AdobePDF.exe

File read: C:\Users\user\Desktop\AdobePDF.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\AdobePDF.exe "C:\Users\user\Desktop\AdobePDF.exe"
Source: C:\Users\user\Desktop\AdobePDF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Source: C:\Users\user\Desktop\AdobePDF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Source: C:\Users\user\Desktop\AdobePDF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"	Jump to behavior
Source: C:\Users\user\Desktop\AdobePDF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"	Jump to behavior

Source: C:\Users\user\Desktop\AdobePDF.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AdobePDF.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\AdobePDF.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\AdobePDF.exe	Section loaded: a.dll	Jump to behavior
Source: C:\Users\user\Desktop\AdobePDF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\AdobePDF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AdobePDF.exe	Section loaded: a.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: sspicli.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: AdobePDF.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: AdobePDF.exe

Static file information: File size 4024320 > 1048576

Source: AdobePDF.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x1b0e00
Source: AdobePDF.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x1a0a00

Source: AdobePDF.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: AdobePDF.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: AdobePDF.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: AdobePDF.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: AdobePDF.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: AdobePDF.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: AdobePDF.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: AdobePDF.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: protobuf-net.pdbSHA256}Lq source: csc.exe, 00000002.00000003.1976044441.0000000008421000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.1976044441.000000000855B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000002.4208830088.00000000098B0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.2245075144.0000000008A21000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2245075144.0000000008B5B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2525264064.0000000009F20000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: E:\builds\CST-RED-LCW\target\i686-pc-windows-msvc\release\deps\bdredline.pdb source: AdobePDF.exe, hdtach.exe.0.dr
Source:	Binary string: protobuf-net.pdb source: csc.exe, 00000002.00000003.1976044441.0000000008421000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.1976044441.000000000855B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000002.4208830088.00000000098B0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.2245075144.0000000008A21000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2245075144.0000000008B5B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2525264064.0000000009F20000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation

Yara detected Costura Assembly Loader

Source: Yara match	File source: 2.2.csc.exe.81c92a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.csc.exe.9850000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.csc.exe.87c92a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.csc.exe.9ec0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2523646930.00000000075A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4207828082.0000000006FA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4208782145.0000000009850000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2524199967.0000000008743000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2525223078.0000000009EC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4208342328.0000000008143000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: csc.exe PID: 7544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: csc.exe PID: 7876, type: MEMORYSTR

Source: C:\Users\user\Desktop\AdobePDF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Source: C:\Users\user\Desktop\AdobePDF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Source: C:\Users\user\Desktop\AdobePDF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"	Jump to behavior
Source: C:\Users\user\Desktop\AdobePDF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"	Jump to behavior

Source: C:\Users\user\Desktop\AdobePDF.exe

Code function: 0_2_005062D0 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,GetCurrentProcessId,CreateMutexA,CloseHandle,ReleaseMutex,

0_2_005062D0

Source: AdobePDF.exe

Static PE information: real checksum: 0x27ecbf should be: 0x3da302

Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_008987D8 push ecx; retf 0000h	0_2_008987D9
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD687D8 push ecx; retf 0000h	0_2_3BD687D9
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BD62FA9 pushfd ; retf	0_2_3BD62FAA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 2_2_053B696D push ebx; retf	2_2_053B6972
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 2_2_097D3C81 push esp; retf	2_2_097D3C8D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 2_2_099260F0 push 5D07FA47h; ret	2_2_09926109
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 2_2_0994C250 pushad ; iretd	2_2_0994C251
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_072F696D push ebx; retf	5_2_072F6972
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09E4F980 push ebp; ret	5_2_09E4F982
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09E4F979 push esi; ret	5_2_09E4F97A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09E4AB1C push ss; ret	5_2_09E4AB22
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09E4AAF1 push ss; ret	5_2_09E4AAF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09E4FA01 push esi; ret	5_2_09E4FA02
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09E43C81 push esp; retf	5_2_09E43C8D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09E4EFD9 push eax; ret	5_2_09E4EFDA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09E4EFB9 push eax; ret	5_2_09E4EFBA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09E4EFBB push eax; ret	5_2_09E4EFD2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09E4EF98 push eax; ret	5_2_09E4EFB2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09E4EF50 push eax; ret	5_2_09E4EF52
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09E4EF5C push eax; ret	5_2_09E4EF92
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09E4EF58 push eax; ret	5_2_09E4EF5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09E4EEAD push eax; ret	5_2_09E4EEBA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09E4F1D0 push ecx; ret	5_2_09E4F1D2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09E4F1A1 push ecx; ret	5_2_09E4F1A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09E4F1A9 push ecx; ret	5_2_09E4F1AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09E4F150 push ecx; ret	5_2_09E4F152
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09E4F159 push ecx; ret	5_2_09E4F15A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09E4F129 push ecx; ret	5_2_09E4F12A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09E4F131 push ecx; ret	5_2_09E4F132
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09E4F100 push ecx; ret	5_2_09E4F102
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09E4F0B0 push ecx; ret	5_2_09E4F0FA

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\AdobePDF.exe

File created: C:\Users\user\Documents\Elaborate Bytes\HD Tach\hdtach.exe

Jump to dropped file

Source: C:\Users\user\Desktop\AdobePDF.exe

File created: C:\Users\user\Documents\Elaborate Bytes\HD Tach\hdtach.exe

Jump to dropped file

Source: C:\Users\user\Desktop\AdobePDF.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run QualysDLP			Jump to behavior
Source: C:\Users\user\Desktop\AdobePDF.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run QualysDLP			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: csc.exe PID: 7544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: csc.exe PID: 7876, type: MEMORYSTR

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 53B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 6FA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 6BB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 5950000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 75A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 7250000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Window / User API: threadDelayed 3530			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Window / User API: threadDelayed 6318			Jump to behavior

Source: C:\Users\user\Desktop\AdobePDF.exe

Dropped PE file which has not been started: C:\Users\user\Documents\Elaborate Bytes\HD Tach\hdtach.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -27670116110564310s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7724	Thread sleep count: 3530 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -59875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7724	Thread sleep count: 6318 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -59765s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -59656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -59547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -59437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -59328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -59218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -59109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -59000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -58890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -58781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -58672s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -58562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -58453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -58344s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -58230s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -58109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -57984s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -57870s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -57759s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -57250s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -57094s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -56969s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -56857s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -56749s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -56625s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -56515s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -56406s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -56281s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -56172s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -56062s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -55937s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -55828s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -55710s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -55562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -55452s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -55343s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -55234s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -55123s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -55015s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -54905s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -54728s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -54590s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -54484s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -54375s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -54265s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -54156s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -54044s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -53922s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7720	Thread sleep time: -53812s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7896	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58230	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 57984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 57870	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 57759	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 57250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 57094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56857	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56749	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55710	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55452	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55123	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54905	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54728	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54590	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54265	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54044	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 53922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 53812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: csc.exe, 00000002.00000002.4209067510.0000000009BD6000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\AdobePDF.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Code function: 2_2_0994EA90 LdrInitializeThunk,

2_2_0994EA90

Source: C:\Users\user\Desktop\AdobePDF.exe

Code function: 0_2_005062D0 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,GetCurrentProcessId,CreateMutexA,CloseHandle,ReleaseMutex,

0_2_005062D0

Source: C:\Users\user\Desktop\AdobePDF.exe

Code function: 0_2_00452E50 HeapReAlloc,GetProcessHeap,HeapAlloc,HeapFree,

0_2_00452E50

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\AdobePDF.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"

Jump to behavior

Source: C:\Users\user\Desktop\AdobePDF.exe

Code function: 0_2_00587A21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00587A21

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\AdobePDF.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 4EA0000 protect: page readonly			Jump to behavior
Source: C:\Users\user\Desktop\AdobePDF.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 5410000 protect: page readonly			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\AdobePDF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 4EA0000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\Desktop\AdobePDF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 5410000 value starts with: 4D5A			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\AdobePDF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 4EA0000	Jump to behavior
Source: C:\Users\user\Desktop\AdobePDF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 4BA2008	Jump to behavior
Source: C:\Users\user\Desktop\AdobePDF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 5410000	Jump to behavior
Source: C:\Users\user\Desktop\AdobePDF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 50B8008	Jump to behavior

Source: C:\Users\user\Desktop\AdobePDF.exe

Code function: 0_2_0047E360 cpuid

0_2_0047E360

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe VolumeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\AdobePDF.exe

Code function: 0_2_00588043 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00588043

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: csc.exe, 00000005.00000003.2217941569.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2520982210.000000000559B000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2522217215.000000000559B000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2520982210.000000000555E000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2522217215.000000000557C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2521128172.000000000557B000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2520488458.00000000055CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: csc.exe, 00000005.00000003.2520758839.0000000009D78000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2217666335.0000000009D78000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2525088594.0000000009D78000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	131 Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	31 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	11 Disable or Modify Tools	LSASS Memory	141 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	1 DLL Side-Loading	141 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	31 Process Injection	NTDS	141 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	134 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
AdobePDF.exe	12%	Virustotal		Browse
AdobePDF.exe	16%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
newstaticfreepoint24.ddns-ip.net	181.71.216.203	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://curl.se/docs/hsts.html	AdobePDF.exe, hdtach.exe.0.dr	false	high
https://github.com/clap-rs/clap/issuesC:	hdtach.exe.0.dr	false	high
https://github.com/mgravell/protobuf-neti	csc.exe, 00000002.00000003.1976044441.0000000008421000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.1976044441.000000000855B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000002.4208830088.00000000098B0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.2245075144.0000000008A21000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2245075144.0000000008B5B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2525264064.0000000009F20000.00000004.08000000.00040000.00000000.sdmp	false	high
https://stackoverflow.com/q/14436606/23354	csc.exe, 00000002.00000002.4207828082.0000000006FA1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.1976044441.0000000008421000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.1976044441.000000000855B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000002.4208830088.00000000098B0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000002.2523646930.00000000075A1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2245075144.0000000008A21000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2245075144.0000000008B5B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2525264064.0000000009F20000.00000004.08000000.00040000.00000000.sdmp	false	high
https://github.com/mgravell/protobuf-netJ	csc.exe, 00000002.00000003.1976044441.0000000008421000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.1976044441.000000000855B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000002.4208830088.00000000098B0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.2245075144.0000000008A21000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2245075144.0000000008B5B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2525264064.0000000009F20000.00000004.08000000.00040000.00000000.sdmp	false	high
https://curl.se/docs/http-cookies.html	AdobePDF.exe, hdtach.exe.0.dr	false	high
https://stackoverflow.com/q/11564914/23354;	csc.exe, 00000002.00000003.1976044441.0000000008421000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.1976044441.000000000855B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000002.4208830088.00000000098B0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.2245075144.0000000008A21000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2245075144.0000000008B5B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2525264064.0000000009F20000.00000004.08000000.00040000.00000000.sdmp	false	high
https://stackoverflow.com/q/2152978/23354	csc.exe, 00000002.00000003.1976044441.0000000008421000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.1976044441.000000000855B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000002.4208830088.00000000098B0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.2245075144.0000000008A21000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2245075144.0000000008B5B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2525264064.0000000009F20000.00000004.08000000.00040000.00000000.sdmp	false	high
https://github.com/mgravell/protobuf-net	csc.exe, 00000002.00000003.1976044441.0000000008421000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000003.1976044441.000000000855B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000002.4208830088.00000000098B0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.2245075144.0000000008A21000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2245075144.0000000008B5B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2525264064.0000000009F20000.00000004.08000000.00040000.00000000.sdmp	false	high
http://www.w3.or	AdobePDF.exe, hdtach.exe.0.dr	false	high
https://curl.se/docs/alt-svc.html	AdobePDF.exe, hdtach.exe.0.dr	false	high
https://github.com/clap-rs/clap/issues46	AdobePDF.exe, hdtach.exe.0.dr	false	high
https://github.com/clap-rs/clap/issuesSUBCOMMAND	hdtach.exe.0.dr	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	csc.exe, 00000002.00000002.4207828082.0000000006FA1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000002.00000002.4207828082.0000000007223000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2523646930.00000000077FB000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2523646930.00000000075A1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2523646930.0000000007621000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/clap-rs/clap/issues	hdtach.exe.0.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
181.71.216.203	newstaticfreepoint24.ddns-ip.net	Colombia		27831	ColombiaMovilCO	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587430
Start date and time:	2025-01-10 11:32:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	AdobePDF.exe
Detection:	MAL
Classification:	mal88.evad.winEXE@5/2@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 90% Number of executed functions: 312 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:33:24	API Interceptor	9345491x Sleep call for process: csc.exe modified
10:33:26	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run QualysDLP C:\Users\user\Documents\Elaborate Bytes\HD Tach\hdtach.exe
10:33:35	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run QualysDLP C:\Users\user\Documents\Elaborate Bytes\HD Tach\hdtach.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
181.71.216.203	PDFonlineseguro.exe	Get hash	malicious	Unknown	Browse
	AdobePremierPDF.exe	Get hash	malicious	Unknown	Browse
	2LDJIyMl2r.exe	Get hash	malicious	Remcos	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
newstaticfreepoint24.ddns-ip.net	PDFonlineseguro.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	AdobePremierPDF.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	2LDJIyMl2r.exe	Get hash	malicious	Remcos	Browse	181.71.216.203
	SHROsQyiAd.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	4JwhvqLe8n.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	fIPSLgT0lO.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	3XSXmrEOw7.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	ozfqy8Ms6t.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	pPLwX9wSrD.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	hCJ8gK9kNn.exe	Get hash	malicious	Remcos	Browse	181.131.217.244

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ColombiaMovilCO	PDFonlineseguro.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	AdobePremierPDF.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	1736491685b40eefbc9bdfbc98216071e6ff3a4c19c7e1ab8a144cde35036665da85346b6b949.dat-decoded.exe	Get hash	malicious	Remcos	Browse	179.15.136.6
	6.elf	Get hash	malicious	Unknown	Browse	181.70.170.80
	173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Get hash	malicious	Remcos	Browse	179.15.136.6
	1736348224ad77cf86e491faad27e4b5decf1eb0bb26f16b0527e5ef488389ba353aa3db79582.dat-decoded.exe	Get hash	malicious	Remcos	Browse	179.15.136.6
	17363482247f60133f013d62aae38c531ac95bb55a200a243b0e15fa7cf8e8923b2a10590f952.dat-decoded.exe	Get hash	malicious	Remcos	Browse	179.15.136.6
	1736348224f7603a5c535b2b2f6cc29730626d73a967c67551d2d14f73b547fe7b5fc10393994.dat-decoded.exe	Get hash	malicious	Remcos	Browse	179.15.136.6
	1736348224bd83df4c8d79407f8e7ac5cf8c08b59746ce37ff95772daa0a6283b50e2b0882115.dat-decoded.exe	Get hash	malicious	Remcos	Browse	179.15.136.6
	17363482249a873460757a9239193679567953c11d17b898ff9845034e34f5d2e7f4521342673.dat-decoded.exe	Get hash	malicious	Remcos	Browse	179.15.136.6

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	838
Entropy (8bit):	5.343981685113983
Encrypted:	false
SSDEEP:	24:ML9E4KlKDE4KhKiKhRAE4KzeosXE4qdKm:MxHKlYHKh3oRAHKzePHA
MD5:	9CCD52F7E666DC3225FA8A6D9120C198
SHA1:	35571A48C9F29765D69EFD69D95669B1A180BBD9
SHA-256:	965053376DFF2CDD816C41292E23666E3456504A75254130D620C3C5BB94949D
SHA-512:	8B66F632EEEF894527CD0EBF331E97E158A40668AC6D290F079449A03477542B609C5FA7AE1E6321093860B11CE697E2D4FECA24ADE51DC94608398B9BC81B54
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\96012833bebd5f21714fc508603cda97\System.Management.ni.dll",0..

C:\Users\user\Documents\Elaborate Bytes\HD Tach\hdtach.exe

Download File

Process:	C:\Users\user\Desktop\AdobePDF.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	959667331
Entropy (8bit):	0.06018102535485538
Encrypted:	false
SSDEEP:
MD5:	77793946BB70355EF6AD3C0BFB83C136
SHA1:	AE404DDCAD95BD6704D6F9899ED0E8C0E2F00873
SHA-256:	26958D28724FFBA5E101C0738D820625D3420D1D788F51F67ACE82A7800DC45D
SHA-512:	4022D771960228DF76B1187265305A1D4324C309508506E0ABFE1960A5A4ADF36B354AD7A08363CF7F4F6F75C3B91C396BD031A593E6D19C4203E6AB323B20DF
Malicious:	true
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......1..Yu...u...u...>...d...>.......>...c...:.;.s...:...R...:...g...:...m.......g...........>...v...u...r...u.........9.t.......t...Richu...........................PE..L...H..d.........."....".....V"......v....... ....@...........................=.......'...@..................................F#.......#...............&. .... &......C".T...................@D"......B".@............ ..h............................text............................... ..`.rdata...@... ...<..................@..@.data.... ...`#......N#.............@....rsrc.........#......^#.............@..@................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.849405076205069
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	AdobePDF.exe
File size:	4'024'320 bytes
MD5:	44cc93b896b10417f5d231088ffe6924
SHA1:	5def3a0114a71e6affd57d9bc7b9757bf4b6eb14
SHA256:	587d10cf5d8c91fe31141bad01719e6a99914010659ef951b1680e97559e7910
SHA512:	39d38f7baf6213fe7b651e942c7dc673d617d83f25549af3897fd69b51a70c1664096831d2eb725ba6edcc5c96ac291a7c073456e52bbe97b674fe7ebabc25e7
SSDEEP:	98304:ikJWBMZlJBcsrblAKE9E+Fi+MvhsE+NE+y0fR46+gjTkWU5QIi1DkR7ibtouu0qL:ikJWBMZlJBcsrblAKEW+E+MvhsE+NE+U
TLSH:	BE169F91E200D0A7D05B2174E00FEAF5A6323DB6B705DED397887E3E34716D22D396A9
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......1..Yu...u...u...>...d...>.......>...c...:.;.s...:...R...:...g...:...m.......g...........>...v...u...r...u.........9.t.......t..

File Icon


Icon Hash:	51e869694d69924d

Static PE Info

General

Entrypoint:	0x5876b2
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x64B8FF48 [Thu Jul 20 09:32:56 2023 UTC]
TLS Callbacks:	0x52dd90
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	c5269153981e562b1aed0a612d80f025

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
call 00007F5F688E802Eh
jmp 00007F5F688E74C9h
int3
int3
int3
int3
push ebx
push esi
mov eax, dword ptr [esp+18h]
or eax, eax
jne 00007F5F688E766Ah
mov ecx, dword ptr [esp+14h]
mov eax, dword ptr [esp+10h]
xor edx, edx
div ecx
mov ebx, eax
mov eax, dword ptr [esp+0Ch]
div ecx
mov edx, ebx
jmp 00007F5F688E7693h
mov ecx, eax
mov ebx, dword ptr [esp+14h]
mov edx, dword ptr [esp+10h]
mov eax, dword ptr [esp+0Ch]
shr ecx, 1
rcr ebx, 1
shr edx, 1
rcr eax, 1
or ecx, ecx
jne 00007F5F688E7646h
div ebx
mov esi, eax
mul dword ptr [esp+18h]
mov ecx, eax
mov eax, dword ptr [esp+14h]
mul esi
add edx, ecx
jc 00007F5F688E7660h
cmp edx, dword ptr [esp+10h]
jnbe 00007F5F688E765Ah
jc 00007F5F688E7659h
cmp eax, dword ptr [esp+0Ch]
jbe 00007F5F688E7653h
dec esi
xor edx, edx
mov eax, esi
pop esi
pop ebx
retn 0010h
push ebp
mov ebp, esp
test byte ptr [ebp+08h], 00000001h
push esi
mov esi, ecx
mov dword ptr [esi], 0061A9A8h
je 00007F5F688E765Ch
push 0000000Ch
push esi
call 00007F5F688E82C8h
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
cmp ecx, dword ptr [00636510h]
jne 00007F5F688E7653h
ret
jmp 00007F5F688E7945h
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
push ebx
xor edi, edi
mov eax, dword ptr [esp+14h]
or eax, eax
jnl 00007F5F688E7666h
inc edi
mov edx, dword ptr [esp+10h]
neg eax
neg edx
sbb eax, 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2346ec	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x238000	0x1a08e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x26d200	0x8120	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x262000	0xd4a0	.rsrc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2243b0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x224440	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2242f0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1b2000	0x368	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1b1000	0x1b0e00	2cbf901d97457c56bc03658830ec27e4	False	0.49542146440947155	data	6.549341400084285	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1b2000	0x84000	0x83c00	8d2f67a016b283587097996d6458bdcf	False	0.4693559505455408	data	5.798902979613995	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x236000	0x2000	0x1000	491c26b7af8d659e4e2e6903dddc8341	False	0.228271484375	data	2.891116441211828	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x238000	0x1a08e0	0x1a0a00	70918993bb1497a9b7066a4a2a8fc853	False	0.591280026440144	data	7.002302548921975	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x238588	0xcf28	Device independent bitmap graphic, 552 x 24 x 32, image size 52992, resolution 3543 x 3543 px/m			0.4380374113742646
RT_BITMAP	0x2454b0	0x23f28	Device independent bitmap graphic, 920 x 40 x 32, image size 147200, resolution 3503 x 3503 px/m			0.3137190980711763
RT_BITMAP	0x2693d8	0x19f98	Device independent bitmap graphic, 782 x 34 x 32, image size 106352, resolution 3543 x 3543 px/m			0.3707891570794797
RT_BITMAP	0x283370	0x402a	Device independent bitmap graphic, 64 x 64 x 32, image size 16386, resolution 2834 x 2834 px/m			0.39419213442103984
RT_ICON	0x28739c	0x587b9	PC bitmap, Windows 3.x format, 45981 x 2 x 41, image size 362988, cbSize 362425, bits offset 54			0.9976105401117472
RT_ICON	0x2dfb58	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600			0.4078558225508318
RT_ICON	0x2e4fe0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688	English	United States	0.5551705756929638
RT_ICON	0x2e5e88	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	English	United States	0.680956678700361
RT_ICON	0x2e6730	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	English	United States	0.6683526011560693
RT_ICON	0x2e6c98	0xf532	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.0004142106101641
RT_ICON	0x2f61cc	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.25051756772743405
RT_ICON	0x3069f4	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.3019012753897024
RT_ICON	0x30ac1c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.3429460580912863
RT_ICON	0x30d1c4	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.4176829268292683
RT_ICON	0x30e26c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.3962765957446808
RT_STRING	0x30e6d4	0x11a4	data			0.5004428697962799
RT_RCDATA	0x30f878	0x46d3b	Delphi compiled form 'TfHint'			0.3806216327079319
RT_RCDATA	0x3565b4	0x46d3b	Delphi compiled form 'TfHint'			0.33296680190412503
RT_RCDATA	0x39d2f0	0x6a97	Delphi compiled form 'TfLinks'			0.5662036867372742
RT_RCDATA	0x3a3d88	0x5445	Delphi compiled form '\021TTechServiceFrame\020TechServiceFrame'			0.46646270801464795
RT_GROUP_ICON	0x3a91d0	0x84	data	English	United States	0.6742424242424242
RT_ANIICON	0x3a9254	0x2f689	PC bitmap, Windows 3.x format, 24374 x 2 x 49, image size 194811, cbSize 194185, bits offset 54			0.9943095501712285

Imports

DLL	Import
WINTRUST.dll	WinVerifyTrust
kernel32.dll	SetStdHandle, GetFileAttributesExW, GetCurrentProcessId, LCMapStringW, CompareStringW, GetTimeFormatW, GetDateFormatW, GetConsoleOutputCP, GetCommandLineA, WriteFile, GetModuleHandleExW, FreeLibraryAndExitThread, ExitThread, FileTimeToSystemTime, PeekNamedPipe, GetDriveTypeW, LoadLibraryExW, InitializeCriticalSectionAndSpinCount, SetLastError, FormatMessageW, QueryPerformanceCounter, GetTickCount, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, QueryPerformanceFrequency, GetSystemDirectoryA, FreeLibrary, GetModuleHandleA, LoadLibraryA, RaiseException, RtlUnwind, GetStartupInfoW, IsDebuggerPresent, Sleep, InitializeSListHead, GetCurrentThreadId, MultiByteToWideChar, WideCharToMultiByte, SetEndOfFile, SetHandleInformation, SetUnhandledExceptionFilter, UnhandledExceptionFilter, WaitForSingleObjectEx, GetModuleHandleW, GetProcAddress, GetLastError, LoadLibraryW, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, FindFirstFileExW, GetEnvironmentVariableA, SleepEx, VerSetConditionMask, VerifyVersionInfoW, CreateFileA, GetFileSizeEx, ReadFile, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetStringTypeW, GetTimeZoneInformation, DecodePointer, GetModuleFileNameW, SetErrorMode, SetThreadErrorMode, GetStdHandle, GetConsoleMode, GetFileInformationByHandleEx, TryAcquireSRWLockExclusive, GetConsoleScreenBufferInfo, SetConsoleTextAttribute, SetConsoleMode, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, SystemTimeToTzSpecificLocalTime, ReleaseMutex, GetCurrentProcess, GetCurrentThread, RtlCaptureContext, CreateMutexA, FreeEnvironmentStringsW, FindClose, ReleaseSRWLockShared, CompareStringOrdinal, AddVectoredExceptionHandler, SetThreadStackGuarantee, SwitchToThread, GetCurrentDirectoryW, GetEnvironmentStringsW, GetEnvironmentVariableW, SetEnvironmentVariableW, CloseHandle, TlsGetValue, GetCommandLineW, FlushFileBuffers, DuplicateHandle, SetFilePointerEx, WriteFileEx, ReadFileEx, WaitForSingleObject, GetExitCodeProcess, TerminateProcess, GetProcessHeap, HeapAlloc, HeapFree, HeapReAlloc, AcquireSRWLockShared, FindNextFileW, CreateFileW, GetFileInformationByHandle, IsProcessorFeaturePresent, MoveFileExA, CreateDirectoryW, FindFirstFileW, DeleteFileW, MoveFileExW, GetFinalPathNameByHandleW, CopyFileExW, CreateEventW, GetOverlappedResult, CancelIo, GetFileType, SetCurrentDirectoryW, ExitProcess, GetFullPathNameW, CreateNamedPipeW, WaitForMultipleObjects, GetSystemDirectoryW, GetWindowsDirectoryW, CreateProcessW, GetFileAttributesW, TlsSetValue, WriteConsoleW, ReadConsoleW, CreateThread, InitOnceBeginInitialize, TlsAlloc, InitOnceComplete, TlsFree, GetSystemTimeAsFileTime, HeapSize
advapi32.dll	CryptDestroyHash, CryptHashData, CryptCreateHash, CryptGetHashParam, CryptReleaseContext, RegisterServiceCtrlHandlerExW, SetServiceStatus, StartServiceCtrlDispatcherW, CryptAcquireContextA, SystemFunction036
crypt32.dll	CryptStringToBinaryA, CertGetEnhancedKeyUsage, CertCloseStore, CertOpenStore, PFXImportCertStore, CertAddCertificateContextToStore, CertEnumCertificatesInStore, CertFreeCertificateChain, CertGetCertificateChain, CertFreeCertificateChainEngine, CertCreateCertificateChainEngine, CryptQueryObject, CertGetNameStringA, CertFindExtension, CryptDecodeObjectEx, CertFindCertificateInStore, CertDuplicateCertificateContext, CertFreeCertificateContext
ws2_32.dll	select, __WSAFDIsSet, socket, htons, WSACleanup, WSAStartup, WSASetLastError, htonl, WSAGetLastError, WSAWaitForMultipleEvents, WSAResetEvent, WSAEventSelect, WSAEnumNetworkEvents, getaddrinfo, WSACloseEvent, ntohs, setsockopt, send, recv, getsockopt, getpeername, getsockname, accept, listen, ioctlsocket, connect, bind, WSASocketW, closesocket, freeaddrinfo, WSAIoctl, WSACreateEvent
bcrypt.dll	BCryptGenRandom
ntdll.dll	RtlNtStatusToDosError, NtWriteFile, NtReadFile

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 11:33:25.266175032 CET	49736	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:33:25.271020889 CET	30203	49736	181.71.216.203	192.168.2.4
Jan 10, 2025 11:33:25.271086931 CET	49736	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:33:25.304965973 CET	49736	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:33:25.309789896 CET	30203	49736	181.71.216.203	192.168.2.4
Jan 10, 2025 11:33:25.309849024 CET	49736	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:33:25.314687967 CET	30203	49736	181.71.216.203	192.168.2.4
Jan 10, 2025 11:33:46.653623104 CET	30203	49736	181.71.216.203	192.168.2.4
Jan 10, 2025 11:33:46.653748989 CET	49736	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:33:46.708378077 CET	49736	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:33:46.713243961 CET	30203	49736	181.71.216.203	192.168.2.4
Jan 10, 2025 11:33:46.840316057 CET	49737	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:33:46.845230103 CET	30203	49737	181.71.216.203	192.168.2.4
Jan 10, 2025 11:33:46.845326900 CET	49737	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:33:46.855823040 CET	49737	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:33:46.860778093 CET	30203	49737	181.71.216.203	192.168.2.4
Jan 10, 2025 11:33:46.863609076 CET	49737	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:33:46.868422985 CET	30203	49737	181.71.216.203	192.168.2.4
Jan 10, 2025 11:34:08.235174894 CET	30203	49737	181.71.216.203	192.168.2.4
Jan 10, 2025 11:34:08.235275984 CET	49737	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:34:08.238990068 CET	49737	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:34:08.243751049 CET	30203	49737	181.71.216.203	192.168.2.4
Jan 10, 2025 11:34:08.344441891 CET	49813	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:34:08.349241018 CET	30203	49813	181.71.216.203	192.168.2.4
Jan 10, 2025 11:34:08.349318027 CET	49813	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:34:08.350033045 CET	49813	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:34:08.354816914 CET	30203	49813	181.71.216.203	192.168.2.4
Jan 10, 2025 11:34:08.356141090 CET	49813	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:34:08.360901117 CET	30203	49813	181.71.216.203	192.168.2.4
Jan 10, 2025 11:34:29.721004009 CET	30203	49813	181.71.216.203	192.168.2.4
Jan 10, 2025 11:34:29.721085072 CET	49813	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:34:29.721246958 CET	49813	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:34:29.726126909 CET	30203	49813	181.71.216.203	192.168.2.4
Jan 10, 2025 11:34:29.825552940 CET	49949	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:34:29.830447912 CET	30203	49949	181.71.216.203	192.168.2.4
Jan 10, 2025 11:34:29.830655098 CET	49949	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:34:29.831244946 CET	49949	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:34:29.836078882 CET	30203	49949	181.71.216.203	192.168.2.4
Jan 10, 2025 11:34:29.836148977 CET	49949	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:34:29.841063976 CET	30203	49949	181.71.216.203	192.168.2.4
Jan 10, 2025 11:34:51.189040899 CET	30203	49949	181.71.216.203	192.168.2.4
Jan 10, 2025 11:34:51.189142942 CET	49949	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:34:51.189457893 CET	49949	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:34:51.194202900 CET	30203	49949	181.71.216.203	192.168.2.4
Jan 10, 2025 11:34:51.295351982 CET	50006	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:34:51.300175905 CET	30203	50006	181.71.216.203	192.168.2.4
Jan 10, 2025 11:34:51.300609112 CET	50006	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:34:51.303335905 CET	50006	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:34:51.308166027 CET	30203	50006	181.71.216.203	192.168.2.4
Jan 10, 2025 11:34:51.309113979 CET	50006	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:34:51.313895941 CET	30203	50006	181.71.216.203	192.168.2.4
Jan 10, 2025 11:34:54.295331955 CET	50006	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:34:54.300462961 CET	30203	50006	181.71.216.203	192.168.2.4
Jan 10, 2025 11:34:54.300553083 CET	50006	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:34:54.305339098 CET	30203	50006	181.71.216.203	192.168.2.4
Jan 10, 2025 11:35:09.201036930 CET	50006	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:35:09.205801964 CET	30203	50006	181.71.216.203	192.168.2.4
Jan 10, 2025 11:35:09.205957890 CET	50006	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:35:09.210736036 CET	30203	50006	181.71.216.203	192.168.2.4
Jan 10, 2025 11:35:12.675806999 CET	30203	50006	181.71.216.203	192.168.2.4
Jan 10, 2025 11:35:12.675887108 CET	50006	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:35:12.676089048 CET	50006	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:35:12.680857897 CET	30203	50006	181.71.216.203	192.168.2.4
Jan 10, 2025 11:35:12.779181957 CET	50007	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:35:12.784152031 CET	30203	50007	181.71.216.203	192.168.2.4
Jan 10, 2025 11:35:12.784281015 CET	50007	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:35:12.785258055 CET	50007	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:35:12.790081024 CET	30203	50007	181.71.216.203	192.168.2.4
Jan 10, 2025 11:35:12.790195942 CET	50007	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:35:12.795062065 CET	30203	50007	181.71.216.203	192.168.2.4
Jan 10, 2025 11:35:13.029417992 CET	50007	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:35:13.034245968 CET	30203	50007	181.71.216.203	192.168.2.4
Jan 10, 2025 11:35:13.034326077 CET	50007	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:35:13.039093018 CET	30203	50007	181.71.216.203	192.168.2.4
Jan 10, 2025 11:35:18.170505047 CET	50007	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:35:18.175349951 CET	30203	50007	181.71.216.203	192.168.2.4
Jan 10, 2025 11:35:18.176362991 CET	50007	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:35:18.181188107 CET	30203	50007	181.71.216.203	192.168.2.4
Jan 10, 2025 11:35:28.513220072 CET	50007	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:35:28.518798113 CET	30203	50007	181.71.216.203	192.168.2.4
Jan 10, 2025 11:35:28.522989035 CET	50007	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:35:28.528533936 CET	30203	50007	181.71.216.203	192.168.2.4
Jan 10, 2025 11:35:31.122906923 CET	50007	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:35:31.127739906 CET	30203	50007	181.71.216.203	192.168.2.4
Jan 10, 2025 11:35:31.127990961 CET	50007	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:35:31.132914066 CET	30203	50007	181.71.216.203	192.168.2.4
Jan 10, 2025 11:35:34.158803940 CET	30203	50007	181.71.216.203	192.168.2.4
Jan 10, 2025 11:35:34.159593105 CET	50007	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:35:34.159866095 CET	50007	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:35:34.164592028 CET	30203	50007	181.71.216.203	192.168.2.4
Jan 10, 2025 11:35:34.263714075 CET	50008	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:35:34.268727064 CET	30203	50008	181.71.216.203	192.168.2.4
Jan 10, 2025 11:35:34.268949986 CET	50008	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:35:34.269659042 CET	50008	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:35:34.274487972 CET	30203	50008	181.71.216.203	192.168.2.4
Jan 10, 2025 11:35:34.278891087 CET	50008	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:35:34.283708096 CET	30203	50008	181.71.216.203	192.168.2.4
Jan 10, 2025 11:35:55.608540058 CET	30203	50008	181.71.216.203	192.168.2.4
Jan 10, 2025 11:35:55.608612061 CET	50008	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:35:55.608820915 CET	50008	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:35:55.613631010 CET	30203	50008	181.71.216.203	192.168.2.4
Jan 10, 2025 11:35:55.716567039 CET	50009	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:35:55.721527100 CET	30203	50009	181.71.216.203	192.168.2.4
Jan 10, 2025 11:35:55.722249985 CET	50009	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:35:55.722249985 CET	50009	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:35:55.727108955 CET	30203	50009	181.71.216.203	192.168.2.4
Jan 10, 2025 11:35:55.729310036 CET	50009	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:35:55.734224081 CET	30203	50009	181.71.216.203	192.168.2.4
Jan 10, 2025 11:36:00.388536930 CET	50009	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:36:00.393428087 CET	30203	50009	181.71.216.203	192.168.2.4
Jan 10, 2025 11:36:00.393575907 CET	50009	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:36:00.398423910 CET	30203	50009	181.71.216.203	192.168.2.4
Jan 10, 2025 11:36:07.966344118 CET	50009	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:36:07.971263885 CET	30203	50009	181.71.216.203	192.168.2.4
Jan 10, 2025 11:36:07.971404076 CET	50009	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:36:07.976232052 CET	30203	50009	181.71.216.203	192.168.2.4
Jan 10, 2025 11:36:14.264868975 CET	50009	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:36:14.269731045 CET	30203	50009	181.71.216.203	192.168.2.4
Jan 10, 2025 11:36:14.273222923 CET	50009	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:36:14.278034925 CET	30203	50009	181.71.216.203	192.168.2.4
Jan 10, 2025 11:36:17.061954021 CET	30203	50009	181.71.216.203	192.168.2.4
Jan 10, 2025 11:36:17.062040091 CET	50009	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:36:17.062314034 CET	50009	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:36:17.067106009 CET	30203	50009	181.71.216.203	192.168.2.4
Jan 10, 2025 11:36:17.170113087 CET	50010	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:36:17.174941063 CET	30203	50010	181.71.216.203	192.168.2.4
Jan 10, 2025 11:36:17.175060034 CET	50010	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:36:17.176747084 CET	50010	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:36:17.181502104 CET	30203	50010	181.71.216.203	192.168.2.4
Jan 10, 2025 11:36:17.181538105 CET	50010	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:36:17.186307907 CET	30203	50010	181.71.216.203	192.168.2.4
Jan 10, 2025 11:36:28.372792006 CET	50010	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:36:28.377825022 CET	30203	50010	181.71.216.203	192.168.2.4
Jan 10, 2025 11:36:28.377895117 CET	50010	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:36:28.382704020 CET	30203	50010	181.71.216.203	192.168.2.4
Jan 10, 2025 11:36:33.591770887 CET	50010	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:36:33.596580029 CET	30203	50010	181.71.216.203	192.168.2.4
Jan 10, 2025 11:36:33.596635103 CET	50010	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:36:33.601453066 CET	30203	50010	181.71.216.203	192.168.2.4
Jan 10, 2025 11:36:38.531071901 CET	30203	50010	181.71.216.203	192.168.2.4
Jan 10, 2025 11:36:38.533102989 CET	50010	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:36:38.533252001 CET	50010	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:36:38.538058043 CET	30203	50010	181.71.216.203	192.168.2.4
Jan 10, 2025 11:36:38.638699055 CET	50011	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:36:38.643579960 CET	30203	50011	181.71.216.203	192.168.2.4
Jan 10, 2025 11:36:38.644385099 CET	50011	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:36:38.644385099 CET	50011	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:36:38.649259090 CET	30203	50011	181.71.216.203	192.168.2.4
Jan 10, 2025 11:36:38.649414062 CET	50011	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:36:38.654215097 CET	30203	50011	181.71.216.203	192.168.2.4
Jan 10, 2025 11:36:39.482016087 CET	50011	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:36:39.487147093 CET	30203	50011	181.71.216.203	192.168.2.4
Jan 10, 2025 11:36:39.487235069 CET	50011	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:36:39.492145061 CET	30203	50011	181.71.216.203	192.168.2.4
Jan 10, 2025 11:36:48.466811895 CET	50011	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:36:48.471915960 CET	30203	50011	181.71.216.203	192.168.2.4
Jan 10, 2025 11:36:48.474921942 CET	50011	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:36:48.479893923 CET	30203	50011	181.71.216.203	192.168.2.4
Jan 10, 2025 11:36:56.685240984 CET	50011	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:36:56.690201998 CET	30203	50011	181.71.216.203	192.168.2.4
Jan 10, 2025 11:36:56.693126917 CET	50011	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:36:56.698046923 CET	30203	50011	181.71.216.203	192.168.2.4
Jan 10, 2025 11:37:00.000757933 CET	30203	50011	181.71.216.203	192.168.2.4
Jan 10, 2025 11:37:00.002842903 CET	50011	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:37:00.002985001 CET	50011	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:37:00.007956028 CET	30203	50011	181.71.216.203	192.168.2.4
Jan 10, 2025 11:37:00.110835075 CET	50012	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:37:00.115892887 CET	30203	50012	181.71.216.203	192.168.2.4
Jan 10, 2025 11:37:00.116236925 CET	50012	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:37:00.117161989 CET	50012	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:37:00.122186899 CET	30203	50012	181.71.216.203	192.168.2.4
Jan 10, 2025 11:37:00.122292042 CET	50012	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:37:00.127237082 CET	30203	50012	181.71.216.203	192.168.2.4
Jan 10, 2025 11:37:11.103271008 CET	50012	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:37:11.108253956 CET	30203	50012	181.71.216.203	192.168.2.4
Jan 10, 2025 11:37:11.108321905 CET	50012	30203	192.168.2.4	181.71.216.203
Jan 10, 2025 11:37:11.113195896 CET	30203	50012	181.71.216.203	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 11:33:25.249376059 CET	52131	53	192.168.2.4	1.1.1.1
Jan 10, 2025 11:33:25.264029026 CET	53	52131	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 11:33:25.249376059 CET	192.168.2.4	1.1.1.1	0xdf4f	Standard query (0)	newstaticfreepoint24.ddns-ip.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 11:33:25.264029026 CET	1.1.1.1	192.168.2.4	0xdf4f	No error (0)	newstaticfreepoint24.ddns-ip.net		181.71.216.203	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	05:33:01
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\AdobePDF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\AdobePDF.exe"
Imagebase:	0x400000
File size:	4'024'320 bytes
MD5 hash:	44CC93B896B10417F5D231088FFE6924
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:33:21
Start date:	10/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Imagebase:	0x7d0000
File size:	2'141'552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000002.00000002.4207828082.0000000006FA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000002.00000002.4208782145.0000000009850000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000002.00000002.4208342328.0000000008143000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	05:33:48
Start date:	10/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Imagebase:	0x7d0000
File size:	2'141'552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000005.00000002.2523646930.00000000075A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000005.00000002.2524199967.0000000008743000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000005.00000002.2525223078.0000000009EC0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	15%
Dynamic/Decrypted Code Coverage:	65%
Signature Coverage:	10.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	61

Executed Functions

Function 00891402 Relevance: 40.8, APIs: 1, Strings: 22, Instructions: 521
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(FFFFE180), ref: 0089142B

Strings

D@JN, xrefs: 00892A2C
e, xrefs: 008924A1
l, xrefs: 008924CB
t, xrefs: 008924A8
3, xrefs: 00892241
d, xrefs: 008924EE
H, xrefs: 008924D9
n, xrefs: 008924E7
a, xrefs: 008924E0
G, xrefs: 0089249A
3, xrefs: 00892047
l, xrefs: 008924F5
o, xrefs: 008924B6
e, xrefs: 008924FC
x, xrefs: 0089250A
V, xrefs: 00891957
M, xrefs: 008924AF
e, xrefs: 008924D2
u, xrefs: 008924C4
E, xrefs: 00892503
d, xrefs: 008924BD
W, xrefs: 00892511

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: LibraryLoad
String ID: D@JN$E$G$H$M$V$W$a$d$d$e$e$e$l$l$n$o$t$u$x$3$3
API String ID: 1029625771-4042423897
Opcode ID: e1c81933f18392f7607d2e97bfd86f349c5bd05ede4ae9a2dfe480ad05001e62
Instruction ID: 9984b38e84b5817ea6b29cfd08641caabf8a869aceb8d8a9bf1e9a41f750a47e
Opcode Fuzzy Hash: e1c81933f18392f7607d2e97bfd86f349c5bd05ede4ae9a2dfe480ad05001e62
Instruction Fuzzy Hash: 3922E5B1D086689BEB208B28DC446EABBB1FF95300F0481EAD44DA7741D6394FC5CF52

Function 3BEBFC6B Relevance: 24.9, APIs: 1, Strings: 13, Instructions: 422
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 3BEBFFDF

Strings

e, xrefs: 3BEC007B
l, xrefs: 3BEC0058
F, xrefs: 3BEC004A
3:7B, xrefs: 3BEC05C4
i, xrefs: 3BEC0051
e, xrefs: 3BEC003C
S, xrefs: 3BEC0066
PNM5, xrefs: 3BEC01AA
z, xrefs: 3BEC0074
i, xrefs: 3BEC006D
G, xrefs: 3BEC0035
e, xrefs: 3BEC005F
t, xrefs: 3BEC0043

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateFile
String ID: 3:7B$F$G$PNM5$S$e$e$e$i$i$l$t$z
API String ID: 823142352-306576767
Opcode ID: a585066e22a4095691a59ce8abc98416cea7ba8de44c94a35e6523025f6b1265
Instruction ID: ce20279f519e2e937f97dabe01c4b9c84374e2358785bd8733e7d3600d2e883c
Opcode Fuzzy Hash: a585066e22a4095691a59ce8abc98416cea7ba8de44c94a35e6523025f6b1265
Instruction Fuzzy Hash: 66F146B1D082A58AFB20CA28DD84BEB7B75EF81314F0481F9D94C67681D6794FD18F92

Function 3BEBC5DD Relevance: 24.3, APIs: 1, Strings: 15, Instructions: 339
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

a, xrefs: 3BEBE0EA
C, xrefs: 3BEBE0D5
W, xrefs: 3BEBE11B
r, xrefs: 3BEBE0DC
l, xrefs: 3BEBE10D
P?L=, xrefs: 3BEBD55F
e, xrefs: 3BEBE0F8
F, xrefs: 3BEBE0FF
_W, xrefs: 3BEBE0AE
^P, xrefs: 3BEBD5C0
e, xrefs: 3BEBE114
i, xrefs: 3BEBE106
e, xrefs: 3BEBE0E3
t, xrefs: 3BEBE0F1
5P5M, xrefs: 3BEBE0B8

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID: 5P5M$C$F$P?L=$W$^P$_W$a$e$e$e$i$l$r$t
API String ID: 0-4150171463
Opcode ID: b8485887a7e33a0b4052db163afa3efa1c86d06ce3875aaa384cb55abad77e0f
Instruction ID: 8eff32f741b479e5529509ef3f8b91041dd543b2f310c2385b7dfbcd8c6d38b0
Opcode Fuzzy Hash: b8485887a7e33a0b4052db163afa3efa1c86d06ce3875aaa384cb55abad77e0f
Instruction Fuzzy Hash: 72C14AF2D082549FFB14CB28DC59BEB7B78EB91314F0480FAD90D56280D67D5AC68A63

Function 3BEBD596 Relevance: 22.8, APIs: 1, Strings: 14, Instructions: 273
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

a, xrefs: 3BEBE0EA
W, xrefs: 3BEBE11B
C, xrefs: 3BEBE0D5
r, xrefs: 3BEBE0DC
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0F8
F, xrefs: 3BEBE0FF
_W, xrefs: 3BEBE0AE
^P, xrefs: 3BEBD5C0
e, xrefs: 3BEBE114
i, xrefs: 3BEBE106
e, xrefs: 3BEBE0E3
t, xrefs: 3BEBE0F1
5P5M, xrefs: 3BEBE0B8

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID: 5P5M$C$F$W$^P$_W$a$e$e$e$i$l$r$t
API String ID: 0-3650445608
Opcode ID: aac97f47407c8053540d91d15cea422ec1562f14f306bffc4a7a9c1790143d39
Instruction ID: 3eba7becf474da7e1c4b63c29e8b94bee7b1c06405eab2e04452f5327b00eca5
Opcode Fuzzy Hash: aac97f47407c8053540d91d15cea422ec1562f14f306bffc4a7a9c1790143d39
Instruction Fuzzy Hash: 76917AB2D082589FFB24C728DC59BEB7B68DB81314F0440FED80D56681DA7D5EC68A63

Function 3BEBD67C Relevance: 22.7, APIs: 1, Strings: 14, Instructions: 209
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

3EF4, xrefs: 3BEBD67C
a, xrefs: 3BEBE0EA
W, xrefs: 3BEBE11B
C, xrefs: 3BEBE0D5
r, xrefs: 3BEBE0DC
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0F8
F, xrefs: 3BEBE0FF
_W, xrefs: 3BEBE0AE
e, xrefs: 3BEBE114
i, xrefs: 3BEBE106
e, xrefs: 3BEBE0E3
t, xrefs: 3BEBE0F1
5P5M, xrefs: 3BEBE0B8

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 3EF4$5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3006875395
Opcode ID: 1f3159f272e2475ea0b8efac505ace3a6763449ae096e71ec23b8b93e50727dc
Instruction ID: 59be6971a0d5f49adbd8d794c2f8f2585e32c5928e710c9024b710e2e9bb9fc9
Opcode Fuzzy Hash: 1f3159f272e2475ea0b8efac505ace3a6763449ae096e71ec23b8b93e50727dc
Instruction Fuzzy Hash: 4E7149B2D0C2689EFB24C728DC89BDB7B68DB41314F0440FAD94C56281D67D5EC68AA3

Function 3BEBD5D6 Relevance: 21.3, APIs: 1, Strings: 13, Instructions: 254
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

a, xrefs: 3BEBE0EA
W, xrefs: 3BEBE11B
C, xrefs: 3BEBE0D5
r, xrefs: 3BEBE0DC
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0F8
F, xrefs: 3BEBE0FF
_W, xrefs: 3BEBE0AE
e, xrefs: 3BEBE114
i, xrefs: 3BEBE106
e, xrefs: 3BEBE0E3
t, xrefs: 3BEBE0F1
5P5M, xrefs: 3BEBE0B8

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: 60d55f7e49cf88aedff0039c5da0411b637dfab33f89107f7f83c44f389ec987
Instruction ID: 0d33d3e364c66e3f473adf7605ee6aaf54505c83de24af124a80a7938d0581ce
Opcode Fuzzy Hash: 60d55f7e49cf88aedff0039c5da0411b637dfab33f89107f7f83c44f389ec987
Instruction Fuzzy Hash: 269158B2D082589FFB24CB28DC59BEB7B68DB91314F0441FED80C16681D67D5EC68A63

Function 3BEBD92D Relevance: 21.2, APIs: 1, Strings: 13, Instructions: 246COMMON

Download Yara Rule

Strings

a, xrefs: 3BEBE0EA
W, xrefs: 3BEBE11B
C, xrefs: 3BEBE0D5
r, xrefs: 3BEBE0DC
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0F8
F, xrefs: 3BEBE0FF
_W, xrefs: 3BEBE0AE
e, xrefs: 3BEBE114
i, xrefs: 3BEBE106
e, xrefs: 3BEBE0E3
t, xrefs: 3BEBE0F1
5P5M, xrefs: 3BEBE0B8

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 0-3741801046
Opcode ID: 221986f34f902f84739f456817315552a3ed21400c2fd6772d97aad00215e27f
Instruction ID: 65750d0eb395550f76505488c38df6f3c947c9977290d332ce3e89135177acff
Opcode Fuzzy Hash: 221986f34f902f84739f456817315552a3ed21400c2fd6772d97aad00215e27f
Instruction Fuzzy Hash: D8815CB2D082689FFB24C728DC49AEB7B74DF42314F0441FAD84C16681D67D5EC68A63

Function 3BEBD8A6 Relevance: 21.2, APIs: 1, Strings: 13, Instructions: 239COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 3BEBE09D

Strings

a, xrefs: 3BEBE0EA
W, xrefs: 3BEBE11B
C, xrefs: 3BEBE0D5
r, xrefs: 3BEBE0DC
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0F8
F, xrefs: 3BEBE0FF
_W, xrefs: 3BEBE0AE
e, xrefs: 3BEBE114
i, xrefs: 3BEBE106
e, xrefs: 3BEBE0E3
t, xrefs: 3BEBE0F1
5P5M, xrefs: 3BEBE0B8

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: efd4a9f007888a262357efecc2e88af222ff4f8596168ecaed9e80c832c01fa9
Instruction ID: 83745cf46b28cc9f66376e9c4082e15ecd89a4647c900b7030e3685be02492d5
Opcode Fuzzy Hash: efd4a9f007888a262357efecc2e88af222ff4f8596168ecaed9e80c832c01fa9
Instruction Fuzzy Hash: C4816BB2D082689EFB24C728DC59BEB7B78DF81714F0440FAD84C56680DA7D5AC5CA63

Function 008ED8A6 Relevance: 21.2, APIs: 1, Strings: 13, Instructions: 239COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 008EE09D

Strings

e, xrefs: 008EE0E3
5P5M, xrefs: 008EE0B8
F, xrefs: 008EE0FF
C, xrefs: 008EE0D5
_W, xrefs: 008EE0AE
W, xrefs: 008EE11B
l, xrefs: 008EE10D
a, xrefs: 008EE0EA
e, xrefs: 008EE0F8
t, xrefs: 008EE0F1
r, xrefs: 008EE0DC
e, xrefs: 008EE114
i, xrefs: 008EE106

Memory Dump Source

Source File: 00000000.00000002.2199701952.00000000008E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: efd4a9f007888a262357efecc2e88af222ff4f8596168ecaed9e80c832c01fa9
Instruction ID: 89e12e30fcd9972cf7b69f936df46f4cfca1df112045071d0f570ec31bd709bd
Opcode Fuzzy Hash: efd4a9f007888a262357efecc2e88af222ff4f8596168ecaed9e80c832c01fa9
Instruction Fuzzy Hash: FC816CB2D041A89EF7208629DC49BFB7B78EB82314F1440FAD80D56681D67D5FC9CA63

Function 3BEBD685 Relevance: 21.2, APIs: 1, Strings: 13, Instructions: 208COMMON

Download Yara Rule

Strings

a, xrefs: 3BEBE0EA
W, xrefs: 3BEBE11B
C, xrefs: 3BEBE0D5
r, xrefs: 3BEBE0DC
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0F8
F, xrefs: 3BEBE0FF
_W, xrefs: 3BEBE0AE
e, xrefs: 3BEBE114
i, xrefs: 3BEBE106
e, xrefs: 3BEBE0E3
t, xrefs: 3BEBE0F1
5P5M, xrefs: 3BEBE0B8

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: 04b2870e4ee60f6e709d4db37dc8311052e61eba39c442a95dd2a82964225acc
Instruction ID: f8db2979b4dbbab73fa6a5618e4986b0847f909ee9cb9a2f9cef98711f696169
Opcode Fuzzy Hash: 04b2870e4ee60f6e709d4db37dc8311052e61eba39c442a95dd2a82964225acc
Instruction Fuzzy Hash: 3A713AB2D082689EFB24C728DC59BD77B64DF51314F0440FAD94C16281DA7D5AC68AA3

Function 3BEBDA3B Relevance: 21.2, APIs: 1, Strings: 13, Instructions: 204COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 3BEBE09D

Strings

a, xrefs: 3BEBE0EA
W, xrefs: 3BEBE11B
C, xrefs: 3BEBE0D5
r, xrefs: 3BEBE0DC
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0F8
F, xrefs: 3BEBE0FF
_W, xrefs: 3BEBE0AE
e, xrefs: 3BEBE114
i, xrefs: 3BEBE106
e, xrefs: 3BEBE0E3
t, xrefs: 3BEBE0F1
5P5M, xrefs: 3BEBE0B8

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: 783f3da648ad80af0167e4ebb0f72c09dcec68fb8928d0fc27bc9bc02b289132
Instruction ID: 3a4370c5283c1a7aa41a642f6aa83fe79ba204788481a91c55926d05cc8c1667
Opcode Fuzzy Hash: 783f3da648ad80af0167e4ebb0f72c09dcec68fb8928d0fc27bc9bc02b289132
Instruction Fuzzy Hash: 9B614AB2D082689EFB24C728DC49BEB7B78DB81314F0440FAD84D56281D67D5EC68A63

Function 3BEBD9A7 Relevance: 21.2, APIs: 1, Strings: 13, Instructions: 202COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 3BEBE09D

Strings

a, xrefs: 3BEBE0EA
W, xrefs: 3BEBE11B
C, xrefs: 3BEBE0D5
r, xrefs: 3BEBE0DC
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0F8
F, xrefs: 3BEBE0FF
_W, xrefs: 3BEBE0AE
e, xrefs: 3BEBE114
i, xrefs: 3BEBE106
e, xrefs: 3BEBE0E3
t, xrefs: 3BEBE0F1
5P5M, xrefs: 3BEBE0B8

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: 0a88f08a84d02579a82e252aca950a88f92323fa763318397690219be4a14cc0
Instruction ID: 8a669ad4617b0f76685192df6b99a1f899f6b1fbd3a62f9b510590eaec999d00
Opcode Fuzzy Hash: 0a88f08a84d02579a82e252aca950a88f92323fa763318397690219be4a14cc0
Instruction Fuzzy Hash: 866139B2D082689EFB24C728DC59BDBBB78DB41314F0440FAD84D16281DA7D5EC68A63

Function 3BEBD725 Relevance: 21.2, APIs: 1, Strings: 13, Instructions: 201COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 3BEBE09D

Strings

a, xrefs: 3BEBE0EA
W, xrefs: 3BEBE11B
C, xrefs: 3BEBE0D5
r, xrefs: 3BEBE0DC
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0F8
F, xrefs: 3BEBE0FF
_W, xrefs: 3BEBE0AE
e, xrefs: 3BEBE114
i, xrefs: 3BEBE106
e, xrefs: 3BEBE0E3
t, xrefs: 3BEBE0F1
5P5M, xrefs: 3BEBE0B8

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: 418ea4fcaf690e461b8a124f6b4756ded07c8140c36dae6f3b69dbd989b13edd
Instruction ID: da4661cb11c65aac05ac7e2418e1a1b66816ac166767fa650c53876d2bd49486
Opcode Fuzzy Hash: 418ea4fcaf690e461b8a124f6b4756ded07c8140c36dae6f3b69dbd989b13edd
Instruction Fuzzy Hash: 23615CB2D082589EFB24C728DC49BDBBB78DB91314F0440FAD84C16281D67D5EC68A63

Function 3BEBD6A3 Relevance: 21.2, APIs: 1, Strings: 13, Instructions: 199COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 3BEBE09D

Strings

a, xrefs: 3BEBE0EA
W, xrefs: 3BEBE11B
C, xrefs: 3BEBE0D5
r, xrefs: 3BEBE0DC
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0F8
F, xrefs: 3BEBE0FF
_W, xrefs: 3BEBE0AE
e, xrefs: 3BEBE114
i, xrefs: 3BEBE106
e, xrefs: 3BEBE0E3
t, xrefs: 3BEBE0F1
5P5M, xrefs: 3BEBE0B8

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: 570dbe96a03a2309e570ae95afc1d75423d5ca5492648b1f52c7618e6bc1d7bd
Instruction ID: af9f8d144e9dace97b90fcdf1e71036cf6d3770352c3393cdd3dfe48a9fc1ac1
Opcode Fuzzy Hash: 570dbe96a03a2309e570ae95afc1d75423d5ca5492648b1f52c7618e6bc1d7bd
Instruction Fuzzy Hash: 606149B2D082689EFB24C728DC49BDBBB78DB41314F0440FAD84D56281D67D5EC68AA3

Function 3BEBDA68 Relevance: 21.2, APIs: 1, Strings: 13, Instructions: 194COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 3BEBE09D

Strings

a, xrefs: 3BEBE0EA
W, xrefs: 3BEBE11B
C, xrefs: 3BEBE0D5
r, xrefs: 3BEBE0DC
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0F8
F, xrefs: 3BEBE0FF
_W, xrefs: 3BEBE0AE
e, xrefs: 3BEBE114
i, xrefs: 3BEBE106
e, xrefs: 3BEBE0E3
t, xrefs: 3BEBE0F1
5P5M, xrefs: 3BEBE0B8

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: f276221dcb1f148b786d1f4b89d12d0d7a8214e7e794047e0f51c4e6acf860e9
Instruction ID: 4620bea5babb222a0b7c14b39e023da81a0a671ecab55006e5539914c7243ada
Opcode Fuzzy Hash: f276221dcb1f148b786d1f4b89d12d0d7a8214e7e794047e0f51c4e6acf860e9
Instruction Fuzzy Hash: C46129B2D082689EFB24C728DC49BDBBB74DB91314F0440FAD84D16281D67D5EC68BA3

Function 00540B40 Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 472COMMON

Download Yara Rule

Strings

e|, xrefs: 00540D17
3, xrefs: 00540D68
A998, xrefs: 00540C74

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID:
String ID: A998$e|$3
API String ID: 0-38523410
Opcode ID: 408a7830ef450858897fe0f000d71361db43786ad0d13a5b169aebc68a952048
Instruction ID: 1b34c731cd5d747cd9c2b0bb724f2a453b0cb7861124cdb7c6694c3612841721
Opcode Fuzzy Hash: 408a7830ef450858897fe0f000d71361db43786ad0d13a5b169aebc68a952048
Instruction Fuzzy Hash: C1128FB1E042289FEB248B18DC95BEABB75FF85314F1481EAD94D66280E6345FC1CF52

Function 3BEC499C Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 448fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 3BEC5DA9

Strings

3, xrefs: 3BEC4ADB
e|, xrefs: 3BEC4A8A

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID: e|$3
API String ID: 2738559852-1726640827
Opcode ID: 2eeb45d96253b2151884a32a0819689958bf91d8e66806803fcb42383f478f7e
Instruction ID: 3e90767d62a35e8a258bdd8fd379473736f81bee3f65a08a2d13f54ee794c28a
Opcode Fuzzy Hash: 2eeb45d96253b2151884a32a0819689958bf91d8e66806803fcb42383f478f7e
Instruction Fuzzy Hash: 3A02BFB2D046289FF724CA18DD55AEBB7B5EFC4314F1481FAD80EA6640DA385FC18E52

Function 3BEBEB80 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 362COMMON

Download Yara Rule

Strings

3, xrefs: 3BEBED01
e|, xrefs: 3BEBECB0

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID: e|$3
API String ID: 0-1726640827
Opcode ID: a12b1f3561323e3a9e50ca8666f686866bebdad2c6da165e4b84fc490f9cf642
Instruction ID: efc3905305ad65e81ffd4e0942f93629c03f460228ea0d8b3f58e48c5adf69fa
Opcode Fuzzy Hash: a12b1f3561323e3a9e50ca8666f686866bebdad2c6da165e4b84fc490f9cf642
Instruction Fuzzy Hash: 6DE193B1D097289BEB28CB18DC95BEAB7B5EF44314F0441FAE90D62240E6755EC1CF52

Function 3BEB68BA Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 307COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Strings

e|, xrefs: 3BEB69E4
3, xrefs: 3BEB6A35

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID: e|$3
API String ID: 4241100979-1726640827
Opcode ID: be98b870f768b0764863c02b9be51a5480b9b19a110dc00e1caf068c91e24aa8
Instruction ID: fc27590b7184e338625be3469bda82fb3bb21c2aa993ce36c4f1fdb9c68e1c44
Opcode Fuzzy Hash: be98b870f768b0764863c02b9be51a5480b9b19a110dc00e1caf068c91e24aa8
Instruction Fuzzy Hash: 21C190B5D086688FEF25CB28DC916E9B7B5EF94310F0481EAE40DA6240EB395EC5CF11

Function 008E68BA Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 307COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 008E7CFA

Strings

3, xrefs: 008E6A35
e|, xrefs: 008E69E4

Memory Dump Source

Source File: 00000000.00000002.2199701952.00000000008E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID: e|$3
API String ID: 4241100979-1726640827
Opcode ID: be98b870f768b0764863c02b9be51a5480b9b19a110dc00e1caf068c91e24aa8
Instruction ID: 03c5323308a0423f700e62295b20ffa71b49c141070559b297e100dda8679f32
Opcode Fuzzy Hash: be98b870f768b0764863c02b9be51a5480b9b19a110dc00e1caf068c91e24aa8
Instruction Fuzzy Hash: 49C1D3B1C086A88BEB248F25DC906E9BBB5FF95350F1481EAE40DA6240E7395FC1CF11

Function 3BEB7276 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 277COMMON

Download Yara Rule

Strings

"r;, xrefs: 3BEB73C7
:FOK, xrefs: 3BEB7517

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID: "r;$:FOK
API String ID: 0-3416402625
Opcode ID: 0846f8f9e150cba83b22e891948e0deff9d1d4075edb240d1670727adb4aeb6b
Instruction ID: 244597cbc4fc1e728f49279ed45c859352b942b33bef57bc3110fcb74e3d3bfd
Opcode Fuzzy Hash: 0846f8f9e150cba83b22e891948e0deff9d1d4075edb240d1670727adb4aeb6b
Instruction Fuzzy Hash: C9A1F8F2D182545FF724CB28DC55AEB7B78EB85310F0441BAD84D96B80E63C5EC68E52

Function 005479AE Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 262memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00548D68

Strings

e|, xrefs: 00547AA7
3, xrefs: 00547AF8

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID: e|$3
API String ID: 544645111-1726640827
Opcode ID: cae61e771cb22d1ec9d6fb730fdf224020caad320cfa2fbf794f33348327e58f
Instruction ID: 24e771bb10c9e2469c13deddb57dda4bc22028dbf25eb96fdff3aa0456e7b3a9
Opcode Fuzzy Hash: cae61e771cb22d1ec9d6fb730fdf224020caad320cfa2fbf794f33348327e58f
Instruction Fuzzy Hash: 8FB19DB1E046698BEB24CB19CC85BEABBB4FF89314F1441EAD94D62240EB745EC1CE51

Function 3BEB765A Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Strings

"r;, xrefs: 3BEB73C7
:FOK, xrefs: 3BEB7517

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID: "r;$:FOK
API String ID: 4241100979-3416402625
Opcode ID: 5d7c9b944ede05850c535b242fa95d66b2bf6c21ba4a591a6506e7dd900abac3
Instruction ID: f15bee6afc844a4c07ddd7ae29b88d1424face8153b13e5102b5f124da52862c
Opcode Fuzzy Hash: 5d7c9b944ede05850c535b242fa95d66b2bf6c21ba4a591a6506e7dd900abac3
Instruction Fuzzy Hash: 309105F2C082685BFB20CB58DC45AEB7B74EF45314F0441BAD84DA6741EA785EC58E92

Function 00548201 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 171memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00548D68

Strings

EBM>, xrefs: 0054832E
V, xrefs: 00548338

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID: EBM>$V
API String ID: 544645111-4161760328
Opcode ID: 511fef2b0f98a73f72e07aea0ef24c1aaa7b19639a44f31e7bddc568de755ee3
Instruction ID: 59bde955e8c769a57cfa2723741041c1c349ffceb5d014491f68f0e53aa6f794
Opcode Fuzzy Hash: 511fef2b0f98a73f72e07aea0ef24c1aaa7b19639a44f31e7bddc568de755ee3
Instruction Fuzzy Hash: 3F5178B2D082915FF7108635DC48AFB7FB8FB80314F1484BAD84D96581D97C5EC68BA2

Function 00895B99 Relevance: 4.9, APIs: 1, Strings: 2, Instructions: 436memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00896AF4

Strings

_W, xrefs: 0089653F
S, xrefs: 00896088

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: S$_W
API String ID: 4275171209-1850906522
Opcode ID: d11be731324278b61aff3a34904e2df47427ef83b060e93425d8718277b35246
Instruction ID: 32c97016c16e6948c21dfa01005e4312fdbbbfa6e8f926550b583d6e1b0ece25
Opcode Fuzzy Hash: d11be731324278b61aff3a34904e2df47427ef83b060e93425d8718277b35246
Instruction Fuzzy Hash: C8F1F2B2D045689FEB208A24DC94BEB7BB9EB81315F1841FAD80D96281D63C6FC1CF51

Function 00895702 Relevance: 4.8, APIs: 1, Strings: 2, Instructions: 283COMMON

Download Yara Rule

Strings

e|, xrefs: 008957E4
3, xrefs: 00895835

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: e|$3
API String ID: 4275171209-1726640827
Opcode ID: 71a8212799ce9897f3b55d2e416be865066c5f18f8e16b7ebea9f0bd523dd697
Instruction ID: 29510eeb16d4d7c1fc656c6c5f958275aaf8e8992ca19970088f7d188a4c7ad5
Opcode Fuzzy Hash: 71a8212799ce9897f3b55d2e416be865066c5f18f8e16b7ebea9f0bd523dd697
Instruction Fuzzy Hash: 8EC1A9B1D006689BEB25DA14DC84BEABBB5FF84314F1481EAD80DA6680E7785FC5CF01

Function 3BEB405B Relevance: 4.7, Strings: 3, Instructions: 918COMMON

Download Yara Rule

Strings

V, xrefs: 3BEB4704
O6@F, xrefs: 3BEB470E
?5IC, xrefs: 3BEB475D

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID: ?5IC$O6@F$V
API String ID: 0-1412617190
Opcode ID: f4c45bc074cc361c1bcd2bcbda37ad9fd1ce404022a626e4f18baf421a4016d0
Instruction ID: 342e4ba0085c71e71d9a22361140027763c6d84d1d5f9a426a77072db219bdc6
Opcode Fuzzy Hash: f4c45bc074cc361c1bcd2bcbda37ad9fd1ce404022a626e4f18baf421a4016d0
Instruction Fuzzy Hash: 8D821752E2826987DB78CB39DC116DBA2B3EF88300F05D4FD940DE7664F6744AC59B0A

Function 3BEB46DA Relevance: 4.5, Strings: 3, Instructions: 709COMMON

Download Yara Rule

Strings

V, xrefs: 3BEB4704
O6@F, xrefs: 3BEB470E
?5IC, xrefs: 3BEB475D

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID: ?5IC$O6@F$V
API String ID: 0-1412617190
Opcode ID: 4c2d31cb38cf5ac17f9d15dd05477bead84e40cd4cbb9ed60f6d7aec1e3fde91
Instruction ID: 4b9dc736bbf7baa6a77c99264d6596b8f4690eb43ab21c1a1570e33345edf9ce
Opcode Fuzzy Hash: 4c2d31cb38cf5ac17f9d15dd05477bead84e40cd4cbb9ed60f6d7aec1e3fde91
Instruction Fuzzy Hash: 9952C712E2866987DB78CB79DC1169FA2B3EF58300F04D4FD940DE7664F6704AC99B0A

Function 3BEB46E5 Relevance: 4.5, Strings: 3, Instructions: 706COMMON

Download Yara Rule

Strings

V, xrefs: 3BEB4704
O6@F, xrefs: 3BEB470E
?5IC, xrefs: 3BEB475D

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID: ?5IC$O6@F$V
API String ID: 0-1412617190
Opcode ID: d6d9f1b69b76863fd6f0513d3a3fc47d762c16b4b39a6db4d8da90e505b210f6
Instruction ID: 3644867f9308080a45b73ca60dec8c9a1ae0518774fcde12112da3596e54052f
Opcode Fuzzy Hash: d6d9f1b69b76863fd6f0513d3a3fc47d762c16b4b39a6db4d8da90e505b210f6
Instruction Fuzzy Hash: C452C712E2866987DB78CB79DC1169FA2B3EF58300F04D4FD940DE7664F6704AC99B0A

Function 3BEB46F1 Relevance: 4.5, Strings: 3, Instructions: 704COMMON

Download Yara Rule

Strings

V, xrefs: 3BEB4704
O6@F, xrefs: 3BEB470E
?5IC, xrefs: 3BEB475D

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID: ?5IC$O6@F$V
API String ID: 0-1412617190
Opcode ID: eb8dbc94bbbfb2e459a11031ced266b819da70190ea21eb6315c359c40bf1491
Instruction ID: 1f6991843798f2a6ccf62949f5ad2196342b656677c2f46ee1615f45682eaa0d
Opcode Fuzzy Hash: eb8dbc94bbbfb2e459a11031ced266b819da70190ea21eb6315c359c40bf1491
Instruction Fuzzy Hash: 7552D712E2466987DB78CB79DC1169FA2B3EF58300F04D4FD940DE7664F6704AC99B0A

Function 008A8FA8 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 361COMMON

Download Yara Rule

Strings

Qj@h, xrefs: 008A9A90

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID: Qj@h
API String ID: 544645111-2762301250
Opcode ID: 97d9fb81ebf5ca76cdea45e15b21a9eb6c8b7829e008b44a734a7d7b643e44d8
Instruction ID: 767c86b576f88e669b94128f44ff9ac4780755e5f693a5956836696c6afa90ec
Opcode Fuzzy Hash: 97d9fb81ebf5ca76cdea45e15b21a9eb6c8b7829e008b44a734a7d7b643e44d8
Instruction Fuzzy Hash: C3C13BF2D095589FF7208A25DC44AEB7778FF86314F1480BAD84D92A41E6396EC1CF62

Function 008A9199 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 283COMMON

Download Yara Rule

Strings

Qj@h, xrefs: 008A9A90

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID:
String ID: Qj@h
API String ID: 0-2762301250
Opcode ID: 9fda01d876a1a9ee716c669931b9a5e98d095f428250b1af7dd47af4e07021c9
Instruction ID: 7c9016e187ad28f7dffa7dc56066a21f03d37de109559b721cc52843ba24571a
Opcode Fuzzy Hash: 9fda01d876a1a9ee716c669931b9a5e98d095f428250b1af7dd47af4e07021c9
Instruction Fuzzy Hash: 03A12FB1D092299AFB208B25DC846FBB775FF85314F1480B6D98D92A80D6395EC1CF62

Function 008A93E5 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 273COMMON

Download Yara Rule

Strings

Qj@h, xrefs: 008A9A90

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID:
String ID: Qj@h
API String ID: 0-2762301250
Opcode ID: aa508bef982a3f4822be32ccd17a338dbdc602d9fb728fdd518a48556a9e2d3e
Instruction ID: 911445e60bd96e19ef075fbe1e577597be17063cce76a534c49ac7f6269ba818
Opcode Fuzzy Hash: aa508bef982a3f4822be32ccd17a338dbdc602d9fb728fdd518a48556a9e2d3e
Instruction Fuzzy Hash: F7911FB2C092589FF7208A65DC846EB7774FF95314F1480BAD88D92A41E6396EC1CF62

Function 3BEB751C Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 258COMMON

Download Yara Rule

Strings

:FOK, xrefs: 3BEB7517

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID: :FOK
API String ID: 0-1546321273
Opcode ID: d598eb1bb29654b0315cb20ea9c137a6e233b77599fd1e229d9ae10b3548b176
Instruction ID: 01a0564da56e34b721cf8f5834f7117ce8972a188868fc6c7376a3fc47a23963
Opcode Fuzzy Hash: d598eb1bb29654b0315cb20ea9c137a6e233b77599fd1e229d9ae10b3548b176
Instruction Fuzzy Hash: FB9128F2C092689BFB24CB58DC41AEB7B74EF45314F0441BAD84DA6780E67C5EC5CA92

Function 0089B271 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 216processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 0089BE3D

Strings

jjjj, xrefs: 0089BE2E

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: b85b2e1870348b1f434e1193003279f54dbab56a7bff8865984786254beac272
Instruction ID: 4e0b745d72112fecf00dc0b04bc0a4512444d6b9e85e5f0b3bc8ff1a37b74a0b
Opcode Fuzzy Hash: b85b2e1870348b1f434e1193003279f54dbab56a7bff8865984786254beac272
Instruction Fuzzy Hash: 86614BF1D04118AFFB248654ED56BFB7778FBC0310F1881BEE50A96680E77C2AC58A52

Function 0054A7A0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 205COMMON

Download Yara Rule

Strings

uCW, xrefs: 0054A9D1

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID:
String ID: uCW
API String ID: 0-3512965699
Opcode ID: 7e7f09b9ed1c3013eb8cb4f153e1eedc83683dd3943617ebe682761ee86a4c43
Instruction ID: 8a131b18f9af3267c82e17c4db3e7d5191e80546e57faf38735a12a96d56bea4
Opcode Fuzzy Hash: 7e7f09b9ed1c3013eb8cb4f153e1eedc83683dd3943617ebe682761ee86a4c43
Instruction Fuzzy Hash: F16105F1D401559AF7608B14DC84BFB7B75EBC0324F1481FAE90996380E63D4EC6CA52

Function 0054604D Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

YV, xrefs: 00546600

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: YV
API String ID: 4275171209-3702526815
Opcode ID: e129b39bb272e6c1086d2ab1c4d6b949f4505121c2c60168a226186916f66f79
Instruction ID: d313880c7898aa00ca48927a6ef2bc75878a90f65e3cb573be430fe4c8d585b5
Opcode Fuzzy Hash: e129b39bb272e6c1086d2ab1c4d6b949f4505121c2c60168a226186916f66f79
Instruction Fuzzy Hash: 6C617BF2C04250AFF3148A21DC4DBE77F69FBC2310F1581BEE84D56581D57D9A86CAA2

Function 3BEB3DA8 Relevance: 3.2, Strings: 2, Instructions: 683COMMON

Download Yara Rule

Strings

3, xrefs: 3BEB3EF1
e|, xrefs: 3BEB3EA0

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID: e|$3
API String ID: 0-1726640827
Opcode ID: aead20fb75e1edb8ff06e66f1231084d83737bc607f525dbc02a4fb36f4e3b52
Instruction ID: 3cd257fd64311c24158c784a518ef23be780b7a723df0c549db22353a9a41b43
Opcode Fuzzy Hash: aead20fb75e1edb8ff06e66f1231084d83737bc607f525dbc02a4fb36f4e3b52
Instruction Fuzzy Hash: E3629325E2466987DB78CB39DC516DBA2B3AF58300F04D4FD940DE3664FB704AC99B0A

Function 008E40B6 Relevance: 2.1, APIs: 1, Instructions: 613libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?,?,?,?,?,?,?,?,008E4051,?,?,?,00000001,008E3D65), ref: 008E4648

Memory Dump Source

Source File: 00000000.00000002.2199701952.00000000008E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_AdobePDF.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a3ae2e5f62207797aa623202d320ba10f3064d7bf67d43d48157e8d72eb7eb0f
Instruction ID: 2594f5c69587ba57c66b0b5546a2936634a106bc696a936905e5633967eabfc9
Opcode Fuzzy Hash: a3ae2e5f62207797aa623202d320ba10f3064d7bf67d43d48157e8d72eb7eb0f
Instruction Fuzzy Hash: 5D42B512A2466986DB78CB79DC1169FA2B3EF58300F04D8FD940DF7664F6704AC99B0E

Function 3BEB4B28 Relevance: 2.0, Strings: 1, Instructions: 786COMMON

Download Yara Rule

Strings

S, xrefs: 3BEB4B38

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID: S
API String ID: 0-1211208622
Opcode ID: 94efed3c7cd2ec85c97c610d9c2169c00336253853dbda92b1538781eb6b28b1
Instruction ID: b4075a90051c0c80179c464f82f4be14c0b94471a3c1f3468c43c55c3b2aa98f
Opcode Fuzzy Hash: 94efed3c7cd2ec85c97c610d9c2169c00336253853dbda92b1538781eb6b28b1
Instruction Fuzzy Hash: 05620752E2826987DB78CB79DC1179BA2B3EF58300F04D4FD940DE7664F6704AC99B0A

Function 3BEB4B4D Relevance: 1.9, Strings: 1, Instructions: 654COMMON

Download Yara Rule

Strings

HN;, xrefs: 3BEB4B50

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID: HN;
API String ID: 0-3860028145
Opcode ID: 00735a5ea730dcac5f8a8070ed5a97f3b743278dc926be25423d58b7a400fa87
Instruction ID: e664c286cba8f556303758100fa4576e239fc08f0dce591623f6e170c8aa950d
Opcode Fuzzy Hash: 00735a5ea730dcac5f8a8070ed5a97f3b743278dc926be25423d58b7a400fa87
Instruction Fuzzy Hash: E852B612E2466987DB78CB39DC1169FA2B3EF58300F05D8FD940DE7664F6704AC99B0A

Function 3BEB4845 Relevance: 1.9, Strings: 1, Instructions: 643COMMON

Download Yara Rule

Strings

5:=H, xrefs: 3BEB4845

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID: 5:=H
API String ID: 0-3718395605
Opcode ID: 16e6b03d8b47dc6da647b7365d1d4b59126a9cb7b2f2843216a8182b8df511f6
Instruction ID: f92985ce92618b3b3ad8a5b34a686b3c7362f0a994be18bd0c0e48f688b49bb3
Opcode Fuzzy Hash: 16e6b03d8b47dc6da647b7365d1d4b59126a9cb7b2f2843216a8182b8df511f6
Instruction Fuzzy Hash: B152C412E2466986DB78CB39DC1169FA2B3EF58300F05D8FD940DE7664F6704AC99B0A

Function 3BEBF054 Relevance: 1.9, APIs: 1, Instructions: 373fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 3BEBFFDF

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 6bd3ab02f75e6fdfae12dadf092c2ae3f9920db81dcd355e91ff4ebbb66a7206
Instruction ID: 3b7c6b0b0c29d12a7855bc83a7b03874b3c044e585013fbc4c29f23eb3972003
Opcode Fuzzy Hash: 6bd3ab02f75e6fdfae12dadf092c2ae3f9920db81dcd355e91ff4ebbb66a7206
Instruction Fuzzy Hash: B6C139F6D082249FFB24CB58DC94BEB7778EB81314F1481FAE90D56681D63C5EC18A92

Function 008B3783 Relevance: 1.9, APIs: 1, Instructions: 364threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 008B3D9D

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: e61044ce204f44a89e145b15e814b8e803e00d72af23b6f4de4e775baf2670bb
Instruction ID: 835ae45a0e8768843c642a2059c9c096a5a100f1d722b4edd4fef207a034d388
Opcode Fuzzy Hash: e61044ce204f44a89e145b15e814b8e803e00d72af23b6f4de4e775baf2670bb
Instruction Fuzzy Hash: 4AD1C2F2D081689BF7248A14DC95AEBBB79FB85314F1841FAD90DA2740D6386FC1CE91

Function 3BEC472C Relevance: 1.7, APIs: 1, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7dd2651572ae6da5b194640ccf87e6ce66ea495376b8ee1cbf91ed6f940d8c2
Instruction ID: 2517022fabe8259f7f911608015f9e25bbaedd316f92898af1011b5ec54e54a6
Opcode Fuzzy Hash: c7dd2651572ae6da5b194640ccf87e6ce66ea495376b8ee1cbf91ed6f940d8c2
Instruction Fuzzy Hash: E2816AF2C102655EF7148B58DC45BFB7778EB84710F0042FAE94E96280EB785EC58BA2

Function 00547833 Relevance: 1.7, APIs: 1, Instructions: 236memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00548D68

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d102ac4ff3878d5864cfe36421bde35fceb51514663232590fe4006672993b8e
Instruction ID: f5c197db9dd7e573f00c174396671f485bf4271ad916959efb5916df041fe0fe
Opcode Fuzzy Hash: d102ac4ff3878d5864cfe36421bde35fceb51514663232590fe4006672993b8e
Instruction Fuzzy Hash: E98125B2D085299EF7208A25DC88BFF7B79FF94318F1440BAD50D56681E7781EC1CA51

Function 3BEB677A Relevance: 1.7, APIs: 1, Instructions: 176COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 045df64edd3187d55d3600802d343d91f80cc52611ccd44e66415812e35ff24b
Instruction ID: dd45d6208be35e8fa12c60e4474bb3dfc9f5bfd058c9ebd655d4852f6e05ef4c
Opcode Fuzzy Hash: 045df64edd3187d55d3600802d343d91f80cc52611ccd44e66415812e35ff24b
Instruction Fuzzy Hash: D851E5B1D192689FFF14CB28DC406BABB75EB84710F1481FAD44D96294EA385EC1CF12

Function 3BEB661F Relevance: 1.7, APIs: 1, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: ddafbac98dafecdc0c6f186c96e46466472c9e2a036e6063019e5ebfd68827f4
Instruction ID: 71179fe1110e69c84a2ab2a5284771af10fe50c2b6077d6dd9fc358fa0552758
Opcode Fuzzy Hash: ddafbac98dafecdc0c6f186c96e46466472c9e2a036e6063019e5ebfd68827f4
Instruction Fuzzy Hash: DF51E6A2C1C3589EFF18CB28DC55AEABB74EB84710F1481FED50D96254EA385EC18F12

Function 3BEB7261 Relevance: 1.6, APIs: 1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f09817fd55b519218c5437ceef01c5dd953251b8902771339dd0cce1f4edee88
Instruction ID: 01e63426c153461609c3fca07dcad3dfcaf301f2cea4468872f1d496389060b9
Opcode Fuzzy Hash: f09817fd55b519218c5437ceef01c5dd953251b8902771339dd0cce1f4edee88
Instruction Fuzzy Hash: 4351F9F2C093645FFB20CB58DC95ADB7B68DB41300F0541BAD98D66B41E9345EC6CA63

Function 00895AE1 Relevance: 1.5, APIs: 1, Instructions: 279memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00896AF4

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1bcc00b4391b2f1a41975a47895ef9b353ab9a340ecb08a1b0407e0002b60be1
Instruction ID: 05f111412a422d4c4f3f6d4041b84a0ef12b89d7725ddcd8b6a20eeefbcbb364
Opcode Fuzzy Hash: 1bcc00b4391b2f1a41975a47895ef9b353ab9a340ecb08a1b0407e0002b60be1
Instruction Fuzzy Hash: 23B1AEB2D045289BEB249A14DC94BEBB7B9FB81315F1841F9D90DA6280E7386FC1CF51

Function 008952CE Relevance: 1.5, APIs: 1, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 55bc7e8588b0df7429bab6d50cab68840f1cb6a7baf53babb6114849edb26884
Instruction ID: d24d8a9ea88fa263f2eee37f05d617f699f3c91a93c946885a4c5ecd0210aa46
Opcode Fuzzy Hash: 55bc7e8588b0df7429bab6d50cab68840f1cb6a7baf53babb6114849edb26884
Instruction Fuzzy Hash: E5A127B2D045289EFB20DA24DC547EAB7B5FB85319F1880FAD80DA6281E7791EC1CF51

Function 008955F7 Relevance: 1.5, APIs: 1, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00896AF4

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 865041f3515d9e3c0b2beeaade53c32c5c384d29c6d6d89fea3f4dab32c355b1
Instruction ID: 1ad3be2ff4b647149ca0b251a2e9fea53b2addfe2a82ae9328768ad4bebd69ec
Opcode Fuzzy Hash: 865041f3515d9e3c0b2beeaade53c32c5c384d29c6d6d89fea3f4dab32c355b1
Instruction Fuzzy Hash: 2D9124B2D045289EEB219A24DC54BFE7775FB80318F1841FAD80DA6280E3781EC5CF52

Function 3BEB4886 Relevance: .8, Instructions: 759COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08f65020e94d74d7a5464b08046a8c1848eb556020a1b36c0e74f6d5e8771071
Instruction ID: 8b67df1087546e698f19b7384d6c88b36264ccb0d390c06c343030ed4233fb6d
Opcode Fuzzy Hash: 08f65020e94d74d7a5464b08046a8c1848eb556020a1b36c0e74f6d5e8771071
Instruction Fuzzy Hash: A862F752E2826987DB78CB79DC0169FA2B3EF58300F04D4FD940DE7664F6704AC99B0A

Function 008E4886 Relevance: .8, Instructions: 759COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2199701952.00000000008E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08f65020e94d74d7a5464b08046a8c1848eb556020a1b36c0e74f6d5e8771071
Instruction ID: b8d6aa45d1293deb0e7d3f504be7dfcdcc1261a02677e43053b0fb9736933432
Opcode Fuzzy Hash: 08f65020e94d74d7a5464b08046a8c1848eb556020a1b36c0e74f6d5e8771071
Instruction Fuzzy Hash: 4362F352E2466987DB78CB79DC016AFA2B3EF58300F04D4FD940DE7664F6704AC99B0A

Function 3BEB48BD Relevance: .7, Instructions: 748COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c813152787d57767024cc3800705929a0d40be9e4ac78f321359257a69930c90
Instruction ID: 267d33db2f3266e6274c47a920730ad33d08f16436e8f4397433e3ce17a9a6cf
Opcode Fuzzy Hash: c813152787d57767024cc3800705929a0d40be9e4ac78f321359257a69930c90
Instruction Fuzzy Hash: 7062F752E2466986DB78CB79DC016AFA2B3EF58300F04D4FD940DE7664F6704AC99B0A

Function 008E48BD Relevance: .7, Instructions: 748COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2199701952.00000000008E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c813152787d57767024cc3800705929a0d40be9e4ac78f321359257a69930c90
Instruction ID: c460b0ddfd8217b70e2d1390228c99849a62044aaa3df12d454d5e65e4b73fe1
Opcode Fuzzy Hash: c813152787d57767024cc3800705929a0d40be9e4ac78f321359257a69930c90
Instruction Fuzzy Hash: 2C62F452E2466986DB78CB79DC017AFA2B3EF58300F04D4FD940DE7664F6704AC99B0A

Function 3BEB48C5 Relevance: .7, Instructions: 745COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02da795bf4cbb92d8935b4de1afd1bdd49eda63cac24eaac875122976ca3098b
Instruction ID: 22696adc39d47b530dc1943bad546ee5ade9cea2ae9399c803238e2a29087ca2
Opcode Fuzzy Hash: 02da795bf4cbb92d8935b4de1afd1bdd49eda63cac24eaac875122976ca3098b
Instruction Fuzzy Hash: 5B62F752E2426986DB78CB79DC016AFA2B3EF58300F04D4FD940DF7664F6704AC99B0A

Function 008E48C5 Relevance: .7, Instructions: 745COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2199701952.00000000008E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02da795bf4cbb92d8935b4de1afd1bdd49eda63cac24eaac875122976ca3098b
Instruction ID: 534391ec468c7c9406e95a10a06ba23310f0691372218b874b53cd979f209a21
Opcode Fuzzy Hash: 02da795bf4cbb92d8935b4de1afd1bdd49eda63cac24eaac875122976ca3098b
Instruction Fuzzy Hash: 2462E452E2466986DB78CB79DC017AFA2B3EF58300F04D4FD940DE7664F6704AC99B0A

Function 3BEB3D70 Relevance: .7, Instructions: 741COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7ac4c557f5946ff02f6cf2dbf44d3f79844bddcdf92a479249219f284adf3d3
Instruction ID: 52611e7537de1194fadc76cd0c608c4c20043fe2b2534ebd30502604e277239d
Opcode Fuzzy Hash: f7ac4c557f5946ff02f6cf2dbf44d3f79844bddcdf92a479249219f284adf3d3
Instruction Fuzzy Hash: 1D62D512E2866987DB78CB39DC5169FA2B3EF58300F04D4FD940DE7664F6704AC99B0A

Function 3BEB3BC2 Relevance: .7, Instructions: 733COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8bbf48fcd32c86e603070d395c52ace2225f5b4064833b829fff2132518b372
Instruction ID: bcf6acf7e313eaf2f1d9aaef402fe0d982a698a04163360ca674eb78b9c2316b
Opcode Fuzzy Hash: c8bbf48fcd32c86e603070d395c52ace2225f5b4064833b829fff2132518b372
Instruction Fuzzy Hash: D062E812E2866987DB78CB39DC5169FA2B3EF58300F04D4FD940DE7664F6704AC99B0A

Function 3BEB4910 Relevance: .7, Instructions: 721COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90bfd4eb15e34d83f22be13f675db4a03ba3eb549f4d35418c813e3307ba7815
Instruction ID: 39cc1ddafbc40c4abc19b2a513848341d91bc8acba8e0812712a5fb5d5f0566f
Opcode Fuzzy Hash: 90bfd4eb15e34d83f22be13f675db4a03ba3eb549f4d35418c813e3307ba7815
Instruction Fuzzy Hash: 1662D612E2466986DB78CB79DC116AFA2B3EF58300F04D4FD940DE7664F6704AC99B0A

Function 3BEB491D Relevance: .7, Instructions: 717COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b39369b6d3e2a316b5cdfd461b327215efc797cc7153fd813a1101db4be85b49
Instruction ID: 3b26b5bc51a3f6476106d885e8e7e25dbd21b3ce5d0dbfcd61cd2b1d14f99008
Opcode Fuzzy Hash: b39369b6d3e2a316b5cdfd461b327215efc797cc7153fd813a1101db4be85b49
Instruction Fuzzy Hash: C562D512E2466986DB78CB79DC116AFA2B3EF58300F04D4FD940DE7664F6704AC99B0A

Function 3BEB4A32 Relevance: .7, Instructions: 686COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc401ac9bca6c51ffe5386bd677e5f7a66050eff258d8090602c72447a2e2464
Instruction ID: 75a938736eb43421336a5a8ca3dd996eb120f143aafe6030d9b60e34ffa5dc75
Opcode Fuzzy Hash: bc401ac9bca6c51ffe5386bd677e5f7a66050eff258d8090602c72447a2e2464
Instruction Fuzzy Hash: 2852C512E2466987DB78CB39DC116AFA2B3EF58300F05D4FD940DE7664F6704AC99B0A

Function 3BEB481A Relevance: .7, Instructions: 654COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e9b2c6d0129b7197f5e0d567fc2c9b0ad63c94a80893e2640c336d128f9abc8
Instruction ID: 32c70b0d2bd71e5d6efc53f467c8350cd3f437779bc1651c5ffa086f874a8f01
Opcode Fuzzy Hash: 0e9b2c6d0129b7197f5e0d567fc2c9b0ad63c94a80893e2640c336d128f9abc8
Instruction Fuzzy Hash: 8F52C612E2466987DB78CB39DC1169FA2B3EF58300F04D4FD940DE7664F6704AC99B0A

Function 008E481A Relevance: .7, Instructions: 654COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2199701952.00000000008E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e9b2c6d0129b7197f5e0d567fc2c9b0ad63c94a80893e2640c336d128f9abc8
Instruction ID: e73f198d4506faaad6be901f2fc9b00772239e8b951c0ee8491bb721dfaa9dbc
Opcode Fuzzy Hash: 0e9b2c6d0129b7197f5e0d567fc2c9b0ad63c94a80893e2640c336d128f9abc8
Instruction Fuzzy Hash: 6152C512E2466987DB78CB79DC1169FA2B3EF58300F04D8FD940DE7664F6704AC99B0A

Function 3BEB47A7 Relevance: .6, Instructions: 649COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3ce586c555638aa5c3cacd5409f31ee72e70314d592c7a7085301da82e52b5f
Instruction ID: 8dbb180ff7d379467c44fff40a254bdb316b0847803211bdc75485213976943b
Opcode Fuzzy Hash: e3ce586c555638aa5c3cacd5409f31ee72e70314d592c7a7085301da82e52b5f
Instruction Fuzzy Hash: 6952C512E2466986DB78CB39DC1169FA2B3EF58300F05D8FD940DF7664F6704AC99B0A

Function 3BEB47BA Relevance: .6, Instructions: 642COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3da72211c49fe12d8f9fae55512b75d470b920320e481364f7f116f4ddc7150d
Instruction ID: eb26ff11b52ed0d5703c543405097893cefea174ccdbaf231669f580d80fdbfe
Opcode Fuzzy Hash: 3da72211c49fe12d8f9fae55512b75d470b920320e481364f7f116f4ddc7150d
Instruction Fuzzy Hash: D952B412E2466986DB78CB39DC1169FA2B3EF58300F05D8FD940DE7664F6704AC99B0A

Function 3BEB419E Relevance: .6, Instructions: 638COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30c7cbe5f106f8e665b845b8f24c369cb1e96ac90dc81efbbdffb6c3eae4119a
Instruction ID: 9942f6df8d534607c12f6f6f9d24ad7548198e578ddbf5119d741232aca63d6e
Opcode Fuzzy Hash: 30c7cbe5f106f8e665b845b8f24c369cb1e96ac90dc81efbbdffb6c3eae4119a
Instruction Fuzzy Hash: 5752C616E2466986DB78CB39DC1169FA2B3EF58300F04D4FD940DE7664F6704AC99B0E

Function 3BEB41A9 Relevance: .6, Instructions: 636COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e02ad5263c43b13dac4e0d178338362ee8e674007681e7736d492d987b29252f
Instruction ID: 74b6a5d0932dcc534f62fa532fcf6076a5996193c1df58310224b794f251da94
Opcode Fuzzy Hash: e02ad5263c43b13dac4e0d178338362ee8e674007681e7736d492d987b29252f
Instruction Fuzzy Hash: 2E52C616E2466986DB78CB39DC1169FA2B3EF58300F04D8FD940DE7664F6704AC99B0E

Function 3BEB4BA0 Relevance: .6, Instructions: 628COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 195be972f1d730d91b1026e7e7e534d91ecea1062958c06adb46027cc3a40fa6
Instruction ID: 4fb4ae0acd37c307cc754f8b30f80899e287f1d67dbe89d36e5b91ac8e0cc66c
Opcode Fuzzy Hash: 195be972f1d730d91b1026e7e7e534d91ecea1062958c06adb46027cc3a40fa6
Instruction Fuzzy Hash: 8B42B312E2466986DB78CB39DC1169FA2B3EF58300F05D8FD940DF7664F6704A899B0E

Function 3BEB41E6 Relevance: .6, Instructions: 622COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b50e2cf1520ae2bb021e77a9aee82c7730d8c758ac6b8f61034498411b68bd55
Instruction ID: 48bf1735ff8579a4b94b894a6080895fb507776d3cb18c25fda20e88728f92cc
Opcode Fuzzy Hash: b50e2cf1520ae2bb021e77a9aee82c7730d8c758ac6b8f61034498411b68bd55
Instruction Fuzzy Hash: 1042C616A2466986DB78CB79DC1169FA2B3EF58300F04D8FD940DE3664F6704AC99B0E

Function 3BEB4155 Relevance: .6, Instructions: 621COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a58029a32e3ae80a5fcb53a12f6ba9a33169204e0740b3b193ae917c06cc3ff
Instruction ID: 4cfba287b7eefd83734ef1e6127c15c804de994aa1bee1bb6be3923eac00eda7
Opcode Fuzzy Hash: 2a58029a32e3ae80a5fcb53a12f6ba9a33169204e0740b3b193ae917c06cc3ff
Instruction Fuzzy Hash: FC42B512A2466986DB78CB79DC1169FA2B3EF58300F04D8FD940DF7664F6704AC99B0E

Function 3BEB45B1 Relevance: .6, Instructions: 620COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46b480305a4903cb3d57e3560f603391edfa14a395c5bb5888444e64f254d57e
Instruction ID: ec60b14d78073ac43c012481cc23090da987a982f0f427e08d0b19fae34b2907
Opcode Fuzzy Hash: 46b480305a4903cb3d57e3560f603391edfa14a395c5bb5888444e64f254d57e
Instruction Fuzzy Hash: B142B512A2466986DB78CB79DC1169FA2B3EF58300F04D8FD940DE7664F6704AC99B0E

Function 3BEB41F4 Relevance: .6, Instructions: 617COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 958caebf3c909686afe66b4fca4366fd237c9a0c17c975b157e4514bf1d0d591
Instruction ID: 448af4a5a0984e7975b5c979df479dff1da60906d577d4bf13944a2a84d59398
Opcode Fuzzy Hash: 958caebf3c909686afe66b4fca4366fd237c9a0c17c975b157e4514bf1d0d591
Instruction Fuzzy Hash: DE42C516A2466986DB78CB39DC1169FA2B3EF58300F04D8FD940DF7664F6704AC99B0E

Function 3BEB4BDC Relevance: .6, Instructions: 614COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15b320a4e12227806e836458203e605335f636a78f02788f222a048caacf3c2a
Instruction ID: 6b71e435b181a7ed9dda20d4b9f821338ffa78d0563d67ab3df6ff7ce49431aa
Opcode Fuzzy Hash: 15b320a4e12227806e836458203e605335f636a78f02788f222a048caacf3c2a
Instruction Fuzzy Hash: 9A42A312E2466986DB78CB39DC1169FA2B3EF58300F05D8FD940DE7664F6704AC99B0E

Function 3BEB4174 Relevance: .6, Instructions: 613COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 027654de364b2a499c5260a5da76652f652b28d684eb9e341d23cbc8b08444ac
Instruction ID: dd451640cab9ebebbf947e696c68ff25957900cc732cf56079804fbfc62b58eb
Opcode Fuzzy Hash: 027654de364b2a499c5260a5da76652f652b28d684eb9e341d23cbc8b08444ac
Instruction Fuzzy Hash: 8B42C512A2466986DB78CB39DC1169FA2B3EF58300F04D8FD940DF7664F6704AC99B0E

Function 3BEB40B6 Relevance: .6, Instructions: 613COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3ae2e5f62207797aa623202d320ba10f3064d7bf67d43d48157e8d72eb7eb0f
Instruction ID: fb82af8ffd0a65a2f91905a3b1e1360b197725b67678bf76b505393c7c914965
Opcode Fuzzy Hash: a3ae2e5f62207797aa623202d320ba10f3064d7bf67d43d48157e8d72eb7eb0f
Instruction Fuzzy Hash: A742C512A2466986DB78CB39DC1169FA2B3EF58300F04D8FD940DF7664F6704AC99B0E

Function 3BEB461C Relevance: .6, Instructions: 600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9ad59e0b4a6ddb01c31e2ff6bc38ce07b4524d8499eb671735305a5ce0f63b6
Instruction ID: b179bd0ae0ecd1a3b8f921d3aa9179185a937464ad2a32e54f91c5d0b45cde98
Opcode Fuzzy Hash: f9ad59e0b4a6ddb01c31e2ff6bc38ce07b4524d8499eb671735305a5ce0f63b6
Instruction Fuzzy Hash: 1F42B516A2466986DB78CB79DC1129FA2B3EF58300F04D8FD940DF7664F6704AC99B0E

Function 3BEB3A9A Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43e43047d96bd8fdf89e7b967bdd5215594aa3ecb9b60a9821df96cd253c2e59
Instruction ID: 46561edf0514077cd8941c18c8beac8106da09fbd3b4ff412bfd36a67209075c
Opcode Fuzzy Hash: 43e43047d96bd8fdf89e7b967bdd5215594aa3ecb9b60a9821df96cd253c2e59
Instruction Fuzzy Hash: C0429512A2466986DB78CB79DC1169FA2B3EF58300F04D8FD940DF7664F6704AC99B0E

Function 3BEB3A14 Relevance: .6, Instructions: 593COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 778af2e9367e54bfebc0ed1c0b3181fd8fba3d44f95bb9eed05216895a01096e
Instruction ID: 86bd064babacad0416d6d6fd3dbfb0051e543986e3ac45372a948cea62942cc9
Opcode Fuzzy Hash: 778af2e9367e54bfebc0ed1c0b3181fd8fba3d44f95bb9eed05216895a01096e
Instruction Fuzzy Hash: D942A512A2466986DB78CB79DC1169FA2B3EF58300F04D8FD940DF7664F6704AC99B0E

Function 3BEB4D1E Relevance: .6, Instructions: 589COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 423039d1ed93768a6da9b6d9a50670f5783d0a03a2d24fcc7babbba66be33c34
Instruction ID: 6decbb8c8be872071cc28c87a03047e10e90ad91afffaec5973e54d041adeef9
Opcode Fuzzy Hash: 423039d1ed93768a6da9b6d9a50670f5783d0a03a2d24fcc7babbba66be33c34
Instruction Fuzzy Hash: D042A412A2466987DB78CB79DC1169FA2B3EF58300F04D8FD940DF7664F6704A899B0E

Function 3BEB4CF9 Relevance: .6, Instructions: 586COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06e198531bca682c0e6a334e34a51219d10fed6ef348be7f4a271bab048c2525
Instruction ID: 8a44dac6d4ffb6568d88f1f2e5d753fc9bc2c239fb5e2781b0d7a57a7fd198b6
Opcode Fuzzy Hash: 06e198531bca682c0e6a334e34a51219d10fed6ef348be7f4a271bab048c2525
Instruction Fuzzy Hash: 5342A412A2466986DB78CB79DC1129FA2B3EF58300F04D8FD940DF7664F6704AC99B0E

Function 3BEB4CF6 Relevance: .6, Instructions: 586COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64de4c36bba4274c335fe3fc82e6ccff8b4f10cfb1c2c18ac7fde06db0f93f52
Instruction ID: fe513fbbf32a02aef760657581636fc3b886637e871e521fec743c26a60495a1
Opcode Fuzzy Hash: 64de4c36bba4274c335fe3fc82e6ccff8b4f10cfb1c2c18ac7fde06db0f93f52
Instruction Fuzzy Hash: F142A412A2466986DB78CB79DC1169FA2B3AF58300F04D8FD940DF7664F6704AC99B0E

Function 3BEB3DE4 Relevance: .6, Instructions: 583COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5f9d83e850b5b465ae3f6f99bb3024d845f713aa4a85bfb8b133f12f1fb832d
Instruction ID: acea215d9b8a2c639eec05cafb6f236f769b36e6d4e5c1b2ff2dcce5c9135c7f
Opcode Fuzzy Hash: e5f9d83e850b5b465ae3f6f99bb3024d845f713aa4a85bfb8b133f12f1fb832d
Instruction Fuzzy Hash: 4E429516A2466986DB78CB79DC1129FA2B3EF58300F04D8FD940DF7664F6704AC99B0E

Function 3BEB3DF2 Relevance: .6, Instructions: 582COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aa72bdebd5d8774cadf334b9a44f24f8e708f15d9682b7d029d80f7c0cf9c12
Instruction ID: 1ad34c21daa2d921f4e2919d39801cd7f7ce248ac4bc13784632b1d4b86d894d
Opcode Fuzzy Hash: 5aa72bdebd5d8774cadf334b9a44f24f8e708f15d9682b7d029d80f7c0cf9c12
Instruction Fuzzy Hash: 7E42A512A2466986DB78CB79DC1129FA2B3EF58300F04D8FD940DF7664F6704AC99B0E

Function 3BEB4D08 Relevance: .6, Instructions: 582COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07a6b9af00aa6b5addb2034024adf425b2db825dd1cf4e696e7218e765569c4c
Instruction ID: 1f6572e48835dbbc6e61420152056692ae8f83275ccbc9fff964782a808d1f4e
Opcode Fuzzy Hash: 07a6b9af00aa6b5addb2034024adf425b2db825dd1cf4e696e7218e765569c4c
Instruction Fuzzy Hash: DF42A416A2466987DB78CB79DC1129FA2B3AF58300F04D8FD940DF7664F6704AC99B0E

Function 3BEB4C51 Relevance: .6, Instructions: 581COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6edf4ff80c5186d7c465df4ca28dd7e431a386f84f280900057186c49d64aa27
Instruction ID: 7e5202ef97bf8d5a85f09c9c0a8cbe92bb53e13f6423c1276c2f79d2811dbfa9
Opcode Fuzzy Hash: 6edf4ff80c5186d7c465df4ca28dd7e431a386f84f280900057186c49d64aa27
Instruction Fuzzy Hash: 6E429416A2466987DB78CB79DC1129FA2B3EF58300F04D8FD940DF7664F6704A899B0E

Function 3BEB515D Relevance: .6, Instructions: 580COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7506965c8956c9522cb5ad1671b9a2be9bb744c6186d22e37f8e5331b8ea94af
Instruction ID: 8a9fda839145d317842585d161baca8b1e14619e234a0ee85bc4f9d159ceb73c
Opcode Fuzzy Hash: 7506965c8956c9522cb5ad1671b9a2be9bb744c6186d22e37f8e5331b8ea94af
Instruction Fuzzy Hash: 2042A412A2466986DB78CB79DC1169FA2B3AF58300F04D8FD940DF7664F6704AC99B0E

Function 3BEB4666 Relevance: .6, Instructions: 578COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 592ce802872181b0cb1209d126dd78f173533e5f2f12401b807aa78a459fefb4
Instruction ID: 0e352e61fcf78d8a6fab30b64cd2b81f10c6509641e4a9a0c5a2eae9f4100ee3
Opcode Fuzzy Hash: 592ce802872181b0cb1209d126dd78f173533e5f2f12401b807aa78a459fefb4
Instruction Fuzzy Hash: EC42A512A2466986DB78CB79DC1169FA2B3EF58300F04D8FD940DF7664F6704AC99B0E

Function 3BEB4D9B Relevance: .6, Instructions: 578COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06d3ed0f8cf187ee04761edeb0da165f4ab27256d0b76234c938bf774b390bb8
Instruction ID: 3ab763e024bb02e9d68c6b2166b47840fbd554aca72757c28bdcd7fdbf649465
Opcode Fuzzy Hash: 06d3ed0f8cf187ee04761edeb0da165f4ab27256d0b76234c938bf774b390bb8
Instruction Fuzzy Hash: 0742A412A2466987DB78CB79DC1129FA2B3AF58300F04D8FD940DF7664F6704AC99B0E

Function 3BEB3E09 Relevance: .6, Instructions: 576COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c638d9780fa64fa48e80259df8e3e293d456f4716728fd62fdedd40f1b01eb35
Instruction ID: 6e36c038dfea649a8423e71a97668fe42e016e356258b98d3948c5f87c903291
Opcode Fuzzy Hash: c638d9780fa64fa48e80259df8e3e293d456f4716728fd62fdedd40f1b01eb35
Instruction Fuzzy Hash: BD429412A2466986DB78CB79DC1169FA2B3EF58300F04D8FD940DF7664F6704AC99B0E

Function 3BEB4C66 Relevance: .6, Instructions: 576COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd09a76c61b781f371fe4427c7b9909b83b3685d8f477569ba6ac9d848e8ed0f
Instruction ID: cb10dac8ebfe84e1e1aea7512ebd4c1598c71b0b834716817985f808a03d2904
Opcode Fuzzy Hash: fd09a76c61b781f371fe4427c7b9909b83b3685d8f477569ba6ac9d848e8ed0f
Instruction Fuzzy Hash: 6242A412A2466987DB78CB79DC1129FA2B3AF58300F04D8FD940DF7664F6704A899B0E

Function 3BEB4C92 Relevance: .6, Instructions: 573COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef627ac3f6e8f67043b2491845b9a7e22600a9eb87b3e74e4a9bd86f4dc3d219
Instruction ID: 4507a445e7b8e9211cddc1637a998d1d84b65d20244d2086ca9a91915d7712c4
Opcode Fuzzy Hash: ef627ac3f6e8f67043b2491845b9a7e22600a9eb87b3e74e4a9bd86f4dc3d219
Instruction Fuzzy Hash: 5A429416A2466987DB78CB79DC1129FA2B3EF58300F04D8FD940DF7664F6704A899B0E

Function 00890607 Relevance: 25.6, APIs: 1, Strings: 16, Instructions: 73
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,000002CC,00001000,00000004), ref: 0089FCC5

Strings

e, xrefs: 0089FD78
h, xrefs: 0089FD39
T, xrefs: 0089FD32
G, xrefs: 0089FD1D
d, xrefs: 0089FD55
r, xrefs: 0089FD40
e, xrefs: 0089FD24
a, xrefs: 0089FD4E
x, xrefs: 0089FD7F
t, xrefs: 0089FD71
t, xrefs: 0089FD86
n, xrefs: 0089FD6A
t, xrefs: 0089FD2B
o, xrefs: 0089FD63
C, xrefs: 0089FD5C
e, xrefs: 0089FD47

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: C$G$T$a$d$e$e$e$h$n$o$r$t$t$t$x
API String ID: 4275171209-902913966
Opcode ID: d82efc5077e4cb8f940cf63e6443f08b7563a7672d75b281068d14c4a0cdac30
Instruction ID: 03eff4bfdd7cfa3d320ea45edfe6fb1c4b0f5613babfe2020d6ed4145178e84f
Opcode Fuzzy Hash: d82efc5077e4cb8f940cf63e6443f08b7563a7672d75b281068d14c4a0cdac30
Instruction Fuzzy Hash: DC317850C486DCCDEB218615CC087D9BFE1BB52319F0881E9C5C966282CBBB1ED4CFA2

Function 3BEBDC25 Relevance: 21.2, APIs: 1, Strings: 13, Instructions: 156COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 3BEBE09D

Strings

a, xrefs: 3BEBE0EA
W, xrefs: 3BEBE11B
C, xrefs: 3BEBE0D5
r, xrefs: 3BEBE0DC
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0F8
F, xrefs: 3BEBE0FF
_W, xrefs: 3BEBE0AE
e, xrefs: 3BEBE114
i, xrefs: 3BEBE106
e, xrefs: 3BEBE0E3
t, xrefs: 3BEBE0F1
5P5M, xrefs: 3BEBE0B8

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: ea2726212cf36c4f0a508114a5e93c178df1c6a49787c28a2ed162b384f28155
Instruction ID: c301289ae32f43b82ddb3447624f4aa9de1daf31eeacc2ce74d7eefb833b54c8
Opcode Fuzzy Hash: ea2726212cf36c4f0a508114a5e93c178df1c6a49787c28a2ed162b384f28155
Instruction Fuzzy Hash: DC5104B2D082689EFB24C718DC59BDB7B78DB81714F0840FAD94C16280D67D5ED58EA3

Function 3BEBDBAB Relevance: 21.2, APIs: 1, Strings: 13, Instructions: 152COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 3BEBE09D

Strings

a, xrefs: 3BEBE0EA
W, xrefs: 3BEBE11B
C, xrefs: 3BEBE0D5
r, xrefs: 3BEBE0DC
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0F8
F, xrefs: 3BEBE0FF
_W, xrefs: 3BEBE0AE
e, xrefs: 3BEBE114
i, xrefs: 3BEBE106
e, xrefs: 3BEBE0E3
t, xrefs: 3BEBE0F1
5P5M, xrefs: 3BEBE0B8

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: ddb7bccc116bdbe94f2487397e8be9ed4cc79195d95d94e3b003af1e92a832ab
Instruction ID: 42f01c4dd40232fa062b302453edb29d6a63444171ccc369169394b4ff7f0333
Opcode Fuzzy Hash: ddb7bccc116bdbe94f2487397e8be9ed4cc79195d95d94e3b003af1e92a832ab
Instruction Fuzzy Hash: DB51F9B1D082689EFB248728DC49BDB7B74EB91714F0440FAD44D16281D67D5EC68FA3

Function 3BEBDC4E Relevance: 21.1, APIs: 1, Strings: 13, Instructions: 143COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 3BEBE09D

Strings

a, xrefs: 3BEBE0EA
W, xrefs: 3BEBE11B
C, xrefs: 3BEBE0D5
r, xrefs: 3BEBE0DC
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0F8
F, xrefs: 3BEBE0FF
_W, xrefs: 3BEBE0AE
e, xrefs: 3BEBE114
i, xrefs: 3BEBE106
e, xrefs: 3BEBE0E3
t, xrefs: 3BEBE0F1
5P5M, xrefs: 3BEBE0B8

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: d9297f27eb320548d5510cab110dc0976b1d6eb0051995f108286623b9f03be1
Instruction ID: d3139e9a8b13dca97a76f61522ca653b362d7cb1e1068b48c5d79f7dca04f270
Opcode Fuzzy Hash: d9297f27eb320548d5510cab110dc0976b1d6eb0051995f108286623b9f03be1
Instruction Fuzzy Hash: B75105B1D082689EFB24C728DC49BEB7B74AB51714F0440FAD84C16281D6795EC58FA3

Function 3BEBE025 Relevance: 21.1, APIs: 1, Strings: 13, Instructions: 140COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 3BEBE09D

Strings

a, xrefs: 3BEBE0EA
W, xrefs: 3BEBE11B
C, xrefs: 3BEBE0D5
r, xrefs: 3BEBE0DC
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0F8
F, xrefs: 3BEBE0FF
_W, xrefs: 3BEBE0AE
e, xrefs: 3BEBE114
i, xrefs: 3BEBE106
e, xrefs: 3BEBE0E3
t, xrefs: 3BEBE0F1
5P5M, xrefs: 3BEBE0B8

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: 322c783329bcc2983e533410743b8fa6ce166e40282c321a49490cb5e858d512
Instruction ID: e154a4aeebaef99965765db6c8d0cd0e1ac03480ccef939e4723694e50bc3cce
Opcode Fuzzy Hash: 322c783329bcc2983e533410743b8fa6ce166e40282c321a49490cb5e858d512
Instruction Fuzzy Hash: 014108B2D082A89EFB248728DC49BDB7F68DB51710F0400FAD84C16281D67D5FD58AA3

Function 3BEBDBEC Relevance: 21.1, APIs: 1, Strings: 13, Instructions: 132COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 3BEBE09D

Strings

a, xrefs: 3BEBE0EA
W, xrefs: 3BEBE11B
C, xrefs: 3BEBE0D5
r, xrefs: 3BEBE0DC
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0F8
F, xrefs: 3BEBE0FF
_W, xrefs: 3BEBE0AE
e, xrefs: 3BEBE114
i, xrefs: 3BEBE106
e, xrefs: 3BEBE0E3
t, xrefs: 3BEBE0F1
5P5M, xrefs: 3BEBE0B8

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: 4defacf141bbfd44142c436516b804d60fdcf417726a7344f93bee79191f3df3
Instruction ID: c992998db1305f42b037c82ad36f8455692a062393d04db5b7d3eebc97abedca
Opcode Fuzzy Hash: 4defacf141bbfd44142c436516b804d60fdcf417726a7344f93bee79191f3df3
Instruction Fuzzy Hash: 2141F5B1D0C2A89AFB24C728DC49BDB7F74AB91710F0840FAD44C16281D67D5AC68FA3

Function 3BEBDC75 Relevance: 21.1, APIs: 1, Strings: 13, Instructions: 132COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 3BEBE09D

Strings

a, xrefs: 3BEBE0EA
W, xrefs: 3BEBE11B
C, xrefs: 3BEBE0D5
r, xrefs: 3BEBE0DC
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0F8
F, xrefs: 3BEBE0FF
_W, xrefs: 3BEBE0AE
e, xrefs: 3BEBE114
i, xrefs: 3BEBE106
e, xrefs: 3BEBE0E3
t, xrefs: 3BEBE0F1
5P5M, xrefs: 3BEBE0B8

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: 1f6d4758d9ebff923557b00a34cf570b48c8a23050b5d15901241565f4359b9e
Instruction ID: ddd9f6e956be370ca3cba855a4d873980d76c16b409a2c69088f7dab7094d9d0
Opcode Fuzzy Hash: 1f6d4758d9ebff923557b00a34cf570b48c8a23050b5d15901241565f4359b9e
Instruction Fuzzy Hash: 4241F5B1D0C2A89EFB248728DC59BEB7F749B41714F0840FAD44D16281D67D5EC58BA3

Function 3BEBDB42 Relevance: 21.1, APIs: 1, Strings: 13, Instructions: 129COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 3BEBE09D

Strings

a, xrefs: 3BEBE0EA
W, xrefs: 3BEBE11B
C, xrefs: 3BEBE0D5
r, xrefs: 3BEBE0DC
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0F8
F, xrefs: 3BEBE0FF
_W, xrefs: 3BEBE0AE
e, xrefs: 3BEBE114
i, xrefs: 3BEBE106
e, xrefs: 3BEBE0E3
t, xrefs: 3BEBE0F1
5P5M, xrefs: 3BEBE0B8

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: 4c14ede1e96190d2c3dc6a99c705509ab44c6d77ff3013459abb8ca33e2cf27f
Instruction ID: 716d9848de01d787c7e59117c8ed9a63313bcee2b73dea4c5ac9c14a137ea7ce
Opcode Fuzzy Hash: 4c14ede1e96190d2c3dc6a99c705509ab44c6d77ff3013459abb8ca33e2cf27f
Instruction Fuzzy Hash: FC41E5B1D082A89AFB24C728DC49BDB7B74AB41714F0440FAD84D16281D67D5ED68FA3

Function 3BEBDC06 Relevance: 21.1, APIs: 1, Strings: 13, Instructions: 128COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 3BEBE09D

Strings

a, xrefs: 3BEBE0EA
W, xrefs: 3BEBE11B
C, xrefs: 3BEBE0D5
r, xrefs: 3BEBE0DC
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0F8
F, xrefs: 3BEBE0FF
_W, xrefs: 3BEBE0AE
e, xrefs: 3BEBE114
i, xrefs: 3BEBE106
e, xrefs: 3BEBE0E3
t, xrefs: 3BEBE0F1
5P5M, xrefs: 3BEBE0B8

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: 63136d7b5147379d68a01dc19f9929eca3b52eaf782c97765a0eafeaa6c4fef0
Instruction ID: e2e75eb23d1ebbcfea06d3d7f48de946e9eb7715e30c88b5033c18662ed54d3e
Opcode Fuzzy Hash: 63136d7b5147379d68a01dc19f9929eca3b52eaf782c97765a0eafeaa6c4fef0
Instruction Fuzzy Hash: D341F4B1D082A89AFB24C728DC49BDB7B74AF51710F0840FAD84C16281D67D5ED68FA3

Function 3BEBD569 Relevance: 21.1, APIs: 1, Strings: 13, Instructions: 123COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 3BEBE09D

Strings

a, xrefs: 3BEBE0EA
W, xrefs: 3BEBE11B
C, xrefs: 3BEBE0D5
r, xrefs: 3BEBE0DC
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0F8
F, xrefs: 3BEBE0FF
_W, xrefs: 3BEBE0AE
e, xrefs: 3BEBE114
i, xrefs: 3BEBE106
e, xrefs: 3BEBE0E3
t, xrefs: 3BEBE0F1
5P5M, xrefs: 3BEBE0B8

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: eb165844d20164fe60918f2b881a0ce7d4ec3ef8043857187399f09a3ce7c788
Instruction ID: 027179dd9026525e02d8d971c713e9bd0f5dcd0fd7a8d4b224981409406c18a9
Opcode Fuzzy Hash: eb165844d20164fe60918f2b881a0ce7d4ec3ef8043857187399f09a3ce7c788
Instruction Fuzzy Hash: 024106B2D0C2A89AFB248728DC49BDB7F74AB51714F0800FAD44C16281D67D5ED68FA3

Function 3BEBCCE9 Relevance: 21.1, APIs: 1, Strings: 13, Instructions: 123COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 3BEBE09D

Strings

a, xrefs: 3BEBE0EA
W, xrefs: 3BEBE11B
C, xrefs: 3BEBE0D5
r, xrefs: 3BEBE0DC
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0F8
F, xrefs: 3BEBE0FF
_W, xrefs: 3BEBE0AE
e, xrefs: 3BEBE114
i, xrefs: 3BEBE106
e, xrefs: 3BEBE0E3
t, xrefs: 3BEBE0F1
5P5M, xrefs: 3BEBE0B8

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: 17b541020c4e4771dc995c80583ba65604a53208e4a8a43109cf4fb5addc4ab4
Instruction ID: 01dacf853391698ec37bd80e2612ac53720a96fe5e4ac8948ed1ff7811484e53
Opcode Fuzzy Hash: 17b541020c4e4771dc995c80583ba65604a53208e4a8a43109cf4fb5addc4ab4
Instruction Fuzzy Hash: 9C41F6B1C0C2A89AFB248728DC49BDB7E64AB41714F0800FAD84D16281D67E5BD58BA3

Function 3BEBDB7B Relevance: 21.1, APIs: 1, Strings: 13, Instructions: 122COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 3BEBE09D

Strings

a, xrefs: 3BEBE0EA
W, xrefs: 3BEBE11B
C, xrefs: 3BEBE0D5
r, xrefs: 3BEBE0DC
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0F8
F, xrefs: 3BEBE0FF
_W, xrefs: 3BEBE0AE
e, xrefs: 3BEBE114
i, xrefs: 3BEBE106
e, xrefs: 3BEBE0E3
t, xrefs: 3BEBE0F1
5P5M, xrefs: 3BEBE0B8

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: 5438c3b9bcf6c2a69e8c448a2b21aa1f06211d9938ef59cccaac7db2c5cd728a
Instruction ID: 0841990237e35b17f336d8fe0d79f4d9e2ad10eeec08a1acbbf23e914250c472
Opcode Fuzzy Hash: 5438c3b9bcf6c2a69e8c448a2b21aa1f06211d9938ef59cccaac7db2c5cd728a
Instruction Fuzzy Hash: CE41E3B1D082A89AFB248728DC49BDB7B78AB51714F0800FAD84C16281D67D5ED58FA3

Function 3BEBD564 Relevance: 21.1, APIs: 1, Strings: 13, Instructions: 122COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 3BEBE09D

Strings

a, xrefs: 3BEBE0EA
W, xrefs: 3BEBE11B
C, xrefs: 3BEBE0D5
r, xrefs: 3BEBE0DC
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0F8
F, xrefs: 3BEBE0FF
_W, xrefs: 3BEBE0AE
e, xrefs: 3BEBE114
i, xrefs: 3BEBE106
e, xrefs: 3BEBE0E3
t, xrefs: 3BEBE0F1
5P5M, xrefs: 3BEBE0B8

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: 4e06b58ba96e5ace161f1916feb9944e6108d49ab3d8453ed04ba01d09d58737
Instruction ID: 3e22502358bd491e74b105627a8556c5df6c45a19cbdec01f2ec899dd7bfc0fe
Opcode Fuzzy Hash: 4e06b58ba96e5ace161f1916feb9944e6108d49ab3d8453ed04ba01d09d58737
Instruction Fuzzy Hash: EA41F6B1C0C2A89AFB248728DC09BDB7E649B41714F0840FAD44C16281D67E5ED58FA3

Function 3BEBC143 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNELBASE(?,?,00000000,00000001,?,?,?,?,3BEBC0E0,?,?,?,?,3BEBBBF0,3BEB969B,?), ref: 3BEBC1BF

Strings

l, xrefs: 3BEBC1CC
e, xrefs: 3BEBC20B
o, xrefs: 3BEBC1D3
n, xrefs: 3BEBC1F6
a, xrefs: 3BEBC1EF
l, xrefs: 3BEBC204
H, xrefs: 3BEBC1E8
d, xrefs: 3BEBC1FD
C, xrefs: 3BEBC1C5
e, xrefs: 3BEBC1E1
s, xrefs: 3BEBC1DA

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: Value
String ID: C$H$a$d$e$e$l$l$n$o$s
API String ID: 3702945584-2848555115
Opcode ID: edb567c4d405c8c125092bce87387bbadf313e197d0d1ebb8806aa53d65049a3
Instruction ID: 627444ea62e9caeb9a024cab4d18935a32938c94d82b1340ef1e5f62e3d0c28d
Opcode Fuzzy Hash: edb567c4d405c8c125092bce87387bbadf313e197d0d1ebb8806aa53d65049a3
Instruction Fuzzy Hash: AF31C671D08A998EEB18CA28CC54BEABBB29B41305F0441EDD14C67281D6BA1FC6CF21

Function 3BEC39A0 Relevance: 15.2, APIs: 1, Strings: 9, Instructions: 156COMMON

Download Yara Rule

Strings

e, xrefs: 3BEC3EE1
R, xrefs: 3BEC3EDA
a, xrefs: 3BEC3EE8
F, xrefs: 3BEC3EF6
l, xrefs: 3BEC3F04
i, xrefs: 3BEC3EFD
d, xrefs: 3BEC3EEF
^S, xrefs: 3BEC3F6F
e, xrefs: 3BEC3F0B

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: F$R$^S$a$d$e$e$i$l
API String ID: 4275171209-2377276599
Opcode ID: 3141dec147b558d62405240489b1ff15c4184e45e55e9d0543e5dd0558e22c4b
Instruction ID: 41fa5d9adfdf1f4dc7cf7666e1d03c3eb339a718b6a7603c42fbbf594df49d40
Opcode Fuzzy Hash: 3141dec147b558d62405240489b1ff15c4184e45e55e9d0543e5dd0558e22c4b
Instruction Fuzzy Hash: 225125B1C086949FE7218A24CC947DBBFB5EF82315F1440FAC54D5A281D27A4AC6CB22

Function 3BEC3A16 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 147memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,39335C83,00003000,00000004), ref: 3BEC3E85

Strings

e, xrefs: 3BEC3EE1
R, xrefs: 3BEC3EDA
a, xrefs: 3BEC3EE8
F, xrefs: 3BEC3EF6
l, xrefs: 3BEC3F04
i, xrefs: 3BEC3EFD
d, xrefs: 3BEC3EEF
^S, xrefs: 3BEC3F6F
e, xrefs: 3BEC3F0B

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: F$R$^S$a$d$e$e$i$l
API String ID: 4275171209-2377276599
Opcode ID: 41cc12e3f37aa8b4cbd49388fdff73f92e74825ada55826acc8b6e96cb0f9759
Instruction ID: 5191d31a6d03cb2bd230287d948d457742ca6455b4a0134eb8dcaec2fb8cfe27
Opcode Fuzzy Hash: 41cc12e3f37aa8b4cbd49388fdff73f92e74825ada55826acc8b6e96cb0f9759
Instruction Fuzzy Hash: 1B5148B2C087949FF7218624DD94BDBBF75EF92704F1440FAD54D5A281D6BA0BC1CA22

Function 3BEC39E1 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 145COMMON

Download Yara Rule

Strings

e, xrefs: 3BEC3EE1
R, xrefs: 3BEC3EDA
a, xrefs: 3BEC3EE8
F, xrefs: 3BEC3EF6
l, xrefs: 3BEC3F04
i, xrefs: 3BEC3EFD
d, xrefs: 3BEC3EEF
^S, xrefs: 3BEC3F6F
e, xrefs: 3BEC3F0B

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: F$R$^S$a$d$e$e$i$l
API String ID: 4275171209-2377276599
Opcode ID: 1ab85169e5283b87be0723a637f2047cc87a8f4f4395c44928ae34f695379456
Instruction ID: deb3449515a873ac73a2cb6aa5341366c8687f20b1c90da8f3a5c38410ee3c2b
Opcode Fuzzy Hash: 1ab85169e5283b87be0723a637f2047cc87a8f4f4395c44928ae34f695379456
Instruction Fuzzy Hash: DE514CB1C097949FF3218628DD957DB7F75AF82704F1400FAC54D5A281D2BA4BC5CB62

Function 3BEC3A30 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 143memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,39335C83,00003000,00000004), ref: 3BEC3E85

Strings

e, xrefs: 3BEC3EE1
R, xrefs: 3BEC3EDA
a, xrefs: 3BEC3EE8
F, xrefs: 3BEC3EF6
l, xrefs: 3BEC3F04
i, xrefs: 3BEC3EFD
d, xrefs: 3BEC3EEF
^S, xrefs: 3BEC3F6F
e, xrefs: 3BEC3F0B

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: F$R$^S$a$d$e$e$i$l
API String ID: 4275171209-2377276599
Opcode ID: 7904322ccc2628d201d8326f4c62d4224f80ceb5d94975cf54b6622a622109d5
Instruction ID: 8320a4700a3ee7e07a7d94ae1bf240092ecee6030e28a70850a0bb29fbd0cec0
Opcode Fuzzy Hash: 7904322ccc2628d201d8326f4c62d4224f80ceb5d94975cf54b6622a622109d5
Instruction Fuzzy Hash: 245147B1C046A49FF3218625DD88BDBBF75EF82704F1400FAD54D66281D2BA0BC1CA62

Function 3BEC3A3B Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 138memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,39335C83,00003000,00000004), ref: 3BEC3E85

Strings

e, xrefs: 3BEC3EE1
R, xrefs: 3BEC3EDA
a, xrefs: 3BEC3EE8
F, xrefs: 3BEC3EF6
l, xrefs: 3BEC3F04
i, xrefs: 3BEC3EFD
d, xrefs: 3BEC3EEF
^S, xrefs: 3BEC3F6F
e, xrefs: 3BEC3F0B

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: F$R$^S$a$d$e$e$i$l
API String ID: 4275171209-2377276599
Opcode ID: 30d72032d7fcb36dd7c1532728cce3d959da61ef05a18c806bd9c6943fdf3140
Instruction ID: d90645b9463051faaf3d7b42ff59c8adc76cf74b96ee8a19c2cb5380e0e5ad48
Opcode Fuzzy Hash: 30d72032d7fcb36dd7c1532728cce3d959da61ef05a18c806bd9c6943fdf3140
Instruction Fuzzy Hash: B45146B2C046A49FF7218628DD84BDBBF75AF82705F1400FAD54D66281D2BA0BC1CF62

Function 3BEC3A68 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 131memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,39335C83,00003000,00000004), ref: 3BEC3E85

Strings

e, xrefs: 3BEC3EE1
R, xrefs: 3BEC3EDA
a, xrefs: 3BEC3EE8
F, xrefs: 3BEC3EF6
l, xrefs: 3BEC3F04
i, xrefs: 3BEC3EFD
d, xrefs: 3BEC3EEF
^S, xrefs: 3BEC3F6F
e, xrefs: 3BEC3F0B

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: F$R$^S$a$d$e$e$i$l
API String ID: 4275171209-2377276599
Opcode ID: 61db9a7b50d170d37c675933f2721a7f3ee4c2dabc97a5208ae357cc764a9919
Instruction ID: ab395aeb75a8291aad3f28fe001a032987a1bea0edf2c75e7ae4302fa0ea44e5
Opcode Fuzzy Hash: 61db9a7b50d170d37c675933f2721a7f3ee4c2dabc97a5208ae357cc764a9919
Instruction Fuzzy Hash: 7D4136B2C086A49FF3218624DC95BDBBF75AF92715F1400FAD54D1A281D2BA0BC1CB62

Function 3BEC39F4 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,39335C83,00003000,00000004), ref: 3BEC3E85

Strings

e, xrefs: 3BEC3EE1
R, xrefs: 3BEC3EDA
a, xrefs: 3BEC3EE8
F, xrefs: 3BEC3EF6
l, xrefs: 3BEC3F04
i, xrefs: 3BEC3EFD
d, xrefs: 3BEC3EEF
^S, xrefs: 3BEC3F6F
e, xrefs: 3BEC3F0B

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: F$R$^S$a$d$e$e$i$l
API String ID: 4275171209-2377276599
Opcode ID: 7ea7f55bef0f78ade4f06369be76c9845dc51543b7c7060e6ea3de02a0614b5b
Instruction ID: f2648983d746ffc65ea85dcdc2d8c2ca7c076a9c2f91992921deafb80c266987
Opcode Fuzzy Hash: 7ea7f55bef0f78ade4f06369be76c9845dc51543b7c7060e6ea3de02a0614b5b
Instruction Fuzzy Hash: 714137B1D086949FF7218625DC897DBBF75AF92705F1400F9D54D5A281D2BA0BC1CF22

Function 3BEC3936 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,39335C83,00003000,00000004), ref: 3BEC3E85

Strings

e, xrefs: 3BEC3EE1
R, xrefs: 3BEC3EDA
a, xrefs: 3BEC3EE8
F, xrefs: 3BEC3EF6
l, xrefs: 3BEC3F04
i, xrefs: 3BEC3EFD
d, xrefs: 3BEC3EEF
^S, xrefs: 3BEC3F6F
e, xrefs: 3BEC3F0B

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: F$R$^S$a$d$e$e$i$l
API String ID: 4275171209-2377276599
Opcode ID: a731e432bd37d839fc8ec193ce9b251205cd9bb0238adbb90797d4b789d16cb5
Instruction ID: 152c454d80641c3712396b26495d69c077c485ba8dc10adbfb1348bb169e64db
Opcode Fuzzy Hash: a731e432bd37d839fc8ec193ce9b251205cd9bb0238adbb90797d4b789d16cb5
Instruction Fuzzy Hash: E04149B2C092A49FF7218624DC957DBBF75AF92705F1400F9C54D1A281D2BA0BC1CF62

Function 3BEC3E48 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,39335C83,00003000,00000004), ref: 3BEC3E85

Strings

e, xrefs: 3BEC3EE1
R, xrefs: 3BEC3EDA
a, xrefs: 3BEC3EE8
F, xrefs: 3BEC3EF6
l, xrefs: 3BEC3F04
i, xrefs: 3BEC3EFD
d, xrefs: 3BEC3EEF
^S, xrefs: 3BEC3F6F
e, xrefs: 3BEC3F0B

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: F$R$^S$a$d$e$e$i$l
API String ID: 4275171209-2377276599
Opcode ID: 529d7e5447e120ba61df0b1e12f795e1f9cfde3fbe69496b2375f69555bbd19d
Instruction ID: 799970ee4c70e0a9071e9eaed243ab0b6855e9942c1f3984344723027d219c63
Opcode Fuzzy Hash: 529d7e5447e120ba61df0b1e12f795e1f9cfde3fbe69496b2375f69555bbd19d
Instruction Fuzzy Hash: 474149B1C082A49FF7218624DC85BDBBF75AF92715F1440FAC54D1A281D2BA0BC1CF62

Function 3BEC2ADB Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 119memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,39335C83,00003000,00000004), ref: 3BEC3E85

Strings

e, xrefs: 3BEC3EE1
R, xrefs: 3BEC3EDA
a, xrefs: 3BEC3EE8
F, xrefs: 3BEC3EF6
l, xrefs: 3BEC3F04
i, xrefs: 3BEC3EFD
d, xrefs: 3BEC3EEF
^S, xrefs: 3BEC3F6F
e, xrefs: 3BEC3F0B

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: F$R$^S$a$d$e$e$i$l
API String ID: 4275171209-2377276599
Opcode ID: 023a0cbf1f71054875a8b6face02e6ad2f281ff22ac6ce6c96b586584fd9b362
Instruction ID: 6e518e51c4a7298ddb7764693893ed5052a04fc6356ed96673ba98703163d661
Opcode Fuzzy Hash: 023a0cbf1f71054875a8b6face02e6ad2f281ff22ac6ce6c96b586584fd9b362
Instruction Fuzzy Hash: CF4159A2C083949FF3218624DC99BD7BF75DF92715F1400F9D54D5A281D2BA0BC1CB22

Function 3BEC3968 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 118memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,39335C83,00003000,00000004), ref: 3BEC3E85

Strings

e, xrefs: 3BEC3EE1
R, xrefs: 3BEC3EDA
a, xrefs: 3BEC3EE8
F, xrefs: 3BEC3EF6
l, xrefs: 3BEC3F04
i, xrefs: 3BEC3EFD
d, xrefs: 3BEC3EEF
^S, xrefs: 3BEC3F6F
e, xrefs: 3BEC3F0B

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: F$R$^S$a$d$e$e$i$l
API String ID: 4275171209-2377276599
Opcode ID: e4e65e63fb9d55602adcc2f0a85e4d13e558049cc347d8fa74676ab262af103e
Instruction ID: 6f775729bdfc3fa4cf3e5500fbcd069c39a1534226837f2ed4423152d27237a0
Opcode Fuzzy Hash: e4e65e63fb9d55602adcc2f0a85e4d13e558049cc347d8fa74676ab262af103e
Instruction Fuzzy Hash: 9F4127B1D096A49FF7218624DC99BDBBF75AF92705F1400F9D54D1A281D2BA0BC1CF22

Function 3BEC3356 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 117memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,39335C83,00003000,00000004), ref: 3BEC3E85

Strings

e, xrefs: 3BEC3EE1
R, xrefs: 3BEC3EDA
a, xrefs: 3BEC3EE8
F, xrefs: 3BEC3EF6
l, xrefs: 3BEC3F04
i, xrefs: 3BEC3EFD
d, xrefs: 3BEC3EEF
^S, xrefs: 3BEC3F6F
e, xrefs: 3BEC3F0B

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: F$R$^S$a$d$e$e$i$l
API String ID: 4275171209-2377276599
Opcode ID: 1d96e366ad7ae2cfa47566351e481602f0f91ddc3d4e29037e6cf0c91c6741e8
Instruction ID: e2885ece506147528feae6806952333baa4a5378810d5bfa93c63f6e400125c4
Opcode Fuzzy Hash: 1d96e366ad7ae2cfa47566351e481602f0f91ddc3d4e29037e6cf0c91c6741e8
Instruction Fuzzy Hash: DD4157B2C083949FF3218624DC59BD7BFB5AF92715F1400F9D54D5A281D2BA0BC1CB62

Function 3BEB9BFC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 3BEBA0FB

Strings

557C, xrefs: 3BEB9BFC
Qh?, xrefs: 3BEBA0E7

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: Open
String ID: 557C$Qh?
API String ID: 71445658-219458933
Opcode ID: 3cb653597bc64d961f8f4ae0a1d08e0bbc5b2a95d2a0e29e8a3dee2843e3208e
Instruction ID: fa1ba82a78c41ffdc5be78f7784d0c1a6f2f17bddbdbace1c69e968a90c4dfdf
Opcode Fuzzy Hash: 3cb653597bc64d961f8f4ae0a1d08e0bbc5b2a95d2a0e29e8a3dee2843e3208e
Instruction Fuzzy Hash: AC11E2FAD143189EFB14CB18CC44BFA76B5EB84310F00E1BAD58996680DA399EC58E52

Function 3BEB7A94 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Strings

K, xrefs: 3BEB7C69

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID: K
API String ID: 4241100979-856455061
Opcode ID: d17a66c6a1fb85ad1f00bd7f9ef20fde77fd129ea050c0d1258e21f55d8bd975
Instruction ID: a61ebb541d81c86e1a94be9a3477989e4ab68bee628c297859d91c9b46b0c52f
Opcode Fuzzy Hash: d17a66c6a1fb85ad1f00bd7f9ef20fde77fd129ea050c0d1258e21f55d8bd975
Instruction Fuzzy Hash: 2551F0B0D0C3985AEF14CB18DDD07AA7BBAEB45305F1840EACA4D56B42DA385BC18E12

Function 008A97F9 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 145COMMON

Download Yara Rule

APIs

VirtualProtectEx.KERNELBASE(?,?,00001000,00000040,?), ref: 008A9AA6

Strings

Qj@h, xrefs: 008A9A90

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID: Qj@h
API String ID: 544645111-2762301250
Opcode ID: 67f4bec60b06c6ed6250d2ffa7673ac6eafed5faca09221bfa6102c621714b21
Instruction ID: 169ca5acf6e0d1536c7671a08f232e09f9ad874ee3ff50acc705e12ea7340d27
Opcode Fuzzy Hash: 67f4bec60b06c6ed6250d2ffa7673ac6eafed5faca09221bfa6102c621714b21
Instruction Fuzzy Hash: A5510B71E095689FE724CA14CC94BEBBB75FF82301F1880FED58A96641D6386EC48F91

Function 3BEB6667 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 135COMMON

Download Yara Rule

Strings

;ZQS, xrefs: 3BEB6669

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID: ;ZQS
API String ID: 4241100979-914843521
Opcode ID: 2a60bbca95aa46d13a933386d657eaf3397486c2e2617a7e6b4dbfda275d0657
Instruction ID: ad41866a012368e11f3d71e736d9a07ec0621b744dc602bf13ad100b44ecefee
Opcode Fuzzy Hash: 2a60bbca95aa46d13a933386d657eaf3397486c2e2617a7e6b4dbfda275d0657
Instruction Fuzzy Hash: 6041E6A1D1C3589EEF14CB28DC446EABB75EF84700F1481EAD50D96295EA381AC08F16

Function 00541A3F Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

K32GetPerformanceInfo.KERNEL32(?,00000038), ref: 00541FDB

Strings

>9MJ, xrefs: 00541B14

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: InfoPerformance
String ID: >9MJ
API String ID: 3070290716-3386120023
Opcode ID: 1e3ca6a2eb1fbbdb94920b2adb9bed1a38b8a3d3ba7fd2f160861eebe2c7d90e
Instruction ID: 2a4afc837041121e3bfe3334d9db2c67196c281d4cafe6a74e2ba7233e38de6f
Opcode Fuzzy Hash: 1e3ca6a2eb1fbbdb94920b2adb9bed1a38b8a3d3ba7fd2f160861eebe2c7d90e
Instruction Fuzzy Hash: 3151BEB2D156289BE728CF14CD94BEABBB5FB90304F14C1E9D40D6A784D6386EC58F44

Function 008A98B3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

VirtualProtectEx.KERNELBASE(?,?,00001000,00000040,?), ref: 008A9AA6

Strings

Qj@h, xrefs: 008A9A90

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID: Qj@h
API String ID: 544645111-2762301250
Opcode ID: 0a1ef45a37b0ae3ec12c27a84a993e95d202f66eacf545d0da283d9f6d85b83f
Instruction ID: cd9e2757867d4ee9eef2d37cea35e685e7aeb5e3df58f4c50f618ceedc367ab5
Opcode Fuzzy Hash: 0a1ef45a37b0ae3ec12c27a84a993e95d202f66eacf545d0da283d9f6d85b83f
Instruction Fuzzy Hash: 14413A71D095689FEB248A18CC947EBBB74FF83301F1840EED98E96641E6346E84CF91

Function 008A94F9 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 112COMMON

Download Yara Rule

APIs

VirtualProtectEx.KERNELBASE(?,?,00001000,00000040,?), ref: 008A9AA6

Strings

Qj@h, xrefs: 008A9A90

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID: Qj@h
API String ID: 544645111-2762301250
Opcode ID: 95a147c2ad3653fd1d04446b0087763719bd6beff2265509358a2c56fa8c8b8a
Instruction ID: 3160b1059b44bb8ef186d8bc0f2c8b89683da5a4c9e515d2f0c7659dff6fc5fb
Opcode Fuzzy Hash: 95a147c2ad3653fd1d04446b0087763719bd6beff2265509358a2c56fa8c8b8a
Instruction Fuzzy Hash: 3E41F7F1D0C2189FFB248B68DC85ADBB774FB46314F2041AAE989D7640E6356E81CE52

Function 005487DD Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00548D68

Strings

=M<4, xrefs: 005488A6

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID: =M<4
API String ID: 544645111-151022777
Opcode ID: 6b449beb5ec40ea697394cf505f180c7ebe87447f53f60f71666c0006ac580c9
Instruction ID: 8c6a14a01cc8813a3283c3d0cecb2b8429e1b1d1bbf78ec5efad4d07a39c6fe3
Opcode Fuzzy Hash: 6b449beb5ec40ea697394cf505f180c7ebe87447f53f60f71666c0006ac580c9
Instruction Fuzzy Hash: B13124B1D042199FEB208A24CC84BFE7B75FB90308F1481FAD54A6A682DE301ED5CF52

Function 00898911 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

Qj@h, xrefs: 008A9A90

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID: Qj@h
API String ID: 544645111-2762301250
Opcode ID: a4bd46a351042099f9468f9fafc46c686f1723983553f78a6fcff9809e707954
Instruction ID: 4a313a9f8a601924728c80626d7d94a172188046b38d7e3688ba754b2f833a8a
Opcode Fuzzy Hash: a4bd46a351042099f9468f9fafc46c686f1723983553f78a6fcff9809e707954
Instruction Fuzzy Hash: 483125B1C0C3A59FEB2156789C956EBBBA4FF02314F1400AAD589D2942D2356E85CB63

Function 3BEB671C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

A2L:, xrefs: 3BEB671C

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID: A2L:
API String ID: 4241100979-3217229825
Opcode ID: e30be1e314151d5dd159db7691d13d1b836159c35da81fcad1178ccc75eba72a
Instruction ID: 70a65a379d4f3c2b4f965f857f7730aa1922bb1174db1727ade84ae062dcf3c5
Opcode Fuzzy Hash: e30be1e314151d5dd159db7691d13d1b836159c35da81fcad1178ccc75eba72a
Instruction Fuzzy Hash: 1731E5B1D1D3A89EEF24CB68DC447EABB74EF85700F1081EAD44D9A155EA780AC5CF12

Function 3BEB76E4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

;GM^, xrefs: 3BEB76E5

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID: ;GM^
API String ID: 4241100979-3133109826
Opcode ID: 84b5d8deae7373197ffdb3b76443b1e1e566bdebe1fdbd7deb08a4906065d452
Instruction ID: 55d0a1baf73a0e5c0ab768ed1c4db9a95f781c58f6ba26c14b5cceee7c0d6b07
Opcode Fuzzy Hash: 84b5d8deae7373197ffdb3b76443b1e1e566bdebe1fdbd7deb08a4906065d452
Instruction Fuzzy Hash: C431F8F1C093A85FEB20DB54CC90ADA7B74DF85704F1581FAD98C66641DA344EC6CB92

Function 0089B8FD Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 76processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 0089BE3D

Strings

jjjj, xrefs: 0089BE2E

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 4455b64cdea1b26f6edff0b999ce5551bc52efe780797bddcb0211565cb0704c
Instruction ID: b5917230019067a8f11773b809cbb3c0b0f32867f502c9dc70e01dbe7b729b26
Opcode Fuzzy Hash: 4455b64cdea1b26f6edff0b999ce5551bc52efe780797bddcb0211565cb0704c
Instruction Fuzzy Hash: AE21D672E4121D9AFB348A14DD85FFA7778F704314F2841F9E90AD66C0E6355F809E90

Function 0089B913 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 69processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 0089BE3D

Strings

jjjj, xrefs: 0089BE2E

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 904e06bd45bd9fdf50ddd58c086326ef73d7893ea4a6e4ff4d6f230e9fc175fb
Instruction ID: f7721127fd72282b40d744a762038066964f21138db9c3e51708c5a7b4193a2c
Opcode Fuzzy Hash: 904e06bd45bd9fdf50ddd58c086326ef73d7893ea4a6e4ff4d6f230e9fc175fb
Instruction Fuzzy Hash: B421C072E4021DAAFB34CA24DD86BFA7778EB40300F2441F9E909AA6C0D6345F809F80

Function 005487B2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

7;PF, xrefs: 005487D5

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID: 7;PF
API String ID: 544645111-1099082884
Opcode ID: 3a19ca62995d2c28e97c3dcd1b95990e7a350f8078187c2eeae706a144347792
Instruction ID: a6874fc4fe02c79d032309a430a846c5687fb61d88b1092537850fad30f1645a
Opcode Fuzzy Hash: 3a19ca62995d2c28e97c3dcd1b95990e7a350f8078187c2eeae706a144347792
Instruction Fuzzy Hash: 6D2102B2D041559FEB208A24CC58BFF7AB4FB80348F2081FAE60E67681DE344EC58B51

Function 0089B99E Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 67processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 0089BE3D

Strings

jjjj, xrefs: 0089BE2E

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 2b9f4424e7420cad9edd66d7f238d336b52235b58116012885eeea81119d8876
Instruction ID: 3f4d881008fa70051dec42cc48d1b25aa46b17ea625fd3a4f1b0ddfd81b8b681
Opcode Fuzzy Hash: 2b9f4424e7420cad9edd66d7f238d336b52235b58116012885eeea81119d8876
Instruction Fuzzy Hash: F911B4B2E4522D5AFB34CA54DC85FFAB778FB40304F1841F5E909A6280E7B56F809E90

Function 3BEB7C50 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Strings

K, xrefs: 3BEB7C69

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID: K
API String ID: 4241100979-856455061
Opcode ID: 113ad6bb2380edc36fc4b847648b066c376f0e3ed5ca20c6d6dca9cf2380ffb3
Instruction ID: 187194ddbf5e467e806333967b9c713888ff7423c9b63ecfa203f438c9f2afee
Opcode Fuzzy Hash: 113ad6bb2380edc36fc4b847648b066c376f0e3ed5ca20c6d6dca9cf2380ffb3
Instruction Fuzzy Hash: 7611DFB0C093986FEB11CB10DC807EA7B74EB46304F0940DBD48DAA642E6394ECA8F52

Function 3BEB7C65 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Strings

K, xrefs: 3BEB7C69

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID: K
API String ID: 4241100979-856455061
Opcode ID: 6a291d858259b90ed948322e226fd18828e5b6510c0699e9ddc9ca19d3840a5b
Instruction ID: 23edb5f167424481ce0ba802085c8f38d275b5c6a279af7f536e1178eebea862
Opcode Fuzzy Hash: 6a291d858259b90ed948322e226fd18828e5b6510c0699e9ddc9ca19d3840a5b
Instruction Fuzzy Hash: CE119DB0C08398AEEB108B14DC816EA7B78EB45700F0880EAD48D65641EA395EC58E52

Function 3BEB9C09 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 3BEBA0FB

Strings

Qh?, xrefs: 3BEBA0E7

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: 0198249a4045f7c3f1497b2a8630e81faab1d8669acd1561e853a4e98890e6e9
Instruction ID: 8d2fe53cf15915831402509c5b9427a516214baa37c769fa1c706ca66eb323ed
Opcode Fuzzy Hash: 0198249a4045f7c3f1497b2a8630e81faab1d8669acd1561e853a4e98890e6e9
Instruction Fuzzy Hash: 9211C1B6D14318AEFB14CB28CC44BFAB6B5EB84310F00E1BAD54996680DA395EC58E11

Function 0089BD82 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 0089BE3D

Strings

jjjj, xrefs: 0089BE2E

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 0b67a3e93217666004ff40da8b37dee503d237bef2fb6423eb3e0ff8ee471c7f
Instruction ID: f84e58b6d8a095238746cb97e7f5f8d071ffd6ee0205144865fc9ca3dc4bc382
Opcode Fuzzy Hash: 0b67a3e93217666004ff40da8b37dee503d237bef2fb6423eb3e0ff8ee471c7f
Instruction Fuzzy Hash: C81173B1E4521C9AEF389A50DD52BF97774F700704F2441EAEA0AA66C0D7741FC09F51

Function 3BEBA07C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 3BEBA0FB

Strings

Qh?, xrefs: 3BEBA0E7

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: f8526c289196378cd7bff4ec3010927700e7c0c1bc176cab9d48bfc231d53c4d
Instruction ID: 8a3f2959ee46624c311a7adffef0dbb3f2c4da057430190a0898e889216c4645
Opcode Fuzzy Hash: f8526c289196378cd7bff4ec3010927700e7c0c1bc176cab9d48bfc231d53c4d
Instruction Fuzzy Hash: DF01B5F2C18718AFEF24CB18CC54AFB7A68EF40701F4061AAA88951581EE745FC1CE53

Function 0089AA2D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 0089BE3D

Strings

jjjj, xrefs: 0089BE2E

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 3890283ce0457eb32d0766ba7cfa8f33abbd822ea9efb7c2a4984ae7506b213a
Instruction ID: 6ac7b4418c0d557b90a710fa1ccc60c899678cdef7c39624a45a6b3596dfd2c1
Opcode Fuzzy Hash: 3890283ce0457eb32d0766ba7cfa8f33abbd822ea9efb7c2a4984ae7506b213a
Instruction Fuzzy Hash: 9001F772F45248AAFB34C915DC46FEE7769FB80704F6841FAFA09AA5C0D7F41B809A41

Function 0089BDAE Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 0089BE3D

Strings

jjjj, xrefs: 0089BE2E

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 66204683e165099a07daaae221ba03c19274fa427e00a6513269654286639aab
Instruction ID: 845d9d8bfcc4f22d072e348526860ce37bcf0d8089a73e5a80af794908a3d4b8
Opcode Fuzzy Hash: 66204683e165099a07daaae221ba03c19274fa427e00a6513269654286639aab
Instruction Fuzzy Hash: 67017171E442589AEB38CA50DC52BF9B774FB40705F2441EEEA4AA62C0DB711B809F44

Function 0089B2AD Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 43processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 0089BE3D

Strings

jjjj, xrefs: 0089BE2E

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: f7bd3e088d5ec32d4f3b5729740d0f0a05f0531191a536fa2145f56e457d0eb8
Instruction ID: 8e17deaae636d3e6c7993c067f08056fd7e95a3d8ce9f51d9e1ba450e1d83a46
Opcode Fuzzy Hash: f7bd3e088d5ec32d4f3b5729740d0f0a05f0531191a536fa2145f56e457d0eb8
Instruction Fuzzy Hash: DA01D671B4961896EF34C940DD42BFD7375FB81705F2881E5E509A99C0E7B41A805B41

Function 0089B8A3 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 0089BE3D

Strings

jjjj, xrefs: 0089BE2E

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 9e5ea8e323a16d38abe5f09f51a2b246070780c19cec1e0154d0e243c047ac8b
Instruction ID: 919dd2b8394da8eedf3f5fc6f42eaea8b5730ac6e744a6ba65d821d88e3746f7
Opcode Fuzzy Hash: 9e5ea8e323a16d38abe5f09f51a2b246070780c19cec1e0154d0e243c047ac8b
Instruction Fuzzy Hash: 49018471A4421D9ADB34CA50DD42BE9B778FB04700F2841E6E909E6680D3755B809F91

Function 0089A9FC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 0089BE3D

Strings

jjjj, xrefs: 0089BE2E

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: e84534659dc528a21b8cc372649596e82f120c6d65e9462b429148fe5c93b6bd
Instruction ID: d6e59648bde95957db18d5999182ea822c33def88c9ba67e6a2252df71e7949d
Opcode Fuzzy Hash: e84534659dc528a21b8cc372649596e82f120c6d65e9462b429148fe5c93b6bd
Instruction Fuzzy Hash: 24012632F052189AFB348901CD05FFDB365FB80704F6841E5E509AB5C0D7F41B809E81

Function 0089B2B2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 0089BE3D

Strings

jjjj, xrefs: 0089BE2E

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 70634f26b1ae7896aab81c46e35f1fe2971a447744ae8384650db3339f45d4e5
Instruction ID: ebe8a5d667e1cfc1aadcc70ac5b370de028c0776ab7b5f9ded4cf68ff5f601f5
Opcode Fuzzy Hash: 70634f26b1ae7896aab81c46e35f1fe2971a447744ae8384650db3339f45d4e5
Instruction Fuzzy Hash: 79012670B092489AEB34CA40CC42FFD7374FB81705F2C81E9E60AAA5C1D7B11A809B81

Function 3BEBA09D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 3BEBA0FB

Strings

Qh?, xrefs: 3BEBA0E7

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: 16f2fb86c47d75584d352aa26e954248e87630d4248e3aa84dc9d8df5d958252
Instruction ID: cb1ac7982a225f6c2d093b830e28f6e30e47912af347b0d63084fc52948eccf8
Opcode Fuzzy Hash: 16f2fb86c47d75584d352aa26e954248e87630d4248e3aa84dc9d8df5d958252
Instruction Fuzzy Hash: D6F081F5C18318AEEF24CB18CD54AFA7A78EF40700F40A1EAA88A65540DE745FC18F13

Function 008EA09D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 008EA0FB

Strings

Qh?, xrefs: 008EA0E7

Memory Dump Source

Source File: 00000000.00000002.2199701952.00000000008E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_AdobePDF.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: 16f2fb86c47d75584d352aa26e954248e87630d4248e3aa84dc9d8df5d958252
Instruction ID: 5a0cbcc395e2f4c2f7b4afeae50174d4673306b59e579634120c36f7d53a5a89
Opcode Fuzzy Hash: 16f2fb86c47d75584d352aa26e954248e87630d4248e3aa84dc9d8df5d958252
Instruction Fuzzy Hash: 68F0A4B5C1065CEEE7288A15CC04BFA7678FF41B04F1091EAA48B95541E6746FC1DF23

Function 3BEB9CD9 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 38registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 3BEBA0FB

Strings

Qh?, xrefs: 3BEBA0E7

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: aa7d00d81ec189bd87bcce02e013ad21ecad6f15d85b88b15f178ff42c514edf
Instruction ID: eaf8d74ccbeabaddc0d390f039fcb25ea9f2f24b6f7f275583a6253563d18451
Opcode Fuzzy Hash: aa7d00d81ec189bd87bcce02e013ad21ecad6f15d85b88b15f178ff42c514edf
Instruction Fuzzy Hash: A1F081F5914358AEEF15CB14CC44BFEBA78EF40700F40A5AAA489A6540DA755FC5CE12

Function 0089B2CC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 0089BE3D

Strings

jjjj, xrefs: 0089BE2E

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 6840c7b78c91cc49818bcc54ba458770c795cccbbb4a63c346a1c11938a36e1b
Instruction ID: 4a7657b60dcf6729ce62f26631186bbe4d742161a17d6c447d149afc6bb1bcbf
Opcode Fuzzy Hash: 6840c7b78c91cc49818bcc54ba458770c795cccbbb4a63c346a1c11938a36e1b
Instruction Fuzzy Hash: 43F06271B4565C96EB34C941DD46FECB364FB41705F2881D9E609A95C0E7B01A809B81

Function 3BEBA0AB Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 3BEBA0FB

Strings

Qh?, xrefs: 3BEBA0E7

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: 4797f77d120bcea430a4ea180c78827df8a4a51a82db65e2143518f6d2acc2a5
Instruction ID: 23bba6e35871c84b725ad3d7857fa60d0d1a9c9a98ef8053f2b792cb68379709
Opcode Fuzzy Hash: 4797f77d120bcea430a4ea180c78827df8a4a51a82db65e2143518f6d2acc2a5
Instruction Fuzzy Hash: BCF03CB5814318AEEF29CF18CC44AFA7B78EF40701F40A1DAA98A65540DE755F85CF12

Function 3BEB8D36 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35COMMON

Download Yara Rule

Strings

Qh?, xrefs: 3BEBA0E7

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: eea14d86ca8880136b55622ad33732fe315635168edc1a1ba26f3762c0602ce5
Instruction ID: 1800ff0ceb93f86a16d5a3a1738e352ad388bb80bd430819feca994ead1a5723
Opcode Fuzzy Hash: eea14d86ca8880136b55622ad33732fe315635168edc1a1ba26f3762c0602ce5
Instruction Fuzzy Hash: CEF0AFE1808348AEEF54CB24DC44BAA3E64EF50B00F40A19AD58914481EE744AC5CE23

Function 008EA0AB Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 008EA0FB

Strings

Qh?, xrefs: 008EA0E7

Memory Dump Source

Source File: 00000000.00000002.2199701952.00000000008E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_AdobePDF.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: 4797f77d120bcea430a4ea180c78827df8a4a51a82db65e2143518f6d2acc2a5
Instruction ID: d60796f0bf8cb1517aeaacc1c18164e893a88a57374b95f1d47834bf5786d567
Opcode Fuzzy Hash: 4797f77d120bcea430a4ea180c78827df8a4a51a82db65e2143518f6d2acc2a5
Instruction Fuzzy Hash: 3EF0AFB5800258EED72C8A15CC44BFA7774FF41B00F0091DAA48B91540D6716FC4DF13

Function 3BEB9BA0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 3BEBA0FB

Strings

Qh?, xrefs: 3BEBA0E7

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: 0da8e396d210691994c2e90656efe39bcbe6442fd234bd89f04e4363b2550418
Instruction ID: b8810f29cf0d7157060cc10a395f61ccc2a6522cd1a5841d01b6221bda0d40a0
Opcode Fuzzy Hash: 0da8e396d210691994c2e90656efe39bcbe6442fd234bd89f04e4363b2550418
Instruction Fuzzy Hash: 48F04FF5D14318AEEF25CB14CC44AEABAB4EF84700F40A2AAA98965540EA755F85CE12

Function 0089B8E9 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 0089BE3D

Strings

jjjj, xrefs: 0089BE2E

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 779d8010a804dd515a025a59d640c0ab89725a1a6ec7f095d3abcb0305f164e7
Instruction ID: 6d7a9e260cf7bc12c33183dcb0af99ecc642ca4cdc479b35b9b4796c7a527c8d
Opcode Fuzzy Hash: 779d8010a804dd515a025a59d640c0ab89725a1a6ec7f095d3abcb0305f164e7
Instruction Fuzzy Hash: B7F04470B4421D9ADF34CA40CC41FEDB774FB44701F2441D9EA09A6580D7715F409F94

Function 3BEBA0B4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 3BEBA0FB

Strings

Qh?, xrefs: 3BEBA0E7

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: ee6cdc6fa1045018a9f7885b9809f726e9f942854c9b775476831f21130f4635
Instruction ID: dfac78bf89a150c9129d2feff3881352d7109a0a4cfaa18bc6707abfd57f089b
Opcode Fuzzy Hash: ee6cdc6fa1045018a9f7885b9809f726e9f942854c9b775476831f21130f4635
Instruction Fuzzy Hash: 6BF049F581431CAEEF25CB18CC40AFABAB8EF40701F40A2DAA48961540DA755F80CE12

Function 008EA0B4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 008EA0FB

Strings

Qh?, xrefs: 008EA0E7

Memory Dump Source

Source File: 00000000.00000002.2199701952.00000000008E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_AdobePDF.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: ee6cdc6fa1045018a9f7885b9809f726e9f942854c9b775476831f21130f4635
Instruction ID: e980ab7a6d1de67ff4feabf3317f57c2d632b803f9dc92e52b68db436d81a907
Opcode Fuzzy Hash: ee6cdc6fa1045018a9f7885b9809f726e9f942854c9b775476831f21130f4635
Instruction Fuzzy Hash: E3F06DB5C10258AEE7298A15CC44AFAB678FF41B01F4092DAA48AA1540E6756FC4CF12

Function 3BEB9BD2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 3BEBA0FB

Strings

Qh?, xrefs: 3BEBA0E7

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: d99a864e144566c439742d7ac9f73c60f77b21b85667bbf3f7e558ad0b62cdc7
Instruction ID: 67b5797c7db6363d00f0f14ba34d8c1f85f957dec82e5edf8b84223dd5f90685
Opcode Fuzzy Hash: d99a864e144566c439742d7ac9f73c60f77b21b85667bbf3f7e558ad0b62cdc7
Instruction Fuzzy Hash: 20F01DF591431CAEEF25CB14CC44BFABAB8EF44700F40A2DAA58965540DA755F85CF12

Function 3BEB95C1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 3BEBA0FB

Strings

Qh?, xrefs: 3BEBA0E7

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: 665f146a684a2591f8f3a9a9f039a0c2e2d969dd48a818ec78092ec9fedefca4
Instruction ID: 068737e0b24e00ff50907a552ebe3528a0b6e08fa0b7c6c0b4d933f20b86748c
Opcode Fuzzy Hash: 665f146a684a2591f8f3a9a9f039a0c2e2d969dd48a818ec78092ec9fedefca4
Instruction Fuzzy Hash: 75F082F5904318ADFF14CB14DD04BFE7A74DF40700F40A2AAE189144809A745FC5CE13

Function 3BEB8D4C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 3BEBA0FB

Strings

Qh?, xrefs: 3BEBA0E7

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: 805d408ccdf3c82228bd8776d5eddff33284df6a6d235308b070bd827510ef29
Instruction ID: 31d59b04086d972770f867ea0dfe582b24493c3882c145c1628fde32753515de
Opcode Fuzzy Hash: 805d408ccdf3c82228bd8776d5eddff33284df6a6d235308b070bd827510ef29
Instruction Fuzzy Hash: 77F082F5808318ADFF14CB14DC04BFA7A74DF40700F40A2AAE189144809E745FC5CE13

Function 3BEC5D53 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 3BEC5DA9

Strings

P@65, xrefs: 3BEC5D54

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID: P@65
API String ID: 2738559852-1165756456
Opcode ID: b026a87512f5465d5cd140d5b333ca79d552e11c47dd94f92bf6601c36060fbe
Instruction ID: 6c2c196a23940e26bb4818d726ba06b07e22efbe2198182507d8eede84fcfeb6
Opcode Fuzzy Hash: b026a87512f5465d5cd140d5b333ca79d552e11c47dd94f92bf6601c36060fbe
Instruction Fuzzy Hash: 10F08275D457298BE724CE04DD84BDFF3B5AB88745F0081E9E80DA7200DA715ED08F81

Function 3BEC5267 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 3BEC5DA9

Strings

8G2D, xrefs: 3BEC5267

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID: 8G2D
API String ID: 2738559852-4258219503
Opcode ID: 49260080b530d25edf066e949fa31f889f055353704453b1a5575e106d6df536
Instruction ID: c61ebb63efe67b0ebf37b80bf8ee6bfd7bce813901015f351dc1e34a076476ec
Opcode Fuzzy Hash: 49260080b530d25edf066e949fa31f889f055353704453b1a5575e106d6df536
Instruction Fuzzy Hash: C8E01A71A453189BF720CE48CD85BDFB7F9BB88B09F1082D9E50CE6140EA319A908B91

Function 00546880 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00546BBA

Strings

@7@:, xrefs: 00546937

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: @7@:
API String ID: 4275171209-2902581891
Opcode ID: a281decdbc1ef60d1bcf704059be086208a4271f60b5a3f17bb634401339e879
Instruction ID: e63054a0582db16fa87fae7b91436714afcc4da6379ac6ae1e97b401ac532b56
Opcode Fuzzy Hash: a281decdbc1ef60d1bcf704059be086208a4271f60b5a3f17bb634401339e879
Instruction Fuzzy Hash: 3A31EFB1D051649FE710CA10CC84BEA7BB5FFC2309F14C4FAD8496B285D6395E868FA2

Function 00895642 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

M3HI, xrefs: 00895642

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: M3HI
API String ID: 4275171209-1505179660
Opcode ID: aaeb17e6b2f8533bad25e1fce4f4af2e064babcdd19e3efd74f6016498aec9bf
Instruction ID: 165706c35231a5df39d44a46b3afebeb9d1eabb429148859e1a596e8871d9dd3
Opcode Fuzzy Hash: aaeb17e6b2f8533bad25e1fce4f4af2e064babcdd19e3efd74f6016498aec9bf
Instruction Fuzzy Hash: C231E2B19005199EEF25AA10CC587EAB775FB81319F2840EED10ED6181E7B80ED5CF12

Function 0089565F Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

5IDD, xrefs: 0089565F

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: 5IDD
API String ID: 4275171209-2086563400
Opcode ID: 3913714fbfc300ba91229a2dcbf09d1c8f0ac023df71876ab593a30ab23e52a1
Instruction ID: 8f35bc0b4c53da8d2f865ae00d96e482a61643248ff94498fd2e6b3350fd482a
Opcode Fuzzy Hash: 3913714fbfc300ba91229a2dcbf09d1c8f0ac023df71876ab593a30ab23e52a1
Instruction Fuzzy Hash: 9331E3709046599FEF35AA50CC587EA77B5FB41319F2800EAD00AD5181E7B80ED5CF12

Function 00896642 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00896AF4

Strings

P?O6, xrefs: 00896643

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: P?O6
API String ID: 4275171209-2099622976
Opcode ID: 4520258b1aab29a83e53f34ae7dc110cfa6dc16e8f2a8f4730fa3cf27b6a972c
Instruction ID: 683671c1d9b6387accb5d1db426b3eadd398e65ec3283d2ad1bb9650b267b562
Opcode Fuzzy Hash: 4520258b1aab29a83e53f34ae7dc110cfa6dc16e8f2a8f4730fa3cf27b6a972c
Instruction Fuzzy Hash: F72171B0A045699FEF31AA14DC48BEAB7B5FB81319F2841E9D40DE6180E7790ED5CF11

Function 00896594 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00896AF4

Strings

EM6^, xrefs: 00896596

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: EM6^
API String ID: 4275171209-4026762246
Opcode ID: 5aee7129e3d90f36188c5794b13980fc991cc71b331e445d9f66b058ad28cb14
Instruction ID: 110a33d859433cbdb1d7ccf339d258665ec9186e7ef4e5839ef6af0e4877dc81
Opcode Fuzzy Hash: 5aee7129e3d90f36188c5794b13980fc991cc71b331e445d9f66b058ad28cb14
Instruction Fuzzy Hash: C7214CB09045299FEF24AA14DC58BEAB7B5FB41319F2801E9D00AE6181E7B91ED4CF11

Function 3BEC56F7 Relevance: 1.8, APIs: 1, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 154bbdbe0896aa84e98682a674c764b959cd4845bf8c97da833bee5e2ea63196
Instruction ID: 89fce2adea4d8279b376a99715dccd6d432012ffd30b05b5e281b5103856cff3
Opcode Fuzzy Hash: 154bbdbe0896aa84e98682a674c764b959cd4845bf8c97da833bee5e2ea63196
Instruction Fuzzy Hash: 738109F2D102155FF7148A14DD85BFB77B9EB80314F1482BAD90D96280E67C5EC18F92

Function 00548A06 Relevance: 1.7, APIs: 1, Instructions: 229memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00548D68

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: f06cffc4548ebeebeaecc282717a4f9b24fd6150206d6321807e80ff7e0921b9
Instruction ID: 2673e868d8cdbc85732c8f6cc1dd295b3cb9aa0c56c91ab49c4fd11079968a5a
Opcode Fuzzy Hash: f06cffc4548ebeebeaecc282717a4f9b24fd6150206d6321807e80ff7e0921b9
Instruction Fuzzy Hash: D47136F2D041689FE714CA14DC94AFF7B79FB81318F1881FAD94A57680DA385E818F92

Function 3BEBEFC7 Relevance: 1.7, APIs: 1, Instructions: 227fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 3BEBFFDF

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 448fbc7bbbf37520996c4ac79a6ae751dab3c0a66d0d8c7d2c3b77ced75d1009
Instruction ID: 13ae408fd5bc32e619acc32e6ccf4bae4b30155d03ea5f2ed22394c6f89454e7
Opcode Fuzzy Hash: 448fbc7bbbf37520996c4ac79a6ae751dab3c0a66d0d8c7d2c3b77ced75d1009
Instruction Fuzzy Hash: DD8125B6D042249FFB24CB18DC95BEBB779EB84318F1481F9E90D57281D6385EC28E91

Function 0054122C Relevance: 1.7, APIs: 1, Instructions: 214COMMON

Download Yara Rule

APIs

K32GetPerformanceInfo.KERNEL32(?,00000038), ref: 00541FDB

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: InfoPerformance
String ID:
API String ID: 3070290716-0
Opcode ID: 66db2fd7d8560504131b1210d7cf6d2f26c934d3399b2fe85552ebff63edb38a
Instruction ID: bbf921ee582a9f2d0934f6865c60331b9a537dae2e7e8efd853446c97c3e2dea
Opcode Fuzzy Hash: 66db2fd7d8560504131b1210d7cf6d2f26c934d3399b2fe85552ebff63edb38a
Instruction Fuzzy Hash: 3781C471D046188BEB24CB24CD94BEEBF75FB41315F1482A9D80DA7644C638ABC1CF55

Function 3BEC54A5 Relevance: 1.7, APIs: 1, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 6dc36f09f61b9b0e4138b36efc47e182a1d24234fb390bcbf9444894c8b14a23
Instruction ID: b4bb4b42583b6c9792f3a3304de5728bd421d3a925b61416a75a06feaf3a0c2a
Opcode Fuzzy Hash: 6dc36f09f61b9b0e4138b36efc47e182a1d24234fb390bcbf9444894c8b14a23
Instruction Fuzzy Hash: 266109F2D102195AF7248A18DD45BFB76B9EBC0314F0482BAD90D96680EA7C5FC1CF92

Function 00547662 Relevance: 1.7, APIs: 1, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 432bcbe4fcfccd2a9311ffc963c6e47ba841499f3f533c5a611c04326f29994f
Instruction ID: 043a8f891fe602f778c2043d8da32fd8cad315076a950ba7974103348e4fa192
Opcode Fuzzy Hash: 432bcbe4fcfccd2a9311ffc963c6e47ba841499f3f533c5a611c04326f29994f
Instruction Fuzzy Hash: A76115B2D086189EE720CA25DC98BFABB75FF94314F1480BED90D56681E6781EC5CF01

Function 3BEBFA44 Relevance: 1.7, APIs: 1, Instructions: 174fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 3BEBFFDF

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 0207e1c8ba9895d34605f527f1132f0ae60f947e87d2d8b5e7840e1a364c8902
Instruction ID: f8305a0a317c7926a950771f3ae16bb063bd774c6d8a0c639c81ef474497c207
Opcode Fuzzy Hash: 0207e1c8ba9895d34605f527f1132f0ae60f947e87d2d8b5e7840e1a364c8902
Instruction Fuzzy Hash: 9D5146F2E042159FF714CA18DC95BEBB778EB91315F1042BAD90D67680D6785EC18E82

Function 00547692 Relevance: 1.7, APIs: 1, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a0fe7db5d87114f430d5ea95307ef949ef19ab00eb2ee6e52caa221928509414
Instruction ID: 940b31fc76206a56ddd94d798b995246e57576849bc5daa2f673020583b054b1
Opcode Fuzzy Hash: a0fe7db5d87114f430d5ea95307ef949ef19ab00eb2ee6e52caa221928509414
Instruction Fuzzy Hash: 3D5126B2D186599EE7208A29DC887FEBB75FF94318F1440BAD50D66681E6781EC1CF01

Function 3BEB789F Relevance: 1.7, APIs: 1, Instructions: 152COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: c17c141243d89632c5bca43b2e2e20771c91457c21adc2697668b466b66bb401
Instruction ID: 62912dd39462c0eb0592d4c722d3d74cfd29cfceb8e9bae7a2abc2c540922965
Opcode Fuzzy Hash: c17c141243d89632c5bca43b2e2e20771c91457c21adc2697668b466b66bb401
Instruction Fuzzy Hash: 0F51BFF1C042599FEB14CB14CC91BEA7778EB44310F1881FADA0DA6741D678AFD68EA1

Function 008E789F Relevance: 1.7, APIs: 1, Instructions: 152COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 008E7CFA

Memory Dump Source

Source File: 00000000.00000002.2199701952.00000000008E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: c17c141243d89632c5bca43b2e2e20771c91457c21adc2697668b466b66bb401
Instruction ID: f2f743ac57ef3643a17245feaf858e74055858870c713f9a2bcfb941e72f7852
Opcode Fuzzy Hash: c17c141243d89632c5bca43b2e2e20771c91457c21adc2697668b466b66bb401
Instruction Fuzzy Hash: 7251BFF1C042689FE714CB04CC91BFA7778FB45304F1881FADA0AA6242D6789FC68E51

Function 3BEB648F Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 22943def984b4749cdea510464161d28ad266ab27ff147a3e70ae6b860567494
Instruction ID: 81c42a6eaa7349d4e4273811e4c21b728476dcedd32fbc5ea691ca2d79bb3630
Opcode Fuzzy Hash: 22943def984b4749cdea510464161d28ad266ab27ff147a3e70ae6b860567494
Instruction Fuzzy Hash: 4F5157F2C19264AFFB148B24DC95BE6BB78EB84314F0440FED94E56681DA3C5EC18E52

Function 3BEB7763 Relevance: 1.6, APIs: 1, Instructions: 139COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: de270df7bd2d4b369acf6de477585933080516950fd91f9b6f0367c404a6f921
Instruction ID: 83ad544c01c27f8cfe4200b0cdc6e56ac23a56ea7553564a0ad4ad93aee20ad7
Opcode Fuzzy Hash: de270df7bd2d4b369acf6de477585933080516950fd91f9b6f0367c404a6f921
Instruction Fuzzy Hash: 7F51C5F1C052659FEB20CB18DC91AEA7B68EB44314F0481FAD84DA6741DA385EC5CF92

Function 3BEB762F Relevance: 1.6, APIs: 1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79ddfe5d1ae99cb9a9be34841f77cf07603370bf85bf465d4c0631434ca4da30
Instruction ID: 66199694955fc5adace489389d98ca16f4cec4cadf2fefb3cdc979795f692fb2
Opcode Fuzzy Hash: 79ddfe5d1ae99cb9a9be34841f77cf07603370bf85bf465d4c0631434ca4da30
Instruction Fuzzy Hash: 714129F2C092685FEB20CB58DC91BDB7B74DF41314F0541BAD98C66641E6385EC68A92

Function 3BEC562A Relevance: 1.6, APIs: 1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: c3c8ab112b453ecbf5ea80bbcc2006df0fe61ad9ea1939e6f0a169d5a99f2cce
Instruction ID: 2d03abd3aa1ec70b007c8f7e73f93ef6d05e13f67ff571165800b6adabf6a3aa
Opcode Fuzzy Hash: c3c8ab112b453ecbf5ea80bbcc2006df0fe61ad9ea1939e6f0a169d5a99f2cce
Instruction Fuzzy Hash: F4410BF2D143159FF3208914DD89BEB76B9E781724F1482FADD0C56280DA794EC1CA92

Function 3BEC55A7 Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 0260ac7a12b8da3f03b3ea55001efad2f778feba14eb989b932dcc9031ed6b0f
Instruction ID: fd9152a6ede2524db62f13a4461569fec892c2ef504545165d339c1b13ec05a9
Opcode Fuzzy Hash: 0260ac7a12b8da3f03b3ea55001efad2f778feba14eb989b932dcc9031ed6b0f
Instruction Fuzzy Hash: F7412DF3D143159FF3248A19DD89BEB76B9EB80714F0441BADD0D56280E67D4EC1CA92

Function 3BEB72A2 Relevance: 1.6, APIs: 1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49cf5d8e988ad70f2551776466fedb5aaa04893754d50f5256e89e92a64829e0
Instruction ID: fc0e32942d9df353ba019ae86e3c35e05334623341c2790343ac74bd99cb8b06
Opcode Fuzzy Hash: 49cf5d8e988ad70f2551776466fedb5aaa04893754d50f5256e89e92a64829e0
Instruction Fuzzy Hash: A74119F2C093685FFB20CB58DC84ADB7B78DB42704F0541BAD98C66B41D5384EC6CA92

Function 00541112 Relevance: 1.6, APIs: 1, Instructions: 128COMMON

Download Yara Rule

APIs

K32GetPerformanceInfo.KERNEL32(?,00000038), ref: 00541FDB

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: InfoPerformance
String ID:
API String ID: 3070290716-0
Opcode ID: eab8fc66906546019ae276725d91048389f8147c6f1130660f6595b0227e8ea9
Instruction ID: 779d507799ec980ca8df1e6e6593a8c48cba0da00ee3335ee99d3b7f2f7dd561
Opcode Fuzzy Hash: eab8fc66906546019ae276725d91048389f8147c6f1130660f6595b0227e8ea9
Instruction Fuzzy Hash: DC51AE71A046288BDB28CF28CD88BEABB75FB85304F1081EAD50E66644C634AEC1CF45

Function 3BEB759C Relevance: 1.6, APIs: 1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8f8330ff5f79ff84ff696969fa5b217d43685b9c9ccd7b2dd62515f2e38bf2e
Instruction ID: 9462e69b4cfe799c1f484d5aee9045b571d4fd55884090f60cb9281716a5d8ee
Opcode Fuzzy Hash: c8f8330ff5f79ff84ff696969fa5b217d43685b9c9ccd7b2dd62515f2e38bf2e
Instruction Fuzzy Hash: 4C41E7F1C093689FEB20CB58DC50AEA7B749F45715F0541FAD88C66741DA388EC5CB92

Function 3BEBEF1D Relevance: 1.6, APIs: 1, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 3BEBFFDF

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ed6f68940b5903b9a17427009fd8e135ecbdf3ca8486a0b2450f2564fbc617c9
Instruction ID: 1d2e3f7d3c0046845e6d2d96e0649de3158b4ac47dbe0b90b86cfa893ba123ca
Opcode Fuzzy Hash: ed6f68940b5903b9a17427009fd8e135ecbdf3ca8486a0b2450f2564fbc617c9
Instruction Fuzzy Hash: C14180F2D053155BF7288628DCC9FEB7728E740729F0442BAE90DA51C0DA7D4BD18E92

Function 3BEC5643 Relevance: 1.6, APIs: 1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 166d84b7039606cce79c7a785697705e7764e9df5fc9b977d17da093553ccfad
Instruction ID: 8cf818b2ba2a80b6e853cdf9e171dd1e48ccd07db704b95c9909f07e0bbafb65
Opcode Fuzzy Hash: 166d84b7039606cce79c7a785697705e7764e9df5fc9b977d17da093553ccfad
Instruction Fuzzy Hash: 9D410AF2D143159BF3208A18DD89BEB76B9EB81714F1482FAD90C56280DB7D4EC1CA92

Function 0054754B Relevance: 1.6, APIs: 1, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00548D68

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: e93e8602b9d09eaa24bc998d90b8564e186b2126cf0e9b0d75df7acd9a3c97a4
Instruction ID: ce935d3db3fd4be4e30b39b29a5cf97aac9d054caf5ccae7a2358adf1bf47d19
Opcode Fuzzy Hash: e93e8602b9d09eaa24bc998d90b8564e186b2126cf0e9b0d75df7acd9a3c97a4
Instruction Fuzzy Hash: 8F4168B3E056989FF7208615DCC4BEB7B69FBD1318F2940BAD88D16180D63C4EC18B91

Function 3BEB66B8 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 46cf632d203e8cd23bf5353f2c7e549a20bad2b8bcf745159d0d7278d5142f2b
Instruction ID: 628b955bc9c09cbf67bee9d1d00ca3f893cf45c8c9874cea25f3e6a9c2442861
Opcode Fuzzy Hash: 46cf632d203e8cd23bf5353f2c7e549a20bad2b8bcf745159d0d7278d5142f2b
Instruction Fuzzy Hash: E241E5A5D1D3A89EEF24CB28DC447EABB74EF85714F1081EAD44D96255DA380EC1CF12

Function 00541BC3 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: InfoPerformance
String ID:
API String ID: 3070290716-0
Opcode ID: 01532963112f6c93a6a1e5fdb1873c5799f3ea1270b26c7ceb75a75b5b850c11
Instruction ID: 021ec91b8e707c063ea25e8237fa53170177e776866b31daf990ec7e9014642e
Opcode Fuzzy Hash: 01532963112f6c93a6a1e5fdb1873c5799f3ea1270b26c7ceb75a75b5b850c11
Instruction Fuzzy Hash: 76514A72E015288BDB24CB28CD98BE9BBB5FB94305F1082E9D80DA7645C634AFC5CF45

Function 3BEB72D7 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: dd41ca2f4b0c7fb0e83873a318c7f655133dce68a4cbe7d849ed1deaffeabdd9
Instruction ID: f24f9b06d42ef5c2745f61ca54362b67d282eda5066b4e66a7a3575761999938
Opcode Fuzzy Hash: dd41ca2f4b0c7fb0e83873a318c7f655133dce68a4cbe7d849ed1deaffeabdd9
Instruction Fuzzy Hash: 66411AF2C093A45FEB20CB58DC84ADB7B789F46704F0541FAD98C66B41D5384EC6CAA2

Function 3BEB7D96 Relevance: 1.6, APIs: 1, Instructions: 111COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,3BEB7703,3BEB73C3,?,?,?,?,?,?,?,?), ref: 3BEB7E45

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 48de234e33b9d92d7dafd543fd4b5963a1eb4849d3d4b5e927810c831e4933f3
Instruction ID: 0bf13ae9a81ad42e486b522962ae177a4aa41465814a5931697483dd793451b8
Opcode Fuzzy Hash: 48de234e33b9d92d7dafd543fd4b5963a1eb4849d3d4b5e927810c831e4933f3
Instruction Fuzzy Hash: 534168B19046198FEB24CF28DC80AAAB776FF84711F1041EBD80DA6740EA399ED5CF51

Function 3BEB72EE Relevance: 1.6, APIs: 1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 48994c0321cd5804a90462c7d819d8a8dc31c4c24744caf832e09ce566417afd
Instruction ID: b1a11e00796aa8f729d74cefcb59c4c169c40efca77e81e46bb064207e34ff2a
Opcode Fuzzy Hash: 48994c0321cd5804a90462c7d819d8a8dc31c4c24744caf832e09ce566417afd
Instruction Fuzzy Hash: 093126F2C093A45FEB20CB58DC80ADB7B749F42314F0541FAD98CA6A41D9348EC5CAA2

Function 3BEBB229 Relevance: 1.6, APIs: 1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: dee5b51a8d31946304e9e6745785cb10370e8c9180f4a4ea5b6ce47603d406e4
Instruction ID: 4e443b1a832d95d2ca286e224f7f4cc7152d02e383eaebfcb5c74ae20ba2895c
Opcode Fuzzy Hash: dee5b51a8d31946304e9e6745785cb10370e8c9180f4a4ea5b6ce47603d406e4
Instruction Fuzzy Hash: 9E3105F3D143159FF3208A18DD89BEB7AB9EB81314F0542FADD0C56680D67D5EC18A92

Function 3BEB75F0 Relevance: 1.6, APIs: 1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 7efe0de4004fca09eb8b8350133f6cdb31ad9e63baeda4bf5f5d8b84aeed2d14
Instruction ID: 49b29cc097f0ed53c9eea5ac5c545b2238839a675e43e5feb53191fea4991298
Opcode Fuzzy Hash: 7efe0de4004fca09eb8b8350133f6cdb31ad9e63baeda4bf5f5d8b84aeed2d14
Instruction Fuzzy Hash: 7C41E7F2C093649FEB20DB58DC506DA7B749F46704F0541FAD98C66B41D9344EC6CB92

Function 3BEC5376 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 9c717ff99189620bb0d91669373df7311c01e3f2672d85510bc23e749a0a9f0a
Instruction ID: 1ac93003d1c117a798e1d97112092fb8827d9f07e7d96211aa3ec562693ffa01
Opcode Fuzzy Hash: 9c717ff99189620bb0d91669373df7311c01e3f2672d85510bc23e749a0a9f0a
Instruction Fuzzy Hash: 1A3106F3D542149BF3208918DD89FEB7AB9EBD1314F0541BAED0C56280E67D5EC18A92

Function 3BEC541A Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 91b7f0cfd6e6778632c4a0493640f2beb1c912ab51a16ca792ee3e91e636a1a5
Instruction ID: 12a4448b2adb9bd5fa151779e0b9f4c7276f64dfeceea8f3ab6687fc689f669f
Opcode Fuzzy Hash: 91b7f0cfd6e6778632c4a0493640f2beb1c912ab51a16ca792ee3e91e636a1a5
Instruction Fuzzy Hash: 513136F3D042149FF3208A18DD89BEB7BB9EB81314F0441FADD0D56280DA7D5EC28A92

Function 3BEC568A Relevance: 1.6, APIs: 1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: b33ad60a93b8723726970dab594f64571a80319b5be96778bb49e798b31c4eae
Instruction ID: 6044ab0b1a33da419adfdaa1d12b104dd3fef7acea3c292eaaaade03460a1b97
Opcode Fuzzy Hash: b33ad60a93b8723726970dab594f64571a80319b5be96778bb49e798b31c4eae
Instruction Fuzzy Hash: F53144F3D442159FF3108A18DC89BEB7BB8EB81314F0442FADD0C56280D6794EC18A92

Function 3BEC5414 Relevance: 1.6, APIs: 1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7cbf9ed9b0556598971011baa83853088ff4d02bf17136a49f052051870be3ee
Instruction ID: fdd9ca55525bc0b7ff196258a57a98a3d17a3810111d1de3cb325f9efe01eda7
Opcode Fuzzy Hash: 7cbf9ed9b0556598971011baa83853088ff4d02bf17136a49f052051870be3ee
Instruction Fuzzy Hash: 533106F3D043149FF3108918DD89BEB76B9EB81714F0441BADD0D56280EA795EC18A92

Function 005413D8 Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

K32GetPerformanceInfo.KERNEL32(?,00000038), ref: 00541FDB

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: InfoPerformance
String ID:
API String ID: 3070290716-0
Opcode ID: e57f17bca775a4cba941344dff07329e8cebe9a660e70891345fe5ee7f9a3899
Instruction ID: 77bb47a0b3041d37c323ba8a946fb85113c76ba581f8ad9308884aee96c87735
Opcode Fuzzy Hash: e57f17bca775a4cba941344dff07329e8cebe9a660e70891345fe5ee7f9a3899
Instruction Fuzzy Hash: 3B414E71D046288BDB24CF28CD98BEABB79FB54344F1081EAD40E66684D6346FC5CF56

Function 3BEB6701 Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 43c0c8d59aa039e76fae9f4bbede326c151c74e910c835137f34a6c3b022f26b
Instruction ID: d5bc930a4a57f7fd6a98c9a487f6c820eb6248e78b767ab6947dc250f1b1e089
Opcode Fuzzy Hash: 43c0c8d59aa039e76fae9f4bbede326c151c74e910c835137f34a6c3b022f26b
Instruction Fuzzy Hash: 9C31F3A1D1D3A89EFF20CB68DC447EABB74EB84710F1081EAD44D56195EA380AC5CF12

Function 00548C09 Relevance: 1.6, APIs: 1, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00548D68

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 7a055f59dd572563da4cfee343eec35629aa6c6565f17d40d66f0e251b5aed5d
Instruction ID: b22fa4607739fbffc3bc056fce19bcda5330741559967292fb40e7f8dd78db90
Opcode Fuzzy Hash: 7a055f59dd572563da4cfee343eec35629aa6c6565f17d40d66f0e251b5aed5d
Instruction Fuzzy Hash: 0A3176B1D052549EFB108A20CCD97FF7AB9FBC1305F2881FAD60A5A584DE384EC28A11

Function 3BEC4570 Relevance: 1.6, APIs: 1, Instructions: 98fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 3BEC5DA9

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 792918b68ad0570aed088b55ae9a05dcb16dc928289881c4a1fd5555ea45542d
Instruction ID: d6b2c699900a76b3e23f08b8e3a130ee686fac8c4cb10f99ea0cd312c41d7555
Opcode Fuzzy Hash: 792918b68ad0570aed088b55ae9a05dcb16dc928289881c4a1fd5555ea45542d
Instruction Fuzzy Hash: 0431F6F2C002149BF3148519DC45BEB7678EB84715F0481BAE90D56684EA7D5ED18A92

Function 00541E9B Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: InfoPerformance
String ID:
API String ID: 3070290716-0
Opcode ID: 8e9242e715e0327d3a372392b7648ff72f67b6afd57d499904267497e88c3b3c
Instruction ID: 83a19b0e2393c7889e0687035f498ac3aec3b9b2254b6605b5b8db3569ca6f81
Opcode Fuzzy Hash: 8e9242e715e0327d3a372392b7648ff72f67b6afd57d499904267497e88c3b3c
Instruction Fuzzy Hash: 0C418B71915A588FCB29CB24CD947EABFB9FB80345F1081EED80DAA245D7346AC6CF04

Function 005477E9 Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 3d5cd673fe1ac5b16fc193afb21d8813b415ec79c06e9627c6725af9fe42573a
Instruction ID: 2b59b97096271c9cb8a716df5703201786a864b496eb3c14ba975d341e4dffbd
Opcode Fuzzy Hash: 3d5cd673fe1ac5b16fc193afb21d8813b415ec79c06e9627c6725af9fe42573a
Instruction Fuzzy Hash: DC3108B2D0921DDEFB248A65DC887FFBA74FB94318F1440BBD50A66680E7780EC0DA11

Function 3BEB76DF Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 23c7471dde136f9756eb8fcf5e87ffcf6a2163e7c5bc3c4fe6d2e3ae23ac423e
Instruction ID: c964936d330becc2cc69c383c6a200382053f97a98b68dcb21edc71f9855ba82
Opcode Fuzzy Hash: 23c7471dde136f9756eb8fcf5e87ffcf6a2163e7c5bc3c4fe6d2e3ae23ac423e
Instruction Fuzzy Hash: 0831E7F1C093A85FEB20DB58DC80ADA7B749F45704F0581FAD98C66745DA344EC6CB92

Function 3BEBEEA8 Relevance: 1.6, APIs: 1, Instructions: 87fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 3BEBFFDF

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 16cc02e03bacd042b0960f71c8c26008a750402e3b2476e7af989659fe7f606e
Instruction ID: 66c63dad571616e44e6f6618c24cfd4c0a533a25f1b3aad921fc30725a8aff02
Opcode Fuzzy Hash: 16cc02e03bacd042b0960f71c8c26008a750402e3b2476e7af989659fe7f606e
Instruction Fuzzy Hash: B8210CB2D443246AF7288614DC95BE77768E744728F1442BAE50E251C0EE7D5BD18D82

Function 00541B1B Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

K32GetPerformanceInfo.KERNEL32(?,00000038), ref: 00541FDB

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: InfoPerformance
String ID:
API String ID: 3070290716-0
Opcode ID: 3295b77c102e5479a205250b9385847f25fa995a10d7d466d9be68d33d5e37ee
Instruction ID: 50dfcfc905e5a78e2708e0088d2543a85495eef5ef2a4e8618c250b7029086d5
Opcode Fuzzy Hash: 3295b77c102e5479a205250b9385847f25fa995a10d7d466d9be68d33d5e37ee
Instruction Fuzzy Hash: 00318DB2D116248BE728CB14CD95BEABBB9FB90301F14C1EAD40D6A684D634AFC5CF41

Function 3BEBF3C3 Relevance: 1.6, APIs: 1, Instructions: 84fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 3BEBFFDF

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 88a8fdf1158f9b6ef6308e2631de6be0c7a09fbfb5a741af9c738e36ac2f5a93
Instruction ID: 5799e9d9f1cd245e6ade3160626568e5cfabe39d6cbb27b1c86e2b9a9ed2b826
Opcode Fuzzy Hash: 88a8fdf1158f9b6ef6308e2631de6be0c7a09fbfb5a741af9c738e36ac2f5a93
Instruction Fuzzy Hash: E2213BB2D04324ABF7288614DC95BEBB768E744724F1442FEF50E661C0EE781BD18E82

Function 00540F37 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

K32GetPerformanceInfo.KERNEL32(?,00000038), ref: 00541FDB

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: InfoPerformance
String ID:
API String ID: 3070290716-0
Opcode ID: 419ba04ed0065d64b02fbc22af5ffb7f69c5872622f70732a00a2d4c97e46059
Instruction ID: 43ba64220a5e7d4a74e24de11ba85edbd874d1409af0dcccf03266fb27887a63
Opcode Fuzzy Hash: 419ba04ed0065d64b02fbc22af5ffb7f69c5872622f70732a00a2d4c97e46059
Instruction Fuzzy Hash: 3E315E729057188BDB28CF28CD94BE9FB79FB54345F1081EA980EA6644D634AFC4CF46

Function 00540FF5 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

K32GetPerformanceInfo.KERNEL32(?,00000038), ref: 00541FDB

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: InfoPerformance
String ID:
API String ID: 3070290716-0
Opcode ID: 293e5aac52db295fbc69209f7d8fbe0757cb4bc1509d3be12168b1c1035ebe18
Instruction ID: 547859ae92dd60aa9260141a7204dd7f75237448dce3ff50264829e9f5bed53d
Opcode Fuzzy Hash: 293e5aac52db295fbc69209f7d8fbe0757cb4bc1509d3be12168b1c1035ebe18
Instruction Fuzzy Hash: 1D314F71D046288BDB24CE28CD84BE9BBB9FB54345F1081EA980DA6644D634AFC4CF55

Function 008ADA38 Relevance: 1.6, APIs: 1, Instructions: 81injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 008AE04F

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: ffccea0f8e69733767f0ed6fe3c5523e6445841803b7aa0af89f05133ee1c723
Instruction ID: e18c220db9c45201e4f681371981bfb49bc46400edbc78866da837d176e7cd4f
Opcode Fuzzy Hash: ffccea0f8e69733767f0ed6fe3c5523e6445841803b7aa0af89f05133ee1c723
Instruction Fuzzy Hash: 2521D6B2E0916C9FE724CA15DC40AEBB7B9FB85314F1081EAD50ED7941E6342E82CE52

Function 00541EF9 Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: InfoPerformance
String ID:
API String ID: 3070290716-0
Opcode ID: 828a1af6cd9bd161917df4452a965fc8fc13873e74504190283ac943f38f3123
Instruction ID: c6165e997f2481f49cd0cf3cc1a041d5428464cb2b6b904b44da257cae0a8208
Opcode Fuzzy Hash: 828a1af6cd9bd161917df4452a965fc8fc13873e74504190283ac943f38f3123
Instruction Fuzzy Hash: 3C318D71D05A688BDB29CF24CD987E9BFB5BB54305F1082DED40EAA285D7306AC6CF04

Function 3BEB67DC Relevance: 1.6, APIs: 1, Instructions: 79COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 014142690a51cfb8258c38911791845c451d488647bb2735937fc00838c0971c
Instruction ID: 63daa760c185d39baaabfa75d264170bcc8a642af7c9c10cacc09b6f23bb2032
Opcode Fuzzy Hash: 014142690a51cfb8258c38911791845c451d488647bb2735937fc00838c0971c
Instruction Fuzzy Hash: 4621F3B1D0A3599EFF248B68DC44BAABB74EB85720F1081FAD44D55586E9380BC68F12

Function 3BEBFECC Relevance: 1.6, APIs: 1, Instructions: 77fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 3BEBFFDF

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b0a4904acb5ebe495f3b9491dee742ed392bd6b4dd9fbffc607a4328077eb79d
Instruction ID: 7619c1b474359aa83b3ec4cf96f8cc3a51d9f8568498716bf088963790abe91a
Opcode Fuzzy Hash: b0a4904acb5ebe495f3b9491dee742ed392bd6b4dd9fbffc607a4328077eb79d
Instruction Fuzzy Hash: 6F216AB1D4431A9EFB30C654ECD5BEBB7A4E701715F1083F9E959251C0CA780EC28E81

Function 3BEB6586 Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 9a0c4664ee44f037e7e1ec4fb55dc2abc9cceb5c19d8b236ffe2716a0e969c31
Instruction ID: 17b578e1904ea0276565ccba53c521231ef024a0dd56c4d0c3b2c35ebe087897
Opcode Fuzzy Hash: 9a0c4664ee44f037e7e1ec4fb55dc2abc9cceb5c19d8b236ffe2716a0e969c31
Instruction Fuzzy Hash: 8C2144B1C0D3949FEF148B64DC587A5BB78EB05314F1144DFC58E96182DA380AC1CF42

Function 3BEB770C Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 772e49b6f2a94eac37bbc9b07aa8315b4ac42801ac8b29a76241099e30e1d045
Instruction ID: aa10538b34c1c661492b83023c86958130e2b4def69998c03fed844d5a1250e3
Opcode Fuzzy Hash: 772e49b6f2a94eac37bbc9b07aa8315b4ac42801ac8b29a76241099e30e1d045
Instruction Fuzzy Hash: 6E21E5F1C093B89FEB20DB58CC806DA7B749F85704F1581FAD88C66655DA344EC6CB92

Function 00541F40 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: InfoPerformance
String ID:
API String ID: 3070290716-0
Opcode ID: bc575ed9843f92030097b587413c541b4c0acbefa72511a3fc88b7fe0ad37e9b
Instruction ID: 27083a1483f11fcb8210d3c26ac0a5184a0db1e5b29f0fbb95e92adc443113bd
Opcode Fuzzy Hash: bc575ed9843f92030097b587413c541b4c0acbefa72511a3fc88b7fe0ad37e9b
Instruction Fuzzy Hash: E8316B719146288BDB68CF24CD987E9BFB4FB50304F1082EE940EAA284D734ABC58F45

Function 3BEBF413 Relevance: 1.6, APIs: 1, Instructions: 72fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 3BEBFFDF

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 82c49bd3fcc2810f4499da027e02ddd2662c198e14416363311eff8696f22350
Instruction ID: 7d410e55ee81d2dcde368965270c23ff680fe3d7f6fe5128c1bb3cb82eb5e22c
Opcode Fuzzy Hash: 82c49bd3fcc2810f4499da027e02ddd2662c198e14416363311eff8696f22350
Instruction Fuzzy Hash: 47215CB2D043246BF7288614DC5AFEB7768E704728F0443BEF50E661C0EE780AD18E92

Function 3BEBFEE8 Relevance: 1.6, APIs: 1, Instructions: 70fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 3BEBFFDF

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5bab3415f7013527199010557ae4539b1f906dab9df2abb5fa46f05cb91d432c
Instruction ID: 016bce4ac4fa578a14deae7f3247ac99d7b664ac161ce9ec6da83ab3a9ce2669
Opcode Fuzzy Hash: 5bab3415f7013527199010557ae4539b1f906dab9df2abb5fa46f05cb91d432c
Instruction Fuzzy Hash: BF2138B0D4531A9EF730CA54DCD5BEBB7A4E701719F1082F5E959651C0DA790AC28F81

Function 3BEB7BE1 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: ce4c98e8994502494c2a81f2a59aaf112a9c61754689ede13511e47f3d563c5e
Instruction ID: bc99a44f3740a9f96e91fbce6dd14f16b1df0214ba0401339380792135616efa
Opcode Fuzzy Hash: ce4c98e8994502494c2a81f2a59aaf112a9c61754689ede13511e47f3d563c5e
Instruction Fuzzy Hash: 4821D6B0C087989FEB21CB54CDC07D97BB4EB45314F1491DAC84D66646EA384FC58F42

Function 3BEB771B Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 082da9981b512a71b572943eea41a15821c00543735791e0b7aa44e5cd38dafc
Instruction ID: 8594fb22ee07907451a5a8957f0716c98cf5beb5617c5139774aeac87726a3b1
Opcode Fuzzy Hash: 082da9981b512a71b572943eea41a15821c00543735791e0b7aa44e5cd38dafc
Instruction Fuzzy Hash: 9621B2F1C092B89FEB20DB58CC806DABB749F45301F1581FA998C66655DA344EC6CB91

Function 3BEBFF36 Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 3BEBFFDF

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 412b3a0c89312e6c4c8baab647f4918726c6888756c5ed7a4d3b7522a80c9b38
Instruction ID: 8672c55fd8ad3f933a805138efb0800cd04cb1f396b8150669c0f7e1f3981843
Opcode Fuzzy Hash: 412b3a0c89312e6c4c8baab647f4918726c6888756c5ed7a4d3b7522a80c9b38
Instruction Fuzzy Hash: AB115EF1D44319AEF7244A14EDD5BE77768E700714F1042BDE909251C0DABD1ED14E81

Function 3BEB7C02 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 0537f6831ef87b25b34bd2163f3d0d3b27189272a3781a38149688f3a105cca3
Instruction ID: dd63dd764533bcf79234e4b118d1b0ae8167590224fbc425c398a3123947cdd0
Opcode Fuzzy Hash: 0537f6831ef87b25b34bd2163f3d0d3b27189272a3781a38149688f3a105cca3
Instruction Fuzzy Hash: B421C2B0C097989FEB20CB54CD807E97BB4EB45305F1481EAD58965642DA384FC28F42

Function 3BEB77FA Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 2cb3affc2ff4254fecea336572ba4f095d382ef30dcc22da5fe8a5b8d7b92f09
Instruction ID: eb9dc73c3a5552127d9d16d3ddf9f4e05f60624c7dfc9ea487e32d43997fda5b
Opcode Fuzzy Hash: 2cb3affc2ff4254fecea336572ba4f095d382ef30dcc22da5fe8a5b8d7b92f09
Instruction Fuzzy Hash: 1021C9F1C057945FEB11CB24CC41AEA7B78EF45310F0441EAD58D56682D6344EC5CF51

Function 3BEB7738 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 8a3a25a25885ee490f4b3787fbbd16445d61efeef63b0ebf5783f7b653b1c234
Instruction ID: 1e1295b674e33d716efe1ae6599dbfb0135586b9696c21dfdf9dd81b5cb58396
Opcode Fuzzy Hash: 8a3a25a25885ee490f4b3787fbbd16445d61efeef63b0ebf5783f7b653b1c234
Instruction Fuzzy Hash: 6721F6F1C093A89FEB21DB64CC806DA7B74AF45300F1481EAC8CC66656DA344EC6CF51

Function 3BEB7BA9 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 8a83182f55129e42b541a3deee6ec87b93bd2de8058faa5c4ed02755bc0c932a
Instruction ID: 93075da0e0ad5c2b4f381b599c24afb53b09dd2f5f92a14db2cb8957dce3d34a
Opcode Fuzzy Hash: 8a83182f55129e42b541a3deee6ec87b93bd2de8058faa5c4ed02755bc0c932a
Instruction Fuzzy Hash: 6E11AFB0C087A8AFEB20CB18CD907E97BB4EB45305F1440DAD58D66646DA381FC58F02

Function 3BEC57EE Relevance: 1.6, APIs: 1, Instructions: 57fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 3BEC5DA9

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: ce05f57343fb6fb35f3750cd280c89d54947cfdcff4758994c5e5af25b243584
Instruction ID: f8a7b83cc0ea431c3e10b0eddc4c800227f91a71156d08bbedfd86c566c932e9
Opcode Fuzzy Hash: ce05f57343fb6fb35f3750cd280c89d54947cfdcff4758994c5e5af25b243584
Instruction Fuzzy Hash: 591108F2D002199FF714CA08DD89BDBB7B8EB84714F0042F9E90D96240EB355ED08E51

Function 3BEC48F8 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: bfc02db74607a2fad374082bc440882a44fdb18fa3eb009e915cf8e2cbe528fa
Instruction ID: 2a785aeea6b1f142ee41b4fdabbad3fbddee8ad24880823b57442e00eb11deba
Opcode Fuzzy Hash: bfc02db74607a2fad374082bc440882a44fdb18fa3eb009e915cf8e2cbe528fa
Instruction Fuzzy Hash: 9C01D6B2C403195BF7208A08CD49BEBB778EB80710F1082FED50E96140DE745ED58A92

Function 008F48F8 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2199701952.00000000008E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: bfc02db74607a2fad374082bc440882a44fdb18fa3eb009e915cf8e2cbe528fa
Instruction ID: 01ac6b840af7c3cf234fe35b230980817c4432971a92fbf222787bd57ba49e8f
Opcode Fuzzy Hash: bfc02db74607a2fad374082bc440882a44fdb18fa3eb009e915cf8e2cbe528fa
Instruction Fuzzy Hash: 4801D6B1D4411D5BF7208A24DC45BFBB778FB80310F1082FEE609D6150DA755ED58A92

Function 3BEC594E Relevance: 1.5, APIs: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 3BEC5DA9

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 2f0a7b190406e02f7951fdd5666d76d5f632156ab35112b740cbb095b10ba99e
Instruction ID: f2e5b7c45f143c9ab89107150fe6d14b1172c381313c2434df9fc8d9d621f16c
Opcode Fuzzy Hash: 2f0a7b190406e02f7951fdd5666d76d5f632156ab35112b740cbb095b10ba99e
Instruction Fuzzy Hash: 900180B1E002159FF724CA09DD44BEFB7B6EBC8705F0081E9E90C57644DA715AD1CE51

Function 00548CDD Relevance: 1.5, APIs: 1, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00548D68

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 7da9b34da933eb82b3e3d2cccf9ac03f4d69967fdff39dd7e497b7ac494cc5fe
Instruction ID: 04c98986fda7daa310abb878132b9646612bd4ce5c2002ac6166bbaac81e114a
Opcode Fuzzy Hash: 7da9b34da933eb82b3e3d2cccf9ac03f4d69967fdff39dd7e497b7ac494cc5fe
Instruction Fuzzy Hash: 9F0128B1D011599EFB60CA15DC88BFE7AB5FBD4308F1480FAD20D66684EE380EC19B11

Function 005476A3 Relevance: 1.5, APIs: 1, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00548D68

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 3c1b38a25fdc8e2de1be5dce28c0abe0ca5413b6d9da61b2bb6b2dbed020f691
Instruction ID: 372667cc695d65750b9dd8f34a6b2d2ab6715c61892c39b6218722c5dda80af6
Opcode Fuzzy Hash: 3c1b38a25fdc8e2de1be5dce28c0abe0ca5413b6d9da61b2bb6b2dbed020f691
Instruction Fuzzy Hash: 81012BF6D55748AEFB108965DCDD7FF7A68F714308F1400BBD90A251C0AA780FC44A52

Function 3BEBFB36 Relevance: 1.5, APIs: 1, Instructions: 46fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 3BEBFFDF

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 7687c3d5f5e5f32277f93cc1f520861e2e3a8ece9d3ce571f9534e378ed6e36b
Instruction ID: 8d06c94dcaaa7bbaff95de04bc0b6d066eb8e4bce2a566c6cf49c1f15dd6599a
Opcode Fuzzy Hash: 7687c3d5f5e5f32277f93cc1f520861e2e3a8ece9d3ce571f9534e378ed6e36b
Instruction Fuzzy Hash: 5F01C0F1D443019FF3248B10DC67FABB728D700B11F1043EDE605652C0DAB80A814F42

Function 00540C7C Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

K32GetPerformanceInfo.KERNEL32(?,00000038), ref: 00541FDB

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: InfoPerformance
String ID:
API String ID: 3070290716-0
Opcode ID: 150e0bff3f0fd519c82fd932d26fb8c87dd71067398a1d6f4a9b709881dac62c
Instruction ID: c72a598bbfa7531c5ea741270d2e6bf9fae7d7814fe8404d895eaf2fe2c1d7c9
Opcode Fuzzy Hash: 150e0bff3f0fd519c82fd932d26fb8c87dd71067398a1d6f4a9b709881dac62c
Instruction Fuzzy Hash: CF2129729116188BDB68CF24CD947ADFBB9FB54341F20C6DD940DAA648D630AB85CF04

Function 00541F97 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

K32GetPerformanceInfo.KERNEL32(?,00000038), ref: 00541FDB

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: InfoPerformance
String ID:
API String ID: 3070290716-0
Opcode ID: 0dd488be67c450d0937639697e9db59565c8268bb5d4e7c7d32c4ab70e4c58b2
Instruction ID: 9204d2a037500546ae568a469c631a69d3d0a62ed755d00fe4a6a2d61bfd7e44
Opcode Fuzzy Hash: 0dd488be67c450d0937639697e9db59565c8268bb5d4e7c7d32c4ab70e4c58b2
Instruction Fuzzy Hash: BB21F571A116288BDB68CF14CD947E9FBB5FB94341F10C6DD940DAA648D630ABC5CF04

Function 3BEB65DB Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 0972d7d4e73790d41f25cf166dfa08cbf310786babae99a9382d6aa5c459bdeb
Instruction ID: e8e94615b8faf7a0027092f394428cb5c2ee721c2e43719e6875515a79785d55
Opcode Fuzzy Hash: 0972d7d4e73790d41f25cf166dfa08cbf310786babae99a9382d6aa5c459bdeb
Instruction Fuzzy Hash: 7301DEB0C0D3999EEF61CB58DC917A8BB78AB05704F1040EB848E95182DE784BC5CF02

Function 008A16F2 Relevance: 1.5, APIs: 1, Instructions: 44threadCOMMON

Download Yara Rule

APIs

Wow64GetThreadContext.KERNEL32(?,?), ref: 008A1C52

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 8c098a6acac6bdf9bc360c7bf472d2d58f8e676682caf1c7629f84345a9c8b92
Instruction ID: aa7fbb07ce319a8080806e3b03aaf770d1677303e4c3522e608d89cfd13af6cf
Opcode Fuzzy Hash: 8c098a6acac6bdf9bc360c7bf472d2d58f8e676682caf1c7629f84345a9c8b92
Instruction Fuzzy Hash: DCF04EA3F4421957F7208605DC84DEB7769F7C1324F1842F6E80D93740E5785E429BA2

Function 3BEC490F Relevance: 1.5, APIs: 1, Instructions: 43fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 3BEC5DA9

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7c99aa2ef1d6d4b43470d33901d0641c12083799034dd0b88006a91415536758
Instruction ID: fa2ac66ef56d2babff9d896f53d6b368fa2f7fe2a1da59afefe236442f471275
Opcode Fuzzy Hash: 7c99aa2ef1d6d4b43470d33901d0641c12083799034dd0b88006a91415536758
Instruction Fuzzy Hash: 0101A2B2D403159BF7248A08DD49BEFB7B8EB84710F1082FEE50D96140EE755ED08A92

Function 00541C09 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

K32GetPerformanceInfo.KERNEL32(?,00000038), ref: 00541FDB

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: InfoPerformance
String ID:
API String ID: 3070290716-0
Opcode ID: ddf75e3c94f6f7eabd264be4095cd1d32540989ead409d24619650fbdcd16789
Instruction ID: 232ed0f6cb3c65ae7db1455384e31e2269f6e103d388e6c41198fd7aa5f79b50
Opcode Fuzzy Hash: ddf75e3c94f6f7eabd264be4095cd1d32540989ead409d24619650fbdcd16789
Instruction Fuzzy Hash: F521E471A116288BDB68CF14CD95BEDFBB9BB94341F10C6DE940DAA248D630AF85CF04

Function 3BEC6891 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 69b08cefd49dd55b361896980a34b9b1129157685e22c8781d8cf5c82a3567dd
Instruction ID: 2ae6d91fd2d2550e8fa40cf9471d970aeb0aaf15651540be155ebc8bfed73881
Opcode Fuzzy Hash: 69b08cefd49dd55b361896980a34b9b1129157685e22c8781d8cf5c82a3567dd
Instruction Fuzzy Hash: B00126B084939C9FF7308B688E85F857BA0AB02710F1403CADA889B0C3DA7259E58747

Function 3BEC4692 Relevance: 1.5, APIs: 1, Instructions: 42fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 3BEC5DA9

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 2096d848a2c918bb73613acaf5a69768e41e2b836c55beb2415c0272f4ccb7fb
Instruction ID: d617fe25adc1c2ee7f998c61c6f40dcf927272fc56a805e8d7cc26ee8c156981
Opcode Fuzzy Hash: 2096d848a2c918bb73613acaf5a69768e41e2b836c55beb2415c0272f4ccb7fb
Instruction Fuzzy Hash: A101A9B2D403155BF7148908DD49BEF77B8EB84714F0042FEE50D96140DE795ED48B92

Function 008F6891 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2199701952.00000000008E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_AdobePDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 69b08cefd49dd55b361896980a34b9b1129157685e22c8781d8cf5c82a3567dd
Instruction ID: f05ef2939924ad09d3555d114a33af13a30153fc535ccc4fdd47c7d8290d1b38
Opcode Fuzzy Hash: 69b08cefd49dd55b361896980a34b9b1129157685e22c8781d8cf5c82a3567dd
Instruction Fuzzy Hash: 9101A2B084939C9FFB309B648D85BA47BA4BB02324F1403DADB84DB0D3DA7259D58742

Function 3BEBFBCC Relevance: 1.5, APIs: 1, Instructions: 40fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 3BEBFFDF

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8e377f1436017c98d852b5703657d093bcda267e2ca7d53ad50a524be4e803ee
Instruction ID: d356ffa141fa838cb882c1135feb2bfaa8d5a4e87e5046acdcdb7af4d854796a
Opcode Fuzzy Hash: 8e377f1436017c98d852b5703657d093bcda267e2ca7d53ad50a524be4e803ee
Instruction Fuzzy Hash: 7C0149B1E403159EF7248A14DC66B9AB764D704715F1042EAEA0A661C0CAB44A924F82

Function 008A7789 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000002), ref: 008A7B03

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 86f76b6614d17a051bda776851b527900005e954d89e016031733f699e39ec76
Instruction ID: 388050a39704dfde351dda9410aa7c78e9f8c831f61d4bff0496f45d8c8bf595
Opcode Fuzzy Hash: 86f76b6614d17a051bda776851b527900005e954d89e016031733f699e39ec76
Instruction Fuzzy Hash: 0C116D74E052299FDB64CA14C884BD9B7B6BB89304F5081DAE50DA7245D7306EC18F91

Function 0054A9E3 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(4F56E159,?,?,?,?,?,?,?), ref: 0054AF1B

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 589bf3444c04627360982fcb91a84b097f39daff2c3a021ab98682fbcd18fbee
Instruction ID: 1fb7ca9e4a06676fdcce1ad24c486a509610ea55bb13cb0fe19003492f56ba8d
Opcode Fuzzy Hash: 589bf3444c04627360982fcb91a84b097f39daff2c3a021ab98682fbcd18fbee
Instruction Fuzzy Hash: DCF059F3E081059BF714591AEC598FBBBA1EB84310F1005B7D80F932C0E5791A879992

Function 3BEB6924 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 7ccd72c164a6a63abb6b1a0ca6adb13bf7a71921eec9e054ea4c4f66b8b686a3
Instruction ID: 73589e04e40ba5d9a2698aeb0643a79332e8f103f5b93e1bc04044eecbb282df
Opcode Fuzzy Hash: 7ccd72c164a6a63abb6b1a0ca6adb13bf7a71921eec9e054ea4c4f66b8b686a3
Instruction Fuzzy Hash: 7801ADB080DB989EEF218B64EC913E87F74EB85301F1485DB858A5A582DA344EC5CF42

Function 3BEC5829 Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 3BEC5DA9

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: a3ff26130b87f4c6e6cf8e8527dfe7ef5916ab7469b4874f2affc48c7914ffc7
Instruction ID: 5fc18bcf824affef868c1e668c0fd8b8b26b87db6aff9a71781a53eaaa7b957f
Opcode Fuzzy Hash: a3ff26130b87f4c6e6cf8e8527dfe7ef5916ab7469b4874f2affc48c7914ffc7
Instruction Fuzzy Hash: 48F0FFB29042259BE724CA08DD45BEBB3B9EB84744F0042F9E50CC6240EA309EC08B81

Function 3BEB7C97 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: b5b16123d979ef107935534d65d5280034cb6f277c15b7f94b4371f8bd0fd022
Instruction ID: dd780ec795cdb5cb3607ca565754beef006dfde77a823136e8d6e3c90c7455d2
Opcode Fuzzy Hash: b5b16123d979ef107935534d65d5280034cb6f277c15b7f94b4371f8bd0fd022
Instruction Fuzzy Hash: 5B019EB08497989FDB21CB64CC802E87BB4BF46300F1481DAC88966642D9354EC6CF02

Function 3BEBEC1A Relevance: 1.5, APIs: 1, Instructions: 37fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 3BEBFFDF

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: bc28fe50a3e8f760e5f7430cb8f6fe7245352ee726830db6f4d766f2b14a25ad
Instruction ID: c6f4d85d226a2df1edcc9de2b201c0e993e13d764e51b2a0a468043ff2deaf90
Opcode Fuzzy Hash: bc28fe50a3e8f760e5f7430cb8f6fe7245352ee726830db6f4d766f2b14a25ad
Instruction Fuzzy Hash: 43F08BB0E483519EF7344614DC67BAA3B64D300B16F0003EAF246750C0C9B845914F82

Function 3BEBEC15 Relevance: 1.5, APIs: 1, Instructions: 37fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 3BEBFFDF

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3c93fb828ada443b9efa170ebd41a4fb8ecfc03bb988ab3c230753c55dd2ba9a
Instruction ID: 9f785bc9f4d8b679bd155113f40e95c30d7087b7068944d46f9122338b1a57b2
Opcode Fuzzy Hash: 3c93fb828ada443b9efa170ebd41a4fb8ecfc03bb988ab3c230753c55dd2ba9a
Instruction Fuzzy Hash: 44F02BB1D483559EF7344614DD67BAA7754D304B16F0003AAF61A750C0DDB946D14E83

Function 008A0888 Relevance: 1.5, APIs: 1, Instructions: 37threadCOMMON

Download Yara Rule

APIs

Wow64GetThreadContext.KERNEL32(?,?), ref: 008A1C52

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 3e1a71f1e1229be6389425e9d7b94b1e9cdb5c319d6177a78429b1da9a49a8e2
Instruction ID: 8bbb1c1f3fc321fad5326accc3f02082d57e4e7debc70145b6f47ca7f3b8d403
Opcode Fuzzy Hash: 3e1a71f1e1229be6389425e9d7b94b1e9cdb5c319d6177a78429b1da9a49a8e2
Instruction Fuzzy Hash: E0F024A3F4411956F7108555EC48AE7B659E7C1328F1D42B6E80D43680E5B85A4286E7

Function 008A1103 Relevance: 1.5, APIs: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Wow64GetThreadContext.KERNEL32(?,?), ref: 008A1C52

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: e8a0da94e03c2ca990e8df0baf023a24f2e9310f9c78de3821ab3bc752b7ce53
Instruction ID: fd3ac5da4a2994ae997b93528c11e0ad93b566e0474b553a1596172484ce6a2e
Opcode Fuzzy Hash: e8a0da94e03c2ca990e8df0baf023a24f2e9310f9c78de3821ab3bc752b7ce53
Instruction Fuzzy Hash: B5F059A3F5551957F7108511EC48BF77659F3C1328F2C82B6E80D42A40AA784E4246A2

Function 008A368E Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: b1b0aa7b1dcbee0c97987e4577207dfe96ed0bb0c124736661a43d39d5c6097d
Instruction ID: 87321f809202ad382e088ccd1603fb657f846f884fd76157359bf803fd347c5e
Opcode Fuzzy Hash: b1b0aa7b1dcbee0c97987e4577207dfe96ed0bb0c124736661a43d39d5c6097d
Instruction Fuzzy Hash: 5DF0AF70E9426D8FEB24CE24CC81BA9B375FB41304F2445DAE949AB210EA316E90CF51

Function 008B397D Relevance: 1.5, APIs: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 008B3D9D

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: eb6e6033f83c1b800f464117a870e0b5270601a7969b9483d7cde954c8190ac9
Instruction ID: cfafa23fb0e755d7cdb1297f2917f26372d3d0b87b998f88f4a7e801a56165d6
Opcode Fuzzy Hash: eb6e6033f83c1b800f464117a870e0b5270601a7969b9483d7cde954c8190ac9
Instruction Fuzzy Hash: 42F0A4F1D140189BEB24CA14DC459EAB371EB84310F1482FEE90D53740DA346F818E51

Function 3BEB7854 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 889e97d6c987780d42274e28564b4d68900ddf24bbc49eca2263a908929c36e8
Instruction ID: 3050c1aaa267490527685f98fad68d76076755d949caeb68c4e1c8309a75986c
Opcode Fuzzy Hash: 889e97d6c987780d42274e28564b4d68900ddf24bbc49eca2263a908929c36e8
Instruction Fuzzy Hash: 6F018BB0C097989FDB258F64CC806E97B74EF85300F1481DB858E6A686DA344EC6CF51

Function 005488EE Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00548D68

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 59606b1561a1596bb3b3f7a52d5543d4f86b5cd184bd1a5d175335cdb2ad6d12
Instruction ID: a12b2f2d7e0b1a819ae424ff45600a5322098fc6dc9dd4e605b6b94e0f9a090e
Opcode Fuzzy Hash: 59606b1561a1596bb3b3f7a52d5543d4f86b5cd184bd1a5d175335cdb2ad6d12
Instruction Fuzzy Hash: C9F0F6B0D003599EDB508A54DCC8AEE7AB4FB14344F2440F5D60966140DA305F809F41

Function 00548976 Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00548D68

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 7f83a5948cd5fa08e66a535b4ca4a47da19c6527dbbe5bf6e712a519cd15ffd5
Instruction ID: 7730eb1af8466d1ac804f2c728d1f4fb9ed6b4115c5e9f5ededf855cea689a36
Opcode Fuzzy Hash: 7f83a5948cd5fa08e66a535b4ca4a47da19c6527dbbe5bf6e712a519cd15ffd5
Instruction Fuzzy Hash: 42F0F0B1D04259EEEB548A24DC98BFEBA74FB14344F2441EAE20A66280EE305F809F41

Function 3BEB71B6 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: a3673533a87154fac15baa9fbaad9243ba3a695150b45407d42062fa27ed3f64
Instruction ID: c1ce0eb21da213b938b4759a13900fa736395a06ce3bcd4b349a8d93f6ca5613
Opcode Fuzzy Hash: a3673533a87154fac15baa9fbaad9243ba3a695150b45407d42062fa27ed3f64
Instruction Fuzzy Hash: CBF062B08097989EEB119B64DC847E87B74EF46304F1485CB858959952D9344EC6CF12

Function 3BEB7CA9 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 8be58a5ba2d8708b62efebd91eaa6239e09be156fd4e2911a248c9f1854826e2
Instruction ID: d73b605ed607305f4834868ba14e6ab7879ada61edb42c8a85a060c6f06ed6c2
Opcode Fuzzy Hash: 8be58a5ba2d8708b62efebd91eaa6239e09be156fd4e2911a248c9f1854826e2
Instruction Fuzzy Hash: FB016DB0C097A89FDB21DF54CC806E9BBB4FF4A300F1484DAD989A6652DA345EC5CF51

Function 3BEB7798 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 89d94bef9597d4d92e84d7933236b5f247e91ef74edf0ef0d6301d513ff85d72
Instruction ID: 0a6bf90621a59a0e15edda256ce34c6d58f2ac24aed5d6eaa228e63d9930168c
Opcode Fuzzy Hash: 89d94bef9597d4d92e84d7933236b5f247e91ef74edf0ef0d6301d513ff85d72
Instruction Fuzzy Hash: 24016DF0C097989FDB21CB64CC806E9BB74AF85300F1481DA858D66A56DA344FC6CF52

Function 3BEC5D47 Relevance: 1.5, APIs: 1, Instructions: 32fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 3BEC5DA9

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: c95596273da07887f75c34247230870368e1932c61e38ee3b380f087e92f8b45
Instruction ID: 0c192a79106b0717ae6f5ab34e09ee2b802b58050b3c45e68009719a4f9e5d9f
Opcode Fuzzy Hash: c95596273da07887f75c34247230870368e1932c61e38ee3b380f087e92f8b45
Instruction Fuzzy Hash: 95F09071D453259BE724CA08CD45BDFB7B9ABC4740F0081EAE80D97240DA715E918F92

Function 3BEC5D42 Relevance: 1.5, APIs: 1, Instructions: 32fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 3BEC5DA9

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 44e092d4f00f339af3886883f2f3d58f815fc98c0d3cbf728c229977b94ef947
Instruction ID: dca7bec64f297055ac0e9062a5594180e26d47661e4c938f79884ccc3e451106
Opcode Fuzzy Hash: 44e092d4f00f339af3886883f2f3d58f815fc98c0d3cbf728c229977b94ef947
Instruction Fuzzy Hash: D2F090B1E013299BE724CA09DD49BDFB7B9ABC4740F0081E9E80D57200EA715E918F92

Function 0054883B Relevance: 1.5, APIs: 1, Instructions: 31memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00548D68

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 9e9220c42fb87bd58d36238439cb5af835d38d135e16808607df36c22974fa7f
Instruction ID: 8c9ca9a7dca5ed771ed165a591ec9678ecae8819058ba7b89c7fff60b9c34f78
Opcode Fuzzy Hash: 9e9220c42fb87bd58d36238439cb5af835d38d135e16808607df36c22974fa7f
Instruction Fuzzy Hash: 10F0E9B5D00259EEDB508A24DC89BEE7BB8FB14348F1440EAE50A66240EE305FC09F51

Function 3BEB71B1 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 4da155b7270e5f763f467b2bbea9c4e1a0f2ecb59df55eef71f64e930374b23a
Instruction ID: 5830a3c5ab1e28fd9235a259c97ad4901c6226f48de6ef6b530a67b49515a5e3
Opcode Fuzzy Hash: 4da155b7270e5f763f467b2bbea9c4e1a0f2ecb59df55eef71f64e930374b23a
Instruction Fuzzy Hash: 5DF06DF080D398AEEB218B64DD807E97F74AF46300F1484DBC98D59A42E9344EC6CF52

Function 3BEB693B Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 73216912db791f1a54dbe9b6b37dc1ced7121c660562699ef8032e48f08030e6
Instruction ID: 880204e945a12b8915141b2ea8009258a35b997b13db92d3c4fc8559747f518e
Opcode Fuzzy Hash: 73216912db791f1a54dbe9b6b37dc1ced7121c660562699ef8032e48f08030e6
Instruction Fuzzy Hash: C0F049B080D7985EEB618B64DCA13E97F74AF4A300F5490CB858A59586DA784AC6CF42

Function 3BEC68AE Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(FFFFEC10,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 3BEC7C76

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5917ee02ac80a25e1e350b8ad602b8dec04e6f8841636b6bfab8aaae1c87dd5e
Instruction ID: 93458d21e52be1ac4ce7d9aa71ffcb2c4af22b71e96577cf26a00eaa68034c10
Opcode Fuzzy Hash: 5917ee02ac80a25e1e350b8ad602b8dec04e6f8841636b6bfab8aaae1c87dd5e
Instruction Fuzzy Hash: 06F0E2B084535C9AF7308B288F46F89B360B701714F5043C5DA4C6A0C2DE725AE88787

Function 008AF9AE Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,00000004,?), ref: 008AFF17

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 4b1e88e36ce93b7ba24727c0c3308c50cd09e8843a5764623ac154bd2e5a63f4
Instruction ID: 1f73000797291e8e04da5e784c3202668843c9db1c75effb0fd0d8e531d94c79
Opcode Fuzzy Hash: 4b1e88e36ce93b7ba24727c0c3308c50cd09e8843a5764623ac154bd2e5a63f4
Instruction Fuzzy Hash: 49F09071A091588BDB21CB64CC50BE9F7B4FF8A704F0506DAD609D7252E7726E80CF50

Function 0089CD1F Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 008A3BFA

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 625410a37b22a9b7d6fe6919a752dbb3e7a8ca3ed0d2f590c162f39962028468
Instruction ID: b3b4baea4cee564d4cbd11570f8ebc10346607bbdb9ff657b281a847e304b7e0
Opcode Fuzzy Hash: 625410a37b22a9b7d6fe6919a752dbb3e7a8ca3ed0d2f590c162f39962028468
Instruction Fuzzy Hash: 89F0F970A4425E9BEB64CF14CC81BE9B3B5FB45304F1442DAA909EB740E6716F90DF91

Function 008F68AE Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(FFFFEC10,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 008F7C76

Memory Dump Source

Source File: 00000000.00000002.2199701952.00000000008E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_AdobePDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5917ee02ac80a25e1e350b8ad602b8dec04e6f8841636b6bfab8aaae1c87dd5e
Instruction ID: c11f6d7c43eac3d6beb82cf21ae15a0d80088232231b1273852b8ebc1b0bc89c
Opcode Fuzzy Hash: 5917ee02ac80a25e1e350b8ad602b8dec04e6f8841636b6bfab8aaae1c87dd5e
Instruction Fuzzy Hash: 2CF0A7B084925C96F7308B344E45FA8B760F701324F6043D9DB49EA1C2DA725AD98783

Function 3BEC5254 Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 3BEC5DA9

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1737019ecd1178840d42969b53393d212ccb7ff45af6c1efb5a35208b3742a33
Instruction ID: 478afbd8f6fe1d765361eb85f37fa75f9c959812dbab8d57f1ded16ef341d99b
Opcode Fuzzy Hash: 1737019ecd1178840d42969b53393d212ccb7ff45af6c1efb5a35208b3742a33
Instruction Fuzzy Hash: 42E0E5B19453049BF714CE08DD85BDFB3B8FB84B00F0042D9E90C96140EE315AD04B92

Function 3BEB71C0 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 3ceba7b5edd1d0aae760407d4cdb6dbc1adc1b9b3abc873ebccaf818db68ac8a
Instruction ID: a1bbf8d19ed28d423987352a7b902de8c9c6628a309dd3e4ec48fe195baf93e2
Opcode Fuzzy Hash: 3ceba7b5edd1d0aae760407d4cdb6dbc1adc1b9b3abc873ebccaf818db68ac8a
Instruction Fuzzy Hash: 8DF030B08097985EDB219B64DC807D87F74AF46300F1484CB858995546D5384AC6CF52

Function 008A36A3 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 008A3BFA

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 989f7e2691895f4c4eae5f5a1ac0169af1bae3fdc8fde973d8a10aeb4075cbd5
Instruction ID: 53a1da261af16fba0d8d00dfbe5ce28d9fde1e39d4f7ce7e0a348bdb7b440bea
Opcode Fuzzy Hash: 989f7e2691895f4c4eae5f5a1ac0169af1bae3fdc8fde973d8a10aeb4075cbd5
Instruction Fuzzy Hash: 65F08C70A8425E8BEB24CE10CC41BA9B3B5FB44304F1402EAA909E7340EA316E90CF51

Function 3BEC590E Relevance: 1.5, APIs: 1, Instructions: 25fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 3BEC5DA9

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 47fe5f217c72ca5ca5e0fa0af1c64c4ca912e62872e5afa83144d4973201f4c0
Instruction ID: ee5dcfd491bbf3425d46816bb28d11d3725fa8965a215c1dce42f88f11bee442
Opcode Fuzzy Hash: 47fe5f217c72ca5ca5e0fa0af1c64c4ca912e62872e5afa83144d4973201f4c0
Instruction Fuzzy Hash: 71F01C71E452199FEB24CE08DD85BDFB3B5AB88740F0041E9E90D97240EB715E908F52

Function 008B3D60 Relevance: 1.5, APIs: 1, Instructions: 24threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 008B3D9D

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 6af1f9d2bdd9226b58ddcdfc8b66c678bf12d2fca36443aece06f2f9f4abe799
Instruction ID: e39d334843af9005a084217a7ff7877dd6263a1b437e74e43f0ca338152a3efc
Opcode Fuzzy Hash: 6af1f9d2bdd9226b58ddcdfc8b66c678bf12d2fca36443aece06f2f9f4abe799
Instruction Fuzzy Hash: 20F0FEB5E5912C8BDB24CA54DC84AD9F371FB88314F1482E9E90DA3300D6705F81CF85

Function 3BEC587C Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 3BEC5DA9

Memory Dump Source

Source File: 00000000.00000002.2226407251.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: f0330247564dc4767c04e071366ff6f88d16d1fcaafbe75ff3ee70370e0235b4
Instruction ID: 200bd145e95fa15cd4e579e93aa0e14f5dda8129bfb2cd4a8d22e6ab8e3620b8
Opcode Fuzzy Hash: f0330247564dc4767c04e071366ff6f88d16d1fcaafbe75ff3ee70370e0235b4
Instruction Fuzzy Hash: B5F01C71A452199FEB24CE04CD85BEFB3B5AB84641F0041DCE90D96240DB715E908F41

Function 008B326E Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 008B3D9D

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 25eab12cdd1881c58f0784d1ea844a7281fa14ee3f30fa1b374599663eeac4c7
Instruction ID: a9282d6e80755cc96e049e173ac1c519f864be8997ad0f4719a45004a9505ce2
Opcode Fuzzy Hash: 25eab12cdd1881c58f0784d1ea844a7281fa14ee3f30fa1b374599663eeac4c7
Instruction Fuzzy Hash: EEE0EDB195912C8BDB24DA54DC44AE9B374FB48314F1442D9E909A3301D6705F819F91

Function 008954C7 Relevance: 1.4, APIs: 1, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 19e9cf5a1c1cc5203cd2dd0ba82218c2acd3c1330582572b0102b56d5fbdad39
Instruction ID: 15fcc64598406632433efd5e90e2d1afa65a55d838cfdada9dd0aa4462a184f8
Opcode Fuzzy Hash: 19e9cf5a1c1cc5203cd2dd0ba82218c2acd3c1330582572b0102b56d5fbdad39
Instruction Fuzzy Hash: 9E6104A1D045289EEB25AB64DC587FA77B5FF81309F1840FAD44EE6281E7780EC5CB12

Function 00896562 Relevance: 1.4, APIs: 1, Instructions: 185memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00896AF4

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 3a2a005e3ecbe70028827913c9b8a22539d5b69178a6e777e11957e47e742657
Instruction ID: 6b776ba6256c79084dc36f0674dde34d01ed0fde67a2066bee7f6b265e80bb9c
Opcode Fuzzy Hash: 3a2a005e3ecbe70028827913c9b8a22539d5b69178a6e777e11957e47e742657
Instruction Fuzzy Hash: 5861D0B1D045299FEB209A14DC58BEBBBB5FB80319F1801FAD80DA6280E7785ED1CF51

Function 00895467 Relevance: 1.4, APIs: 1, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 079e5bb0d5becda0254310098e1766e096602e53eadd165bae30918e560c8f3b
Instruction ID: e7ada96e59bfe3db44c76e529841a210e5e7377711283661c2501658af5352c2
Opcode Fuzzy Hash: 079e5bb0d5becda0254310098e1766e096602e53eadd165bae30918e560c8f3b
Instruction Fuzzy Hash: 445105A1D045289EEB24AB64DC547FA7775FF81319F1840FED40DA6280E3781EC5CB52

Function 00895478 Relevance: 1.4, APIs: 1, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 320e515f3a01278530aed95d9e5a5059ef9cd0be8eeac83e70b76c15e0da0a7c
Instruction ID: 36e1a0a1a587c2c5bff31ac296a0de5d6d26bda63d9ad37b81a7c6aea238b70b
Opcode Fuzzy Hash: 320e515f3a01278530aed95d9e5a5059ef9cd0be8eeac83e70b76c15e0da0a7c
Instruction Fuzzy Hash: 4451F3A1D045289EEB24AB64DC547FAB775FF81319F1840FAD40EA6280E3B81EC5CF12

Function 008954B0 Relevance: 1.4, APIs: 1, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41b728e973fefd40d84a6473778ed0205eabd845dd9657455c1ad525a2b8e602
Instruction ID: 0bc6b3c60b8b20b8a476797ea6fa058465d06f6d3097cb23373015210a5ddd17
Opcode Fuzzy Hash: 41b728e973fefd40d84a6473778ed0205eabd845dd9657455c1ad525a2b8e602
Instruction Fuzzy Hash: D05126A1D045289EEB24AB24DC547FA7774FB80319F1801FED40EA6281E3B81EC5CF12

Function 0089F72C Relevance: 1.4, APIs: 1, Instructions: 150memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,000002CC,00001000,00000004), ref: 0089FCC5

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e554d3377cd69e0e0acd52f5144e21c496007c7a32a2cd0d613f850e24a2d931
Instruction ID: 3e5dd4749b389ac6f90603a1d5585d0e0b0db8957fe2cf034a37034eb4dd7161
Opcode Fuzzy Hash: e554d3377cd69e0e0acd52f5144e21c496007c7a32a2cd0d613f850e24a2d931
Instruction Fuzzy Hash: 0B5128F1C012989FEB289B14DC61BF67778FB41318F1441FED68AD2282D6745EC18E41

Function 00895E5A Relevance: 1.4, APIs: 1, Instructions: 144memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00896AF4

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6dc3772f428c3de515bb6db0cc3bc38c0145c5839b3ca07ec8f144fc5eaae238
Instruction ID: ca319c354615d9a6a261fa7fda7be01fd19f5f7d6707261bd3b4fdfb85577afd
Opcode Fuzzy Hash: 6dc3772f428c3de515bb6db0cc3bc38c0145c5839b3ca07ec8f144fc5eaae238
Instruction Fuzzy Hash: B851E0B28045289BEB259A24DC58BEA77B9FB80319F1841F9D40DE6A80E77C5FC4CF51

Function 00895505 Relevance: 1.4, APIs: 1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 30d6a27fcb588c09c6c8bb05ccd0091f17b35592794b2dd488fcaead06f647b6
Instruction ID: 70938426f99a7ed7c7bdac9673f38cbbf12d8b57cc69501d2862d6fd79672024
Opcode Fuzzy Hash: 30d6a27fcb588c09c6c8bb05ccd0091f17b35592794b2dd488fcaead06f647b6
Instruction Fuzzy Hash: C841F0A1D055299EFB24AA10DD587FAB7B5FB80319F1801FED40EA6180E3B81EC5CF12

Function 00895AEC Relevance: 1.4, APIs: 1, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00896AF4

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0a7c33062406aebd17d1a924a42dd99fe0caa8e63e02dcba4bea1733c862e851
Instruction ID: 9324175f3d236d7e1df85dfe2d5d16cf24649f7d44fdbc858b8c5c9a1793095e
Opcode Fuzzy Hash: 0a7c33062406aebd17d1a924a42dd99fe0caa8e63e02dcba4bea1733c862e851
Instruction Fuzzy Hash: 204192B2D04529ABEB259A14DC48BEA77B9FB80319F1840F9D50DE6680E7781FC4CF11

Function 008959B0 Relevance: 1.4, APIs: 1, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00896AF4

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 627a1c31879ae3f1f6f622f1c0c184054866aba6415f6fe3ecef29248e607345
Instruction ID: ac36af7ed7c0b0667df2f960dddd1d3cc6d9749e0d796d5a735ddab1dfe1bb2b
Opcode Fuzzy Hash: 627a1c31879ae3f1f6f622f1c0c184054866aba6415f6fe3ecef29248e607345
Instruction Fuzzy Hash: 5A41A1B19045199FFB219A14DC88BEAB7B9FB80319F2841F9D40DA2580E7791FD5CF11

Function 008969A9 Relevance: 1.4, APIs: 1, Instructions: 119memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00896AF4

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6b52c9bd5cd35f8fde46274a5cadb98086fa936bbc3b249f4884afbc47d0d8e1
Instruction ID: 2bb0c895ce398af059f3e3549eca6b75f23eb464ddc4c5bee30e26da573c3126
Opcode Fuzzy Hash: 6b52c9bd5cd35f8fde46274a5cadb98086fa936bbc3b249f4884afbc47d0d8e1
Instruction Fuzzy Hash: BB41E0B19001699FEF24DA54DC98BFA7BB5FB41319F2841E9D409E6180E7781ED4CF41

Function 004026B0 Relevance: 1.4, APIs: 1, Instructions: 109memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00546BBA

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 90853c554411dfcf14930fdbbeb2311955c14448743e8d1d2cd89427394e690a
Instruction ID: 92a2407643f5f06c86bf51bc5a26a80cc6295a71d8da75017e0fe8487857f1b5
Opcode Fuzzy Hash: 90853c554411dfcf14930fdbbeb2311955c14448743e8d1d2cd89427394e690a
Instruction Fuzzy Hash: E3316BB28096916FE7019B30AC4DBFA3F65FFC2309F0844FAE4455A483D239544AD762

Function 00895B28 Relevance: 1.4, APIs: 1, Instructions: 105memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00896AF4

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d5941c21ee62b00bdd138d896b61674c8fa5a209843a8ab524520f43a098dc5c
Instruction ID: 565c5b2dc421461d2eddf3da6b99e16f490f53ad021b61fb1cfc45f81be694cb
Opcode Fuzzy Hash: d5941c21ee62b00bdd138d896b61674c8fa5a209843a8ab524520f43a098dc5c
Instruction Fuzzy Hash: 3941B0B1D046289FEB259A14DC98BEAB7B9FB80319F1840F9D40DA6680E7791FC4CF11

Function 008959F9 Relevance: 1.3, APIs: 1, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00896AF4

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7c00e052772e684cd05d6c0d41aca2f146f125b55617b865bf1b739c07cefec6
Instruction ID: 8901193e7e191737ecaac21d236370b6417c2e9dec633d87292b72f94af40f60
Opcode Fuzzy Hash: 7c00e052772e684cd05d6c0d41aca2f146f125b55617b865bf1b739c07cefec6
Instruction Fuzzy Hash: AA4182B19046299FEB319A14DC98BEAB7B9FB80319F2840E9D40DD6580E7791FC5CF11

Function 008969EA Relevance: 1.3, APIs: 1, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00896AF4

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ffadc30819fd47260dec25e684920bac409ef7f22704a88c59984bda8934808c
Instruction ID: b8705c633246bda0d158fe863a9dce51ccb1bedb72ea4dce631f15cde6599140
Opcode Fuzzy Hash: ffadc30819fd47260dec25e684920bac409ef7f22704a88c59984bda8934808c
Instruction Fuzzy Hash: 4D41DEB08006699FEF24DA54DC98BFA7BB9FB40329F2801E9D109E6181E7791ED5CF01

Function 0054663A Relevance: 1.3, APIs: 1, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00546BBA

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 40271f1d74712419302199915dbdcb29aedb7cd8383cc6fd1a28ca08dcc7dd0b
Instruction ID: b3f090e60090d80c4ec7009055afb4405dda0ac0d2ba6541383f34111ed5052a
Opcode Fuzzy Hash: 40271f1d74712419302199915dbdcb29aedb7cd8383cc6fd1a28ca08dcc7dd0b
Instruction Fuzzy Hash: DF3128B2D066559FF7108A20CD89FEA7F34FB92309F0441FBD84956681D6385DC68F22

Function 008953CE Relevance: 1.3, APIs: 1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8164a54eaac1fe58dae35d80ddbff3eecd5c86d4d4afbb0638b86fcfcf3c9d56
Instruction ID: b0e154617714e47b9c978d9fb4d3f032122ac89df8ffbfdedac1652269e6c80f
Opcode Fuzzy Hash: 8164a54eaac1fe58dae35d80ddbff3eecd5c86d4d4afbb0638b86fcfcf3c9d56
Instruction Fuzzy Hash: 2331C0B0904519AEFB25AA00DC597EA77B5FB8131AF2840EDD00ED5181E7B81ED9CF12

Function 0089F6AC Relevance: 1.3, APIs: 1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: fcfec64b2f459e2e40738ad50382c71cd9790dc031c0a733d6dc0be868121ab7
Instruction ID: 45d7557a228179cf0ec1d7a97ca8e634cf81b3b345ab28dd0ff76389eb152d48
Opcode Fuzzy Hash: fcfec64b2f459e2e40738ad50382c71cd9790dc031c0a733d6dc0be868121ab7
Instruction Fuzzy Hash: 6B216BB2D4022CAFFB248A14DC85BE77B74F780324F1401BAD94D96281D2B51EC68E92

Function 005466F0 Relevance: 1.3, APIs: 1, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00546BBA

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6454830a4f054a16947425cb9900bbae0bf35ca6845a0f0611ab251f2c45df10
Instruction ID: 30ee51ec892e40171fe6d2e2ff3573e3b3de5bb88e1c9bee8844361c5e267ec0
Opcode Fuzzy Hash: 6454830a4f054a16947425cb9900bbae0bf35ca6845a0f0611ab251f2c45df10
Instruction Fuzzy Hash: E72155F2E053559FF3104A20CC88BA67E39FBD2309F0541FAD84C56285D6780EC68F22

Function 00895344 Relevance: 1.3, APIs: 1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ed4a8d80a7f211fa34c9ea690a621adddbf6b81696f7452e8f3b4041c4f785d6
Instruction ID: 64eb29431a8cd0a627fb73869059dbda80304ffaf97eae36a047acaaf1968f30
Opcode Fuzzy Hash: ed4a8d80a7f211fa34c9ea690a621adddbf6b81696f7452e8f3b4041c4f785d6
Instruction Fuzzy Hash: 8131C3B09046199FFF25AA10DC587EA77B5FB4131AF2840E9D409D5181E7B80ED5CF12

Function 00896A6A Relevance: 1.3, APIs: 1, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00896AF4

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7ac4d2b4905567a6e88836432dafe0c2d797d912567251b6eb54dfbef2577bab
Instruction ID: 3f2f1dcd2d9c125c82de2e39eb7bab9155720a0987b6966bfa2b224503345986
Opcode Fuzzy Hash: 7ac4d2b4905567a6e88836432dafe0c2d797d912567251b6eb54dfbef2577bab
Instruction Fuzzy Hash: 5E318FB09002299FFF249A14DC58BFAB7B5FB40319F1800E9D509A6280E7B91ED4CF51

Function 00895709 Relevance: 1.3, APIs: 1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b62ad6a7f0aab75346c870d8489d4f7b6f1fb45f3e973621976ff543b5d252eb
Instruction ID: 99d1ca62c514426646cd81175e19d764c7833bfe1e43cd2994572dca48df8d52
Opcode Fuzzy Hash: b62ad6a7f0aab75346c870d8489d4f7b6f1fb45f3e973621976ff543b5d252eb
Instruction Fuzzy Hash: 9021BCB09046199EFF25AA10CC587EAB7B5FB4131AF2800E9D00AD6181E7B80ED9CF12

Function 0089F962 Relevance: 1.3, APIs: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,000002CC,00001000,00000004), ref: 0089FCC5

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1480d8d4cdf07f93a2b377e4d2fa41717d8b781a4d6b462fedf04bb82925dd48
Instruction ID: 6a27ebc01bc1dcb41d52ff2151549806a4ffacf668c24524810e9ba2240fc7ff
Opcode Fuzzy Hash: 1480d8d4cdf07f93a2b377e4d2fa41717d8b781a4d6b462fedf04bb82925dd48
Instruction Fuzzy Hash: 6E218BB1E456289FEB24DA14CC40BAAB7B1FBC4329F1481F9D90CA7342D6315ED1CE81

Function 00895737 Relevance: 1.3, APIs: 1, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00896AF4

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e18a0dd44b4699bd0716cdf494cd7dae33980a68cc50f531410840667f69fd55
Instruction ID: e35e6181aab4aedeb1a05c85298f03739a84a26e582fd3b353099731d3dbcdb6
Opcode Fuzzy Hash: e18a0dd44b4699bd0716cdf494cd7dae33980a68cc50f531410840667f69fd55
Instruction Fuzzy Hash: 6F215EB09045199BFF25AA10DC58BEAB7B5FB81319F2800E9D00ED6181E7B91ED9CF11

Function 00546B60 Relevance: 1.3, APIs: 1, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00546BBA

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8d9ee259ff3f94485c1f37c7a59302eb98429301dbdbfab71f1e43876b62d993
Instruction ID: d23a00b70988f22ca2388678a4acee2fd5b2280af2d9b29f9278514ec95cc5f3
Opcode Fuzzy Hash: 8d9ee259ff3f94485c1f37c7a59302eb98429301dbdbfab71f1e43876b62d993
Instruction Fuzzy Hash: E811E3F2D092619FF3104A10CD49BFA7E34FBD2315F1481FAD54D5A585D2391E868B62

Function 00546680 Relevance: 1.3, APIs: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00546BBA

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ac22baa1be71debf2615b1886561a3e15a5791230d8d2906a002dffa5220dbc6
Instruction ID: 06a482c6c4d7caa1dad016bb6d709eb7ef82b769fc9ce01a05f5b11c1df2d086
Opcode Fuzzy Hash: ac22baa1be71debf2615b1886561a3e15a5791230d8d2906a002dffa5220dbc6
Instruction Fuzzy Hash: 431123B2D066619FF3108A20CD4CBEA7F34FBC1306F0440FAD84C6A586C6380E86CB62

Function 008966F0 Relevance: 1.3, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00896AF4

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2b044ff38f519fdca33a3187307b03a8436c414e9064ba15c8dfb274331cbb5d
Instruction ID: 2b8c0d77f0515ee244ce80e4e93b5f6613ad8170f1d69fb9e9e518c47fe554b6
Opcode Fuzzy Hash: 2b044ff38f519fdca33a3187307b03a8436c414e9064ba15c8dfb274331cbb5d
Instruction Fuzzy Hash: 20213BB09055299FEF25AA10DC58BE9B7B5FB41319F2800E9D409E6281E7791ED4CF01

Function 00896668 Relevance: 1.3, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00896AF4

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e47c5292232cf840c791c5023726676e7b93899ee519080754b9ced792c4061f
Instruction ID: d6802ae1c4425f9cf720b5cef38de9540c20b742a473e12b68c2aad70a5d6431
Opcode Fuzzy Hash: e47c5292232cf840c791c5023726676e7b93899ee519080754b9ced792c4061f
Instruction Fuzzy Hash: D2215EB09045699FEF35AE14CC58BE9B7B5FB81319F2800E9D009E6181E3B90ED4CF01

Function 005467E1 Relevance: 1.3, APIs: 1, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00546BBA

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8a64bb7d22fe79e4a6ba6a127545e578cc1dabd6cc02dd890bf2f65a442d7bdd
Instruction ID: ed5d0494762b1713d714b6b182cd3bf426ad97ee38150477a7ff2a9b948da22e
Opcode Fuzzy Hash: 8a64bb7d22fe79e4a6ba6a127545e578cc1dabd6cc02dd890bf2f65a442d7bdd
Instruction Fuzzy Hash: 941104B2E096559FF7118A20CC89BAA7F34FBD1305F1481FBD8485A585D6381D868B22

Function 005460AE Relevance: 1.3, APIs: 1, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00546BBA

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 06025c6b92c312f3fa89734b5d4948693cea2a278f307bd66ed6b8d1c090434d
Instruction ID: a3b395560470add39c70eb7aa303f4c01e67d77fab3430dd53d01ad7f2ee20d7
Opcode Fuzzy Hash: 06025c6b92c312f3fa89734b5d4948693cea2a278f307bd66ed6b8d1c090434d
Instruction Fuzzy Hash: E201F5F2D09651AFF3004520CD89BB53E34EBD130AF0480FBE549994C6D67C0DCA8722

Function 0054586A Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00546BBA

Memory Dump Source

Source File: 00000000.00000002.2197938893.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2197901846.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198747705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199211207.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199240295.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 241407fc1974f478d2d1a1522664754b0e2eafcd23f3181f989bc6a9e52b4d69
Instruction ID: 5f6085b812e05f626550e2b3e0f01cac49b5ac2b5b499f667bab1e39752fa8b0
Opcode Fuzzy Hash: 241407fc1974f478d2d1a1522664754b0e2eafcd23f3181f989bc6a9e52b4d69
Instruction Fuzzy Hash: F101F5F2D09651AFF3004520CD89BA53E34FBD131AF0480F6D54999486D27C098A8722

Function 0089F81C Relevance: 1.3, APIs: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,000002CC,00001000,00000004), ref: 0089FCC5

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 663adbef92004e7fe798528485943526fdc73126d0837aa5aeeeb71627b04e52
Instruction ID: 9549e79668c245763e91825656f2ae854866b70fcd1061e315d7544f72dc3727
Opcode Fuzzy Hash: 663adbef92004e7fe798528485943526fdc73126d0837aa5aeeeb71627b04e52
Instruction Fuzzy Hash: 7BF0B4B1D8461D9EF7245A10DC89BBA7264F700729F1402FAEE0E56380D6B61E908E82

Function 008AB45A Relevance: 1.3, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 008AB9B1

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0e37247ee947ea62f25ce27d4deef5ec3f3ab246f03bd2d6da71d5a33dfb5266
Instruction ID: 53b3c33db6c174b9798c3c6d7942dd0625bed7349397deed42a6a700090867cb
Opcode Fuzzy Hash: 0e37247ee947ea62f25ce27d4deef5ec3f3ab246f03bd2d6da71d5a33dfb5266
Instruction Fuzzy Hash: A2F09670D0961C9EFB648E11C8987BABB70FB01305F1442EEDA4DA6681D7351EC0DE42

Function 0089FC68 Relevance: 1.3, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,000002CC,00001000,00000004), ref: 0089FCC5

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8ab0c20e5944fd58e9577473cddf3beffc8fad310e2f6df3806a14c62092106a
Instruction ID: 99f353f8fe01b4e47b4cb0f1a4f25539ee795b45d88b6d5e014da0f5f15bd312
Opcode Fuzzy Hash: 8ab0c20e5944fd58e9577473cddf3beffc8fad310e2f6df3806a14c62092106a
Instruction Fuzzy Hash: A9F09071E8532D9EEB305910CC49BABB6A0F745329F1441F5DA0DA6280D6751DC08EC2

Function 0089F8A9 Relevance: 1.3, APIs: 1, Instructions: 31memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,000002CC,00001000,00000004), ref: 0089FCC5

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8496a5972e48c861d0bb4d563441466d249349a301bfd5d9b22aa2d2ff206d99
Instruction ID: f7c07b33958d3637ceb5b2c8bba86999347838ceac7779c363340a52672d900f
Opcode Fuzzy Hash: 8496a5972e48c861d0bb4d563441466d249349a301bfd5d9b22aa2d2ff206d99
Instruction Fuzzy Hash: D1F0B471E806299EEB309914DC45BEB77B0F78531DF1401F6DA4D96281D6711EC08EC1

Function 0089E90C Relevance: 1.3, APIs: 1, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,000002CC,00001000,00000004), ref: 0089FCC5

Memory Dump Source

Source File: 00000000.00000002.2199661491.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Offset: 00890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: bb2f14a31601c9ecf8540ee0dffc646c6ab548c8448c67aacb59886e7a43b2d3
Instruction ID: b7a738f616394a6c1d10d65fcbe09c3becd0ee580a62a37de326f5c4b52a38c5
Opcode Fuzzy Hash: bb2f14a31601c9ecf8540ee0dffc646c6ab548c8448c67aacb59886e7a43b2d3
Instruction Fuzzy Hash: 45E0CD7098431D8EEB305A104C097657260F70072DF2402F5DF49E52C1D7B00980CEC7

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report AdobePDF.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\csc.exe.log

C:\Users\user\Documents\Elaborate Bytes\HD Tach\hdtach.exe

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
AdobePDF.exe

Function 00891402 Relevance: 40.8, APIs: 1, Strings: 22, Instructions: 521
libraryCOMMON

Function 3BEBFC6B Relevance: 24.9, APIs: 1, Strings: 13, Instructions: 422
fileCOMMON

Function 3BEBC5DD Relevance: 24.3, APIs: 1, Strings: 15, Instructions: 339
COMMON

Function 3BEBD596 Relevance: 22.8, APIs: 1, Strings: 14, Instructions: 273
COMMON

Function 3BEBD67C Relevance: 22.7, APIs: 1, Strings: 14, Instructions: 209
COMMON

Function 3BEBD5D6 Relevance: 21.3, APIs: 1, Strings: 13, Instructions: 254
COMMON