Edit tour

Windows Analysis Report
AdobePDF.exe

Overview

General Information

Sample name:	AdobePDF.exe
Analysis ID:	1587430
MD5:	44cc93b896b10417f5d231088ffe6924
SHA1:	5def3a0114a71e6affd57d9bc7b9757bf4b6eb14
SHA256:	587d10cf5d8c91fe31141bad01719e6a99914010659ef951b1680e97559e7910
Tags:	exeuser-zhuzhu0009
Infos:

Detection

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

AI detected suspicious sample

Allocates memory in foreign processes

Drops PE files to the document folder of the user

Drops large PE files

Injects a PE file into a foreign processes

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Writes to foreign memory regions

Yara detected Costura Assembly Loader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

AdobePDF.exe (PID: 5172 cmdline: "C:\Users\user\Desktop\AdobePDF.exe" MD5: 44CC93B896B10417F5D231088FFE6924)

csc.exe (PID: 4256 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

csc.exe (PID: 5776 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.4041169546.00000000091B0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000005.00000002.2995695195.0000000008373000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000005.00000002.2995207906.00000000071D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000005.00000002.2996359869.0000000009A20000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000003.00000002.4040791036.0000000007B93000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000003.00000002.4040377925.00000000069F1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: csc.exe PID: 4256	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: csc.exe PID: 4256	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: csc.exe PID: 5776	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: csc.exe PID: 5776	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
5.2.csc.exe.9a20000.3.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
3.2.csc.exe.7c192a0.1.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
5.2.csc.exe.83f92a0.1.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
3.2.csc.exe.91b0000.3.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\Documents\Elaborate Bytes\HD Tach\hdtach.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\AdobePDF.exe, ProcessId: 5172, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\QualysDLP

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: AdobePDF.exe	Virustotal: Detection: 12%			Perma Link
Source: AdobePDF.exe	ReversingLabs: Detection: 15%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Users\user\Desktop\AdobePDF.exe

Code function: 0_2_00530E10 TlsGetValue,TlsGetValue,TlsSetValue,BCryptGenRandom,TlsGetValue,TlsGetValue,

0_2_00530E10

Source: AdobePDF.exe, 00000000.00000000.2188246781.00000000005B2000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_dab96381-9

Source: AdobePDF.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: AdobePDF.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: protobuf-net.pdbSHA256}Lq source: csc.exe, 00000003.00000003.2636533396.0000000007FAB000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.2636533396.0000000007E71000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.4041206445.0000000009210000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.2718351296.0000000008651000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2718351296.000000000878B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2996398762.0000000009A80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: E:\builds\CST-RED-LCW\target\i686-pc-windows-msvc\release\deps\bdredline.pdb source: AdobePDF.exe, hdtach.exe.0.dr
Source:	Binary string: protobuf-net.pdb source: csc.exe, 00000003.00000003.2636533396.0000000007FAB000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.2636533396.0000000007E71000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.4041206445.0000000009210000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.2718351296.0000000008651000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2718351296.000000000878B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2996398762.0000000009A80000.00000004.08000000.00040000.00000000.sdmp

Source: global traffic

TCP traffic: 192.168.2.6:49850 -> 181.71.216.203:30203

Source: Joe Sandbox View

IP Address: 181.71.216.203 181.71.216.203

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: newstaticfreepoint24.ddns-ip.net

Source: csc.exe, 00000003.00000002.4040377925.00000000069F1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.4040377925.0000000006C73000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.4040377925.0000000006A86000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2995207906.0000000007251000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2995207906.00000000071D1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2995207906.000000000742B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: AdobePDF.exe, hdtach.exe.0.dr	String found in binary or memory: http://www.w3.or
Source: AdobePDF.exe, hdtach.exe.0.dr	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: AdobePDF.exe, hdtach.exe.0.dr	String found in binary or memory: https://curl.se/docs/hsts.html
Source: AdobePDF.exe, hdtach.exe.0.dr	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: hdtach.exe.0.dr	String found in binary or memory: https://github.com/clap-rs/clap/issues
Source: AdobePDF.exe, hdtach.exe.0.dr	String found in binary or memory: https://github.com/clap-rs/clap/issues46
Source: hdtach.exe.0.dr	String found in binary or memory: https://github.com/clap-rs/clap/issuesC:
Source: hdtach.exe.0.dr	String found in binary or memory: https://github.com/clap-rs/clap/issuesSUBCOMMAND
Source: AdobePDF.exe, hdtach.exe.0.dr	String found in binary or memory: https://github.com/clap-rs/clap/issuesunexpected
Source: csc.exe, 00000003.00000003.2636533396.0000000007FAB000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.2636533396.0000000007E71000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.4041206445.0000000009210000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.2718351296.0000000008651000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2718351296.000000000878B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2996398762.0000000009A80000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: csc.exe, 00000003.00000003.2636533396.0000000007FAB000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.2636533396.0000000007E71000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.4041206445.0000000009210000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.2718351296.0000000008651000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2718351296.000000000878B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2996398762.0000000009A80000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: csc.exe, 00000003.00000003.2636533396.0000000007FAB000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.2636533396.0000000007E71000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.4041206445.0000000009210000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.2718351296.0000000008651000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2718351296.000000000878B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2996398762.0000000009A80000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: csc.exe, 00000003.00000003.2636533396.0000000007FAB000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.2636533396.0000000007E71000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.4041206445.0000000009210000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.2718351296.0000000008651000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2718351296.000000000878B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2996398762.0000000009A80000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: csc.exe, 00000003.00000003.2636533396.0000000007FAB000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.2636533396.0000000007E71000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.4040377925.00000000069F1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.4041206445.0000000009210000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.2718351296.0000000008651000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2718351296.000000000878B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2995207906.00000000071D1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2996398762.0000000009A80000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: csc.exe, 00000003.00000003.2636533396.0000000007FAB000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.2636533396.0000000007E71000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.4041206445.0000000009210000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.2718351296.0000000008651000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2718351296.000000000878B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2996398762.0000000009A80000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

System Summary

Drops large PE files

Source: C:\Users\user\Desktop\AdobePDF.exe

File dump: hdtach.exe.0.dr 959667331

Jump to dropped file

Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0054604D	0_2_0054604D
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_005B1060	0_2_005B1060
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00401000	0_2_00401000
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00547833	0_2_00547833
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_004B3020	0_2_004B3020
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00449900	0_2_00449900
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00484100	0_2_00484100
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_005011C0	0_2_005011C0
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_004859F0	0_2_004859F0
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_005479AE	0_2_005479AE
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00526A00	0_2_00526A00
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00548201	0_2_00548201
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0048B210	0_2_0048B210
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_005ACA20	0_2_005ACA20
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_004C0A30	0_2_004C0A30
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00428B50	0_2_00428B50
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00540B40	0_2_00540B40
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0042D370	0_2_0042D370
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0045CB20	0_2_0045CB20
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_004B3320	0_2_004B3320
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00502BD0	0_2_00502BD0
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_005473B9	0_2_005473B9
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00427C76	0_2_00427C76
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00545C16	0_2_00545C16
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_005264C0	0_2_005264C0
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_005434CC	0_2_005434CC
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0054849D	0_2_0054849D
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00500C80	0_2_00500C80
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0054648D	0_2_0054648D
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_004FFD50	0_2_004FFD50
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0042A560	0_2_0042A560
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00543579	0_2_00543579
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00502560	0_2_00502560
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00422570	0_2_00422570
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00501D10	0_2_00501D10
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_004BFD30	0_2_004BFD30
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00490DB0	0_2_00490DB0
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00547E43	0_2_00547E43
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_005486F1	0_2_005486F1
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_004FFEA0	0_2_004FFEA0
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0051FF00	0_2_0051FF00
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00542FD0	0_2_00542FD0
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_005027E0	0_2_005027E0
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00502F80	0_2_00502F80
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0054A7A0	0_2_0054A7A0
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00981402	0_2_00981402
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_009A3783	0_2_009A3783
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0098380F	0_2_0098380F
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00990805	0_2_00990805
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0098983E	0_2_0098983E
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00999199	0_2_00999199
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0098212E	0_2_0098212E
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00981AD9	0_2_00981AD9
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_009822D5	0_2_009822D5
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_009852CE	0_2_009852CE
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00981AFF	0_2_00981AFF
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00981AE8	0_2_00981AE8
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00985AE1	0_2_00985AE1
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00981A43	0_2_00981A43
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0098B271	0_2_0098B271
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00981A75	0_2_00981A75
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00985B99	0_2_00985B99
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00981B82	0_2_00981B82
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0098B3C9	0_2_0098B3C9
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0098A3EB	0_2_0098A3EB
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_009993E5	0_2_009993E5
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00982327	0_2_00982327
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00981B7B	0_2_00981B7B
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00981B76	0_2_00981B76
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0098736C	0_2_0098736C
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0098B36E	0_2_0098B36E
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0098B49F	0_2_0098B49F
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0098B482	0_2_0098B482
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0098B41D	0_2_0098B41D
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00981443	0_2_00981443
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0098F47A	0_2_0098F47A
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00983472	0_2_00983472
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_009855F7	0_2_009855F7
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00990D16	0_2_00990D16
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_009A5500	0_2_009A5500
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_009906BE	0_2_009906BE
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0098AE03	0_2_0098AE03
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00982E2E	0_2_00982E2E
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00981657	0_2_00981657
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0098B7B0	0_2_0098B7B0
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00998FA8	0_2_00998FA8
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0098B7A2	0_2_0098B7A2
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0098B7D2	0_2_0098B7D2
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0098B71C	0_2_0098B71C
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00981F1F	0_2_00981F1F
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00985702	0_2_00985702
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_0098B75E	0_2_0098B75E
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00981F55	0_2_00981F55
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E53783	0_2_00E53783
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E50861	0_2_00E50861
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E40805	0_2_00E40805
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E3380F	0_2_00E3380F
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E49199	0_2_00E49199
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E4A164	0_2_00E4A164
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E52964	0_2_00E52964
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E35AE1	0_2_00E35AE1
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E542CD	0_2_00E542CD
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E352CE	0_2_00E352CE
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E3B271	0_2_00E3B271
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E493E5	0_2_00E493E5
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E3A3EB	0_2_00E3A3EB
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E3B3C9	0_2_00E3B3C9
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E4A3CA	0_2_00E4A3CA
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E523A5	0_2_00E523A5
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E35B99	0_2_00E35B99
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E3B36E	0_2_00E3B36E
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E3736C	0_2_00E3736C
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E3B482	0_2_00E3B482
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E3B49F	0_2_00E3B49F
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E3B41D	0_2_00E3B41D
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E355F7	0_2_00E355F7
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E505FA	0_2_00E505FA
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E55500	0_2_00E55500
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E40D16	0_2_00E40D16
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E526E3	0_2_00E526E3
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E406BE	0_2_00E406BE
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E3AE03	0_2_00E3AE03
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E49FEC	0_2_00E49FEC
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E3B7D2	0_2_00E3B7D2
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E3B7A2	0_2_00E3B7A2
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E48FA8	0_2_00E48FA8
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E3B7B0	0_2_00E3B7B0
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E54754	0_2_00E54754
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E3B75E	0_2_00E3B75E
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E5172E	0_2_00E5172E
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E35702	0_2_00E35702
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E3B71C	0_2_00E3B71C
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B405B	0_2_026B405B
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026BD6A3	0_2_026BD6A3
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B47BA	0_2_026B47BA
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026BFC6B	0_2_026BFC6B
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026BDA68	0_2_026BDA68
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B7261	0_2_026B7261
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026C1A66	0_2_026C1A66
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B7276	0_2_026B7276
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026BE24C	0_2_026BE24C
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B9A2B	0_2_026B9A2B
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026BBA20	0_2_026BBA20
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026BDA3B	0_2_026BDA3B
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B4A32	0_2_026B4A32
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B3A14	0_2_026B3A14
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026C0AF2	0_2_026C0AF2
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026C42A6	0_2_026C42A6
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B3A9A	0_2_026B3A9A
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B8B67	0_2_026B8B67
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B4B4D	0_2_026B4B4D
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026C0B45	0_2_026C0B45
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026D0343	0_2_026D0343
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B4B28	0_2_026B4B28
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026C03E6	0_2_026C03E6
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B3BC2	0_2_026B3BC2
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B4BDC	0_2_026B4BDC
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B4BA0	0_2_026B4BA0
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B2388	0_2_026B2388
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026C1388	0_2_026C1388
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026BEB80	0_2_026BEB80
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026C8B94	0_2_026C8B94
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B4845	0_2_026B4845
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026BF054	0_2_026BF054
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B0027	0_2_026B0027
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B481A	0_2_026B481A
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026BE8E6	0_2_026BE8E6
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B20CF	0_2_026B20CF
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026C18C0	0_2_026C18C0
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B48C5	0_2_026B48C5
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026BD8A6	0_2_026BD8A6
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B68BA	0_2_026B68BA
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B48BD	0_2_026B48BD
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B40B6	0_2_026B40B6
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B4886	0_2_026B4886
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B4174	0_2_026B4174
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B515D	0_2_026B515D
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B4155	0_2_026B4155
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B9955	0_2_026B9955
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026BD92D	0_2_026BD92D
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026BF933	0_2_026BF933
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B010B	0_2_026B010B
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026C4106	0_2_026C4106
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B491D	0_2_026B491D
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B4910	0_2_026B4910
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B41E6	0_2_026B41E6
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B41F4	0_2_026B41F4
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B41A9	0_2_026B41A9
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026BD9A7	0_2_026BD9A7
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026C09A2	0_2_026C09A2
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026C818F	0_2_026C818F
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026C499C	0_2_026C499C
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B419E	0_2_026B419E
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B4666	0_2_026B4666
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026BD67C	0_2_026BD67C
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026C2E73	0_2_026C2E73
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026C4645	0_2_026C4645
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026C1640	0_2_026C1640
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B765A	0_2_026B765A
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B3E09	0_2_026B3E09
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026C0E1E	0_2_026C0E1E
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B661F	0_2_026B661F
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B461C	0_2_026B461C
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B46E5	0_2_026B46E5
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B86F3	0_2_026B86F3
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B46F1	0_2_026B46F1
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026C46C0	0_2_026C46C0
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B46DA	0_2_026B46DA
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026C0ED1	0_2_026C0ED1
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026C0EA9	0_2_026C0EA9
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026BD685	0_2_026BD685
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B677A	0_2_026B677A
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026C0742	0_2_026C0742
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026C472C	0_2_026C472C
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026BD725	0_2_026BD725
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B0FF2	0_2_026B0FF2
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026C37C5	0_2_026C37C5
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026C17A7	0_2_026C17A7
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B47A7	0_2_026B47A7
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026C07BC	0_2_026C07BC
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026C4F81	0_2_026C4F81
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B4C66	0_2_026B4C66
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B4C51	0_2_026B4C51
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B9455	0_2_026B9455
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B4CF9	0_2_026B4CF9
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B4CF6	0_2_026B4CF6
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B4C92	0_2_026B4C92
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B3D70	0_2_026B3D70
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B4D08	0_2_026B4D08
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B4D1E	0_2_026B4D1E
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B751C	0_2_026B751C
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B3DE4	0_2_026B3DE4
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B3DF2	0_2_026B3DF2
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026C0DDC	0_2_026C0DDC
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026BC5DD	0_2_026BC5DD
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026BD5D6	0_2_026BD5D6
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B3DA8	0_2_026B3DA8
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B45B1	0_2_026B45B1
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026C9584	0_2_026C9584
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026B4D9B	0_2_026B4D9B
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_026BD596	0_2_026BD596
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB47BA	0_2_3BEB47BA
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEBD6A3	0_2_3BEBD6A3
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEBFC6B	0_2_3BEBFC6B
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC03E6	0_2_3BEC03E6
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB3BC2	0_2_3BEB3BC2
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB4BDC	0_2_3BEB4BDC
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB4BA0	0_2_3BEB4BA0
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB2388	0_2_3BEB2388
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC1388	0_2_3BEC1388
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEBEB80	0_2_3BEBEB80
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC8B94	0_2_3BEC8B94
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB8B67	0_2_3BEB8B67
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB4B4D	0_2_3BEB4B4D
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC0B45	0_2_3BEC0B45
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BED0343	0_2_3BED0343
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB4B28	0_2_3BEB4B28
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC0AF2	0_2_3BEC0AF2
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC42A6	0_2_3BEC42A6
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB3A9A	0_2_3BEB3A9A
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEBDA68	0_2_3BEBDA68
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB7261	0_2_3BEB7261
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC1A66	0_2_3BEC1A66
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB7276	0_2_3BEB7276
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEBE24C	0_2_3BEBE24C
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB9A2B	0_2_3BEB9A2B
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEBBA20	0_2_3BEBBA20
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEBDA3B	0_2_3BEBDA3B
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB4A32	0_2_3BEB4A32
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB3A14	0_2_3BEB3A14
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB41E6	0_2_3BEB41E6
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB41F4	0_2_3BEB41F4
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB41A9	0_2_3BEB41A9
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEBD9A7	0_2_3BEBD9A7
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC09A2	0_2_3BEC09A2
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC499C	0_2_3BEC499C
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB419E	0_2_3BEB419E
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB4174	0_2_3BEB4174
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB515D	0_2_3BEB515D
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB4155	0_2_3BEB4155
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB9955	0_2_3BEB9955
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEBD92D	0_2_3BEBD92D
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEBF933	0_2_3BEBF933
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB010B	0_2_3BEB010B
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC4106	0_2_3BEC4106
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB491D	0_2_3BEB491D
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB4910	0_2_3BEB4910
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEBE8E6	0_2_3BEBE8E6
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB20CF	0_2_3BEB20CF
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC18C0	0_2_3BEC18C0
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB48C5	0_2_3BEB48C5
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEBD8A6	0_2_3BEBD8A6
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB68BA	0_2_3BEB68BA
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB48BD	0_2_3BEB48BD
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB40B6	0_2_3BEB40B6
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB4886	0_2_3BEB4886
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB4845	0_2_3BEB4845
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB405B	0_2_3BEB405B
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEBF054	0_2_3BEBF054
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB0027	0_2_3BEB0027
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB481A	0_2_3BEB481A
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB0FF2	0_2_3BEB0FF2
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC37C5	0_2_3BEC37C5
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC17A7	0_2_3BEC17A7
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB47A7	0_2_3BEB47A7
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC07BC	0_2_3BEC07BC
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC4F81	0_2_3BEC4F81
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB677A	0_2_3BEB677A
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC0742	0_2_3BEC0742
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC472C	0_2_3BEC472C
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEBD725	0_2_3BEBD725
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB46E5	0_2_3BEB46E5
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB86F3	0_2_3BEB86F3
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB46F1	0_2_3BEB46F1
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC46C0	0_2_3BEC46C0
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC7EC2	0_2_3BEC7EC2
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB46DA	0_2_3BEB46DA
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC0ED1	0_2_3BEC0ED1
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC0EA9	0_2_3BEC0EA9
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEBD685	0_2_3BEBD685
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB4666	0_2_3BEB4666
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEBD67C	0_2_3BEBD67C
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC2E73	0_2_3BEC2E73
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC4645	0_2_3BEC4645
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC1640	0_2_3BEC1640
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB765A	0_2_3BEB765A
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB3E09	0_2_3BEB3E09
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC0E1E	0_2_3BEC0E1E
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB661F	0_2_3BEB661F
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB461C	0_2_3BEB461C
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB3DE4	0_2_3BEB3DE4
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB3DF2	0_2_3BEB3DF2
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC0DDC	0_2_3BEC0DDC
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEBC5DD	0_2_3BEBC5DD
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEBD5D6	0_2_3BEBD5D6
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB3DA8	0_2_3BEB3DA8
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB45B1	0_2_3BEB45B1
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEC9584	0_2_3BEC9584
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB4D9B	0_2_3BEB4D9B
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEBD596	0_2_3BEBD596
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB3D70	0_2_3BEB3D70
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB4D08	0_2_3BEB4D08
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB4D1E	0_2_3BEB4D1E
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB751C	0_2_3BEB751C
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB4CF9	0_2_3BEB4CF9
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB4CF6	0_2_3BEB4CF6
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB4C92	0_2_3BEB4C92
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB4C66	0_2_3BEB4C66
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB4C51	0_2_3BEB4C51
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_3BEB9455	0_2_3BEB9455
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_04C63008	3_2_04C63008
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_04C62FF8	3_2_04C62FF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_09035250	3_2_09035250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_0903C5F0	3_2_0903C5F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_0903C917	3_2_0903C917
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_09033D38	3_2_09033D38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_09033D48	3_2_09033D48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_0903D620	3_2_0903D620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_09281528	3_2_09281528
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_09280910	3_2_09280910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_09286110	3_2_09286110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_09280C58	3_2_09280C58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_09281EE0	3_2_09281EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_09281EF0	3_2_09281EF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_092AE850	3_2_092AE850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_092ACED8	3_2_092ACED8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_092AE818	3_2_092AE818
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_092AE840	3_2_092AE840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_06EC3008	5_2_06EC3008
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_06EC2FF8	5_2_06EC2FF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_099A5250	5_2_099A5250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_099AC5DF	5_2_099AC5DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_099AC917	5_2_099AC917
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_099A88F6	5_2_099A88F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_099A3D38	5_2_099A3D38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_099A3D48	5_2_099A3D48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_099AD620	5_2_099AD620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09AF29F8	5_2_09AF29F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09AF1528	5_2_09AF1528
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09AF29EA	5_2_09AF29EA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09AF2C76	5_2_09AF2C76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09AF0C58	5_2_09AF0C58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09AF1EB8	5_2_09AF1EB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09AF1EF0	5_2_09AF1EF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09B1E850	5_2_09B1E850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09B1CED8	5_2_09B1CED8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09B1E818	5_2_09B1E818
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09B1E840	5_2_09B1E840

Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: String function: 005B1730 appears 36 times
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: String function: 005B1A30 appears 46 times

Source: AdobePDF.exe, 00000000.00000002.2667636281.00000000026AA000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameVppuhvl.exe" vs AdobePDF.exe

Source: AdobePDF.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal88.evad.winEXE@5/2@1/1

Source: C:\Users\user\Desktop\AdobePDF.exe

File created: C:\Users\user\Documents\Elaborate Bytes

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Mutant created: \Sessions\1\BaseNamedObjects\mono1234

Source: AdobePDF.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\AdobePDF.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: AdobePDF.exe	Virustotal: Detection: 12%
Source: AdobePDF.exe	ReversingLabs: Detection: 15%

Source: AdobePDF.exe	String found in binary or memory: error: --helphelp For more information try C:\Users\compile-bamboo\.cargo\registry\src\index.crates.io-6f17d22bba15001f\os_str_bytes-6.5.1\src\raw_str.rs
Source: AdobePDF.exe	String found in binary or memory: error: --helphelp For more information try C:\Users\compile-bamboo\.cargo\registry\src\index.crates.io-6f17d22bba15001f\os_str_bytes-6.5.1\src\raw_str.rs
Source: AdobePDF.exe	String found in binary or memory: error: --helphelp For more information try C:\Users\compile-bamboo\.cargo\registry\src\index.crates.io-6f17d22bba15001f\os_str_bytes-6.5.1\src\raw_str.rs
Source: AdobePDF.exe	String found in binary or memory: error: --helphelp For more information try C:\Users\compile-bamboo\.cargo\registry\src\index.crates.io-6f17d22bba15001f\os_str_bytes-6.5.1\src\raw_str.rs
Source: AdobePDF.exe	String found in binary or memory: --helphelp For more information try C:\Users\compile-bamboo\.cargo\registry\src\index.crates.io-6f17d22bba15001f\os_str_bytes-6.5.1\src\raw_str.rs
Source: AdobePDF.exe	String found in binary or memory: --helphelp For more information try C:\Users\compile-bamboo\.cargo\registry\src\index.crates.io-6f17d22bba15001f\os_str_bytes-6.5.1\src\raw_str.rs
Source: AdobePDF.exe	String found in binary or memory: --helphelp For more information try C:\Users\compile-bamboo\.cargo\registry\src\index.crates.io-6f17d22bba15001f\os_str_bytes-6.5.1\src\raw_str.rs
Source: AdobePDF.exe	String found in binary or memory: --helphelp For more information try C:\Users\compile-bamboo\.cargo\registry\src\index.crates.io-6f17d22bba15001f\os_str_bytes-6.5.1\src\raw_str.rs
Source: AdobePDF.exe	String found in binary or memory: --helphelp For more information try C:\Users\compile-bamboo\.cargo\registry\src\index.crates.io-6f17d22bba15001f\os_str_bytes-6.5.1\src\raw_str.rs
Source: AdobePDF.exe	String found in binary or memory: --helphelp For more information try C:\Users\compile-bamboo\.cargo\registry\src\index.crates.io-6f17d22bba15001f\os_str_bytes-6.5.1\src\raw_str.rs
Source: AdobePDF.exe	String found in binary or memory: error: --helphelpFor more information try C:\Users\compile-bamboo\.cargo\registry\src\index.crates.io-6f17d22bba15001f\os_str_bytes-6.5.1\src\raw_str.rs
Source: AdobePDF.exe	String found in binary or memory: error: --helphelpFor more information try C:\Users\compile-bamboo\.cargo\registry\src\index.crates.io-6f17d22bba15001f\os_str_bytes-6.5.1\src\raw_str.rs
Source: AdobePDF.exe	String found in binary or memory: --helphelpFor more information try C:\Users\compile-bamboo\.cargo\registry\src\index.crates.io-6f17d22bba15001f\os_str_bytes-6.5.1\src\raw_str.rs
Source: AdobePDF.exe	String found in binary or memory: --helphelpFor more information try C:\Users\compile-bamboo\.cargo\registry\src\index.crates.io-6f17d22bba15001f\os_str_bytes-6.5.1\src\raw_str.rs
Source: AdobePDF.exe	String found in binary or memory: --helpupdating self
Source: AdobePDF.exe	String found in binary or memory: --helpupdating self
Source: AdobePDF.exe	String found in binary or memory: iphlpapi.dllif_nametoindexkernel32LoadLibraryExA\/AddDllDirectoryh1h2h3%10s %512s %u %10s %512s %u "%64[^"]" %u %urt%s %s %u %s %s %u "%d%02d%02d %02d:%02d:%02d" %u %d
Source: AdobePDF.exe	String found in binary or memory: --helphelp
Source: AdobePDF.exe	String found in binary or memory: --helphelp
Source: AdobePDF.exe	String found in binary or memory: {before-help}{bin} {version}
Source: AdobePDF.exe	String found in binary or memory: {all-args}{after-help}{before-help}{bin} {version}
Source: AdobePDF.exe	String found in binary or memory: {usage}{after-help}
Source: AdobePDF.exe	String found in binary or memory: &{before-help}{bin} {version}
Source: AdobePDF.exe	String found in binary or memory: author-section}about-section}usage-heading}all-args}positionals}subcommands}after-help}before-help}
Source: AdobePDF.exe	String found in binary or memory: /author-section}about-section}usage-heading}all-args}positionals}subcommands}after-help}before-help}$W`k

Source: C:\Users\user\Desktop\AdobePDF.exe

File read: C:\Users\user\Desktop\AdobePDF.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\AdobePDF.exe "C:\Users\user\Desktop\AdobePDF.exe"
Source: C:\Users\user\Desktop\AdobePDF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Source: C:\Users\user\Desktop\AdobePDF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Source: C:\Users\user\Desktop\AdobePDF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"	Jump to behavior
Source: C:\Users\user\Desktop\AdobePDF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"	Jump to behavior

Source: C:\Users\user\Desktop\AdobePDF.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AdobePDF.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\AdobePDF.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\AdobePDF.exe	Section loaded: a.dll	Jump to behavior
Source: C:\Users\user\Desktop\AdobePDF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\AdobePDF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AdobePDF.exe	Section loaded: a.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: sspicli.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: AdobePDF.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: AdobePDF.exe

Static file information: File size 4024320 > 1048576

Source: AdobePDF.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x1b0e00
Source: AdobePDF.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x1a0a00

Source: AdobePDF.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: AdobePDF.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: AdobePDF.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: AdobePDF.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: AdobePDF.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: AdobePDF.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: AdobePDF.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: AdobePDF.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: protobuf-net.pdbSHA256}Lq source: csc.exe, 00000003.00000003.2636533396.0000000007FAB000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.2636533396.0000000007E71000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.4041206445.0000000009210000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.2718351296.0000000008651000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2718351296.000000000878B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2996398762.0000000009A80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: E:\builds\CST-RED-LCW\target\i686-pc-windows-msvc\release\deps\bdredline.pdb source: AdobePDF.exe, hdtach.exe.0.dr
Source:	Binary string: protobuf-net.pdb source: csc.exe, 00000003.00000003.2636533396.0000000007FAB000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.2636533396.0000000007E71000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.4041206445.0000000009210000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.2718351296.0000000008651000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2718351296.000000000878B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2996398762.0000000009A80000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation

Yara detected Costura Assembly Loader

Source: Yara match	File source: 5.2.csc.exe.9a20000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.csc.exe.7c192a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.csc.exe.83f92a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.csc.exe.91b0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4041169546.00000000091B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2995695195.0000000008373000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2995207906.00000000071D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2996359869.0000000009A20000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4040791036.0000000007B93000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4040377925.00000000069F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: csc.exe PID: 4256, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: csc.exe PID: 5776, type: MEMORYSTR

Source: C:\Users\user\Desktop\AdobePDF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Source: C:\Users\user\Desktop\AdobePDF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Source: C:\Users\user\Desktop\AdobePDF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"	Jump to behavior
Source: C:\Users\user\Desktop\AdobePDF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"	Jump to behavior

Source: AdobePDF.exe

Static PE information: real checksum: 0x27ecbf should be: 0x3da302

Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_009887D8 push ecx; retf 0000h	0_2_009887D9
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E387D8 push ecx; retf 0000h	0_2_00E387D9
Source: C:\Users\user\Desktop\AdobePDF.exe	Code function: 0_2_00E32FA9 pushfd ; retf	0_2_00E32FAA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_04C6696D push ebx; retf	3_2_04C66972
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_09033C81 push esp; retf	3_2_09033C8D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_09284FBB push dword ptr [esp+esi*2-75h]; iretd	3_2_09284FCC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_092AC230 pushad ; iretd	3_2_092AC251
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_06EC696D push ebx; retf	5_2_06EC6972
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 5_2_09B1C250 pushad ; iretd	5_2_09B1C251

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\AdobePDF.exe

File created: C:\Users\user\Documents\Elaborate Bytes\HD Tach\hdtach.exe

Jump to dropped file

Source: C:\Users\user\Desktop\AdobePDF.exe

File created: C:\Users\user\Documents\Elaborate Bytes\HD Tach\hdtach.exe

Jump to dropped file

Source: C:\Users\user\Desktop\AdobePDF.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run QualysDLP			Jump to behavior
Source: C:\Users\user\Desktop\AdobePDF.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run QualysDLP			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: csc.exe PID: 4256, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: csc.exe PID: 5776, type: MEMORYSTR

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 4C20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 69F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 6530000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 6E80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 71D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 6EF0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 344000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\AdobePDF.exe

Dropped PE file which has not been started: C:\Users\user\Documents\Elaborate Bytes\HD Tach\hdtach.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 3968	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 3968	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 5292	Thread sleep count: 200 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 3968	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 4144	Thread sleep time: -344000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 6196	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 344000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: csc.exe, 00000003.00000002.4041379915.0000000009518000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\AdobePDF.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Code function: 5_2_09B1EA90 LdrInitializeThunk,

5_2_09B1EA90

Source: C:\Users\user\Desktop\AdobePDF.exe

Code function: 0_2_00452E50 HeapReAlloc,GetProcessHeap,HeapAlloc,HeapFree,

0_2_00452E50

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\AdobePDF.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"

Jump to behavior

Source: C:\Users\user\Desktop\AdobePDF.exe

Code function: 0_2_00587A21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00587A21

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\AdobePDF.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 600000 protect: page readonly			Jump to behavior
Source: C:\Users\user\Desktop\AdobePDF.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 5070000 protect: page readonly			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\AdobePDF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 600000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\Desktop\AdobePDF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 5070000 value starts with: 4D5A			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\AdobePDF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 600000	Jump to behavior
Source: C:\Users\user\Desktop\AdobePDF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 249008	Jump to behavior
Source: C:\Users\user\Desktop\AdobePDF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 5070000	Jump to behavior
Source: C:\Users\user\Desktop\AdobePDF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 4C26008	Jump to behavior

Source: C:\Users\user\Desktop\AdobePDF.exe

Code function: 0_2_0047E360 cpuid

0_2_0047E360

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe VolumeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\AdobePDF.exe

Code function: 0_2_00588043 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00588043

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: csc.exe, 00000003.00000002.4039692396.00000000008C6000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000003.00000003.2419248892.00000000094E1000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2994360411.00000000053CF000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2996689817.0000000009DE1000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2692443303.0000000009DE1000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	131 Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	31 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	11 Disable or Modify Tools	LSASS Memory	141 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	141 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	31 Process Injection	NTDS	141 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	134 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
AdobePDF.exe	12%	Virustotal		Browse
AdobePDF.exe	16%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
newstaticfreepoint24.ddns-ip.net	181.71.216.203	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://curl.se/docs/hsts.html	AdobePDF.exe, hdtach.exe.0.dr	false	high
https://github.com/clap-rs/clap/issuesC:	hdtach.exe.0.dr	false	high
https://github.com/mgravell/protobuf-neti	csc.exe, 00000003.00000003.2636533396.0000000007FAB000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.2636533396.0000000007E71000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.4041206445.0000000009210000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.2718351296.0000000008651000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2718351296.000000000878B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2996398762.0000000009A80000.00000004.08000000.00040000.00000000.sdmp	false	high
https://stackoverflow.com/q/14436606/23354	csc.exe, 00000003.00000003.2636533396.0000000007FAB000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.2636533396.0000000007E71000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.4040377925.00000000069F1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.4041206445.0000000009210000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.2718351296.0000000008651000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2718351296.000000000878B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2995207906.00000000071D1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2996398762.0000000009A80000.00000004.08000000.00040000.00000000.sdmp	false	high
https://github.com/mgravell/protobuf-netJ	csc.exe, 00000003.00000003.2636533396.0000000007FAB000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.2636533396.0000000007E71000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.4041206445.0000000009210000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.2718351296.0000000008651000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2718351296.000000000878B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2996398762.0000000009A80000.00000004.08000000.00040000.00000000.sdmp	false	high
https://curl.se/docs/http-cookies.html	AdobePDF.exe, hdtach.exe.0.dr	false	high
https://stackoverflow.com/q/11564914/23354;	csc.exe, 00000003.00000003.2636533396.0000000007FAB000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.2636533396.0000000007E71000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.4041206445.0000000009210000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.2718351296.0000000008651000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2718351296.000000000878B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2996398762.0000000009A80000.00000004.08000000.00040000.00000000.sdmp	false	high
https://stackoverflow.com/q/2152978/23354	csc.exe, 00000003.00000003.2636533396.0000000007FAB000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.2636533396.0000000007E71000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.4041206445.0000000009210000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.2718351296.0000000008651000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2718351296.000000000878B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2996398762.0000000009A80000.00000004.08000000.00040000.00000000.sdmp	false	high
https://github.com/mgravell/protobuf-net	csc.exe, 00000003.00000003.2636533396.0000000007FAB000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.2636533396.0000000007E71000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.4041206445.0000000009210000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000005.00000003.2718351296.0000000008651000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000003.2718351296.000000000878B000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2996398762.0000000009A80000.00000004.08000000.00040000.00000000.sdmp	false	high
http://www.w3.or	AdobePDF.exe, hdtach.exe.0.dr	false	high
https://curl.se/docs/alt-svc.html	AdobePDF.exe, hdtach.exe.0.dr	false	high
https://github.com/clap-rs/clap/issues46	AdobePDF.exe, hdtach.exe.0.dr	false	high
https://github.com/clap-rs/clap/issuesSUBCOMMAND	hdtach.exe.0.dr	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	csc.exe, 00000003.00000002.4040377925.00000000069F1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.4040377925.0000000006C73000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.4040377925.0000000006A86000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2995207906.0000000007251000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2995207906.00000000071D1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000005.00000002.2995207906.000000000742B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/clap-rs/clap/issues	hdtach.exe.0.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
181.71.216.203	newstaticfreepoint24.ddns-ip.net	Colombia		27831	ColombiaMovilCO	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587430
Start date and time:	2025-01-10 11:43:20 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	AdobePDF.exe
Detection:	MAL
Classification:	mal88.evad.winEXE@5/2@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 92% Number of executed functions: 318 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 20.109.210.53
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtProtectVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:44:40	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run QualysDLP C:\Users\user\Documents\Elaborate Bytes\HD Tach\hdtach.exe
11:44:48	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run QualysDLP C:\Users\user\Documents\Elaborate Bytes\HD Tach\hdtach.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
181.71.216.203	AdobeReaderPDFonline.exe	Get hash	malicious	Unknown	Browse
	MicrosoftWORD.exe	Get hash	malicious	Unknown	Browse
	PDFonlineseguro.exe	Get hash	malicious	Unknown	Browse
	MicrosoftOfficeWord.exe	Get hash	malicious	Unknown	Browse
	AdobeReaderPDFonline.exe	Get hash	malicious	Unknown	Browse
	PDFonlineseguro.exe	Get hash	malicious	Unknown	Browse
	AdobePremierPDF.exe	Get hash	malicious	Unknown	Browse
	2LDJIyMl2r.exe	Get hash	malicious	Remcos	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
newstaticfreepoint24.ddns-ip.net	AdobeReaderPDFonline.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	MicrosoftWORD.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	PDFonlineseguro.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	MicrosoftOfficeWord.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	AdobeReaderPDFonline.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	PDFonlineseguro.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	AdobePremierPDF.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	2LDJIyMl2r.exe	Get hash	malicious	Remcos	Browse	181.71.216.203
	SHROsQyiAd.exe	Get hash	malicious	Remcos	Browse	181.131.217.244

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ColombiaMovilCO	AdobeReaderPDFonline.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	MicrosoftWORD.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	PDFonlineseguro.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	MicrosoftOfficeWord.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	AdobeReaderPDFonline.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	PDFonlineseguro.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	AdobePremierPDF.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	1736491685b40eefbc9bdfbc98216071e6ff3a4c19c7e1ab8a144cde35036665da85346b6b949.dat-decoded.exe	Get hash	malicious	Remcos	Browse	179.15.136.6
	6.elf	Get hash	malicious	Unknown	Browse	181.70.170.80

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	838
Entropy (8bit):	5.343981685113983
Encrypted:	false
SSDEEP:	24:ML9E4KlKDE4KhKiKhRAE4KzeosXE4qdKm:MxHKlYHKh3oRAHKzePHA
MD5:	9CCD52F7E666DC3225FA8A6D9120C198
SHA1:	35571A48C9F29765D69EFD69D95669B1A180BBD9
SHA-256:	965053376DFF2CDD816C41292E23666E3456504A75254130D620C3C5BB94949D
SHA-512:	8B66F632EEEF894527CD0EBF331E97E158A40668AC6D290F079449A03477542B609C5FA7AE1E6321093860B11CE697E2D4FECA24ADE51DC94608398B9BC81B54
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\96012833bebd5f21714fc508603cda97\System.Management.ni.dll",0..

C:\Users\user\Documents\Elaborate Bytes\HD Tach\hdtach.exe

Download File

Process:	C:\Users\user\Desktop\AdobePDF.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	959667331
Entropy (8bit):	0.06018102535485538
Encrypted:	false
SSDEEP:
MD5:	77793946BB70355EF6AD3C0BFB83C136
SHA1:	AE404DDCAD95BD6704D6F9899ED0E8C0E2F00873
SHA-256:	26958D28724FFBA5E101C0738D820625D3420D1D788F51F67ACE82A7800DC45D
SHA-512:	4022D771960228DF76B1187265305A1D4324C309508506E0ABFE1960A5A4ADF36B354AD7A08363CF7F4F6F75C3B91C396BD031A593E6D19C4203E6AB323B20DF
Malicious:	true
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......1..Yu...u...u...>...d...>.......>...c...:.;.s...:...R...:...g...:...m.......g...........>...v...u...r...u.........9.t.......t...Richu...........................PE..L...H..d.........."....".....V"......v....... ....@...........................=.......'...@..................................F#.......#...............&. .... &......C".T...................@D"......B".@............ ..h............................text............................... ..`.rdata...@... ...<..................@..@.data.... ...`#......N#.............@....rsrc.........#......^#.............@..@................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.849405076205069
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	AdobePDF.exe
File size:	4'024'320 bytes
MD5:	44cc93b896b10417f5d231088ffe6924
SHA1:	5def3a0114a71e6affd57d9bc7b9757bf4b6eb14
SHA256:	587d10cf5d8c91fe31141bad01719e6a99914010659ef951b1680e97559e7910
SHA512:	39d38f7baf6213fe7b651e942c7dc673d617d83f25549af3897fd69b51a70c1664096831d2eb725ba6edcc5c96ac291a7c073456e52bbe97b674fe7ebabc25e7
SSDEEP:	98304:ikJWBMZlJBcsrblAKE9E+Fi+MvhsE+NE+y0fR46+gjTkWU5QIi1DkR7ibtouu0qL:ikJWBMZlJBcsrblAKEW+E+MvhsE+NE+U
TLSH:	BE169F91E200D0A7D05B2174E00FEAF5A6323DB6B705DED397887E3E34716D22D396A9
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......1..Yu...u...u...>...d...>.......>...c...:.;.s...:...R...:...g...:...m.......g...........>...v...u...r...u.........9.t.......t..

File Icon


Icon Hash:	51e869694d69924d

Static PE Info

General

Entrypoint:	0x5876b2
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x64B8FF48 [Thu Jul 20 09:32:56 2023 UTC]
TLS Callbacks:	0x52dd90
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	c5269153981e562b1aed0a612d80f025

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
call 00007FC3F84C9D9Eh
jmp 00007FC3F84C9239h
int3
int3
int3
int3
push ebx
push esi
mov eax, dword ptr [esp+18h]
or eax, eax
jne 00007FC3F84C93DAh
mov ecx, dword ptr [esp+14h]
mov eax, dword ptr [esp+10h]
xor edx, edx
div ecx
mov ebx, eax
mov eax, dword ptr [esp+0Ch]
div ecx
mov edx, ebx
jmp 00007FC3F84C9403h
mov ecx, eax
mov ebx, dword ptr [esp+14h]
mov edx, dword ptr [esp+10h]
mov eax, dword ptr [esp+0Ch]
shr ecx, 1
rcr ebx, 1
shr edx, 1
rcr eax, 1
or ecx, ecx
jne 00007FC3F84C93B6h
div ebx
mov esi, eax
mul dword ptr [esp+18h]
mov ecx, eax
mov eax, dword ptr [esp+14h]
mul esi
add edx, ecx
jc 00007FC3F84C93D0h
cmp edx, dword ptr [esp+10h]
jnbe 00007FC3F84C93CAh
jc 00007FC3F84C93C9h
cmp eax, dword ptr [esp+0Ch]
jbe 00007FC3F84C93C3h
dec esi
xor edx, edx
mov eax, esi
pop esi
pop ebx
retn 0010h
push ebp
mov ebp, esp
test byte ptr [ebp+08h], 00000001h
push esi
mov esi, ecx
mov dword ptr [esi], 0061A9A8h
je 00007FC3F84C93CCh
push 0000000Ch
push esi
call 00007FC3F84CA038h
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
cmp ecx, dword ptr [00636510h]
jne 00007FC3F84C93C3h
ret
jmp 00007FC3F84C96B5h
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
push ebx
xor edi, edi
mov eax, dword ptr [esp+14h]
or eax, eax
jnl 00007FC3F84C93D6h
inc edi
mov edx, dword ptr [esp+10h]
neg eax
neg edx
sbb eax, 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2346ec	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x238000	0x1a08e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x26d200	0x8120	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x262000	0xd4a0	.rsrc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2243b0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x224440	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2242f0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1b2000	0x368	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1b1000	0x1b0e00	2cbf901d97457c56bc03658830ec27e4	False	0.49542146440947155	data	6.549341400084285	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1b2000	0x84000	0x83c00	8d2f67a016b283587097996d6458bdcf	False	0.4693559505455408	data	5.798902979613995	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x236000	0x2000	0x1000	491c26b7af8d659e4e2e6903dddc8341	False	0.228271484375	data	2.891116441211828	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x238000	0x1a08e0	0x1a0a00	70918993bb1497a9b7066a4a2a8fc853	False	0.591280026440144	data	7.002302548921975	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x238588	0xcf28	Device independent bitmap graphic, 552 x 24 x 32, image size 52992, resolution 3543 x 3543 px/m			0.4380374113742646
RT_BITMAP	0x2454b0	0x23f28	Device independent bitmap graphic, 920 x 40 x 32, image size 147200, resolution 3503 x 3503 px/m			0.3137190980711763
RT_BITMAP	0x2693d8	0x19f98	Device independent bitmap graphic, 782 x 34 x 32, image size 106352, resolution 3543 x 3543 px/m			0.3707891570794797
RT_BITMAP	0x283370	0x402a	Device independent bitmap graphic, 64 x 64 x 32, image size 16386, resolution 2834 x 2834 px/m			0.39419213442103984
RT_ICON	0x28739c	0x587b9	PC bitmap, Windows 3.x format, 45981 x 2 x 41, image size 362988, cbSize 362425, bits offset 54			0.9976105401117472
RT_ICON	0x2dfb58	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600			0.4078558225508318
RT_ICON	0x2e4fe0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688	English	United States	0.5551705756929638
RT_ICON	0x2e5e88	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	English	United States	0.680956678700361
RT_ICON	0x2e6730	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	English	United States	0.6683526011560693
RT_ICON	0x2e6c98	0xf532	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.0004142106101641
RT_ICON	0x2f61cc	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.25051756772743405
RT_ICON	0x3069f4	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.3019012753897024
RT_ICON	0x30ac1c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.3429460580912863
RT_ICON	0x30d1c4	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.4176829268292683
RT_ICON	0x30e26c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.3962765957446808
RT_STRING	0x30e6d4	0x11a4	data			0.5004428697962799
RT_RCDATA	0x30f878	0x46d3b	Delphi compiled form 'TfHint'			0.3806216327079319
RT_RCDATA	0x3565b4	0x46d3b	Delphi compiled form 'TfHint'			0.33296680190412503
RT_RCDATA	0x39d2f0	0x6a97	Delphi compiled form 'TfLinks'			0.5662036867372742
RT_RCDATA	0x3a3d88	0x5445	Delphi compiled form '\021TTechServiceFrame\020TechServiceFrame'			0.46646270801464795
RT_GROUP_ICON	0x3a91d0	0x84	data	English	United States	0.6742424242424242
RT_ANIICON	0x3a9254	0x2f689	PC bitmap, Windows 3.x format, 24374 x 2 x 49, image size 194811, cbSize 194185, bits offset 54			0.9943095501712285

Imports

DLL	Import
WINTRUST.dll	WinVerifyTrust
kernel32.dll	SetStdHandle, GetFileAttributesExW, GetCurrentProcessId, LCMapStringW, CompareStringW, GetTimeFormatW, GetDateFormatW, GetConsoleOutputCP, GetCommandLineA, WriteFile, GetModuleHandleExW, FreeLibraryAndExitThread, ExitThread, FileTimeToSystemTime, PeekNamedPipe, GetDriveTypeW, LoadLibraryExW, InitializeCriticalSectionAndSpinCount, SetLastError, FormatMessageW, QueryPerformanceCounter, GetTickCount, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, QueryPerformanceFrequency, GetSystemDirectoryA, FreeLibrary, GetModuleHandleA, LoadLibraryA, RaiseException, RtlUnwind, GetStartupInfoW, IsDebuggerPresent, Sleep, InitializeSListHead, GetCurrentThreadId, MultiByteToWideChar, WideCharToMultiByte, SetEndOfFile, SetHandleInformation, SetUnhandledExceptionFilter, UnhandledExceptionFilter, WaitForSingleObjectEx, GetModuleHandleW, GetProcAddress, GetLastError, LoadLibraryW, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, FindFirstFileExW, GetEnvironmentVariableA, SleepEx, VerSetConditionMask, VerifyVersionInfoW, CreateFileA, GetFileSizeEx, ReadFile, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetStringTypeW, GetTimeZoneInformation, DecodePointer, GetModuleFileNameW, SetErrorMode, SetThreadErrorMode, GetStdHandle, GetConsoleMode, GetFileInformationByHandleEx, TryAcquireSRWLockExclusive, GetConsoleScreenBufferInfo, SetConsoleTextAttribute, SetConsoleMode, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, SystemTimeToTzSpecificLocalTime, ReleaseMutex, GetCurrentProcess, GetCurrentThread, RtlCaptureContext, CreateMutexA, FreeEnvironmentStringsW, FindClose, ReleaseSRWLockShared, CompareStringOrdinal, AddVectoredExceptionHandler, SetThreadStackGuarantee, SwitchToThread, GetCurrentDirectoryW, GetEnvironmentStringsW, GetEnvironmentVariableW, SetEnvironmentVariableW, CloseHandle, TlsGetValue, GetCommandLineW, FlushFileBuffers, DuplicateHandle, SetFilePointerEx, WriteFileEx, ReadFileEx, WaitForSingleObject, GetExitCodeProcess, TerminateProcess, GetProcessHeap, HeapAlloc, HeapFree, HeapReAlloc, AcquireSRWLockShared, FindNextFileW, CreateFileW, GetFileInformationByHandle, IsProcessorFeaturePresent, MoveFileExA, CreateDirectoryW, FindFirstFileW, DeleteFileW, MoveFileExW, GetFinalPathNameByHandleW, CopyFileExW, CreateEventW, GetOverlappedResult, CancelIo, GetFileType, SetCurrentDirectoryW, ExitProcess, GetFullPathNameW, CreateNamedPipeW, WaitForMultipleObjects, GetSystemDirectoryW, GetWindowsDirectoryW, CreateProcessW, GetFileAttributesW, TlsSetValue, WriteConsoleW, ReadConsoleW, CreateThread, InitOnceBeginInitialize, TlsAlloc, InitOnceComplete, TlsFree, GetSystemTimeAsFileTime, HeapSize
advapi32.dll	CryptDestroyHash, CryptHashData, CryptCreateHash, CryptGetHashParam, CryptReleaseContext, RegisterServiceCtrlHandlerExW, SetServiceStatus, StartServiceCtrlDispatcherW, CryptAcquireContextA, SystemFunction036
crypt32.dll	CryptStringToBinaryA, CertGetEnhancedKeyUsage, CertCloseStore, CertOpenStore, PFXImportCertStore, CertAddCertificateContextToStore, CertEnumCertificatesInStore, CertFreeCertificateChain, CertGetCertificateChain, CertFreeCertificateChainEngine, CertCreateCertificateChainEngine, CryptQueryObject, CertGetNameStringA, CertFindExtension, CryptDecodeObjectEx, CertFindCertificateInStore, CertDuplicateCertificateContext, CertFreeCertificateContext
ws2_32.dll	select, __WSAFDIsSet, socket, htons, WSACleanup, WSAStartup, WSASetLastError, htonl, WSAGetLastError, WSAWaitForMultipleEvents, WSAResetEvent, WSAEventSelect, WSAEnumNetworkEvents, getaddrinfo, WSACloseEvent, ntohs, setsockopt, send, recv, getsockopt, getpeername, getsockname, accept, listen, ioctlsocket, connect, bind, WSASocketW, closesocket, freeaddrinfo, WSAIoctl, WSACreateEvent
bcrypt.dll	BCryptGenRandom
ntdll.dll	RtlNtStatusToDosError, NtWriteFile, NtReadFile

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 11:44:41.970103025 CET	49850	30203	192.168.2.6	181.71.216.203
Jan 10, 2025 11:44:41.974966049 CET	30203	49850	181.71.216.203	192.168.2.6
Jan 10, 2025 11:44:41.975131989 CET	49850	30203	192.168.2.6	181.71.216.203
Jan 10, 2025 11:44:42.015177011 CET	49850	30203	192.168.2.6	181.71.216.203
Jan 10, 2025 11:44:42.020025969 CET	30203	49850	181.71.216.203	192.168.2.6
Jan 10, 2025 11:44:42.020083904 CET	49850	30203	192.168.2.6	181.71.216.203
Jan 10, 2025 11:44:42.024961948 CET	30203	49850	181.71.216.203	192.168.2.6
Jan 10, 2025 11:45:03.338078976 CET	30203	49850	181.71.216.203	192.168.2.6
Jan 10, 2025 11:45:03.338681936 CET	49850	30203	192.168.2.6	181.71.216.203
Jan 10, 2025 11:45:03.349859953 CET	49850	30203	192.168.2.6	181.71.216.203
Jan 10, 2025 11:45:03.354830980 CET	30203	49850	181.71.216.203	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 11:44:41.944202900 CET	61893	53	192.168.2.6	1.1.1.1
Jan 10, 2025 11:44:41.966157913 CET	53	61893	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 11:44:41.944202900 CET	192.168.2.6	1.1.1.1	0xc3ac	Standard query (0)	newstaticfreepoint24.ddns-ip.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 11:44:41.966157913 CET	1.1.1.1	192.168.2.6	0xc3ac	No error (0)	newstaticfreepoint24.ddns-ip.net		181.71.216.203	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	05:44:17
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\AdobePDF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\AdobePDF.exe"
Imagebase:	0x400000
File size:	4'024'320 bytes
MD5 hash:	44CC93B896B10417F5D231088FFE6924
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:44:37
Start date:	10/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Imagebase:	0x9a0000
File size:	2'141'552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000003.00000002.4041169546.00000000091B0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000003.00000002.4040791036.0000000007B93000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000003.00000002.4040377925.00000000069F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	05:45:05
Start date:	10/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Imagebase:	0x9a0000
File size:	2'141'552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000005.00000002.2995695195.0000000008373000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000005.00000002.2995207906.00000000071D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000005.00000002.2996359869.0000000009A20000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	15.2%
Dynamic/Decrypted Code Coverage:	65%
Signature Coverage:	10.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	62

Executed Functions

Function 3BEBFC6B Relevance: 24.9, APIs: 1, Strings: 13, Instructions: 422
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 3BEBFFDF

Strings

e, xrefs: 3BEC005F
l, xrefs: 3BEC0058
t, xrefs: 3BEC0043
G, xrefs: 3BEC0035
PNM5, xrefs: 3BEC01AA
e, xrefs: 3BEC007B
i, xrefs: 3BEC0051
e, xrefs: 3BEC003C
F, xrefs: 3BEC004A
i, xrefs: 3BEC006D
S, xrefs: 3BEC0066
3:7B, xrefs: 3BEC05C4
z, xrefs: 3BEC0074

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateFile
String ID: 3:7B$F$G$PNM5$S$e$e$e$i$i$l$t$z
API String ID: 823142352-306576767
Opcode ID: a585066e22a4095691a59ce8abc98416cea7ba8de44c94a35e6523025f6b1265
Instruction ID: ce20279f519e2e937f97dabe01c4b9c84374e2358785bd8733e7d3600d2e883c
Opcode Fuzzy Hash: a585066e22a4095691a59ce8abc98416cea7ba8de44c94a35e6523025f6b1265
Instruction Fuzzy Hash: 66F146B1D082A58AFB20CA28DD84BEB7B75EF81314F0481F9D94C67681D6794FD18F92

Function 3BEBC5DD Relevance: 24.3, APIs: 1, Strings: 15, Instructions: 339
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

C, xrefs: 3BEBE0D5
a, xrefs: 3BEBE0EA
P?L=, xrefs: 3BEBD55F
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0E3
^P, xrefs: 3BEBD5C0
F, xrefs: 3BEBE0FF
e, xrefs: 3BEBE0F8
i, xrefs: 3BEBE106
t, xrefs: 3BEBE0F1
W, xrefs: 3BEBE11B
e, xrefs: 3BEBE114
5P5M, xrefs: 3BEBE0B8
r, xrefs: 3BEBE0DC
_W, xrefs: 3BEBE0AE

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID: 5P5M$C$F$P?L=$W$^P$_W$a$e$e$e$i$l$r$t
API String ID: 0-4150171463
Opcode ID: b8485887a7e33a0b4052db163afa3efa1c86d06ce3875aaa384cb55abad77e0f
Instruction ID: 8eff32f741b479e5529509ef3f8b91041dd543b2f310c2385b7dfbcd8c6d38b0
Opcode Fuzzy Hash: b8485887a7e33a0b4052db163afa3efa1c86d06ce3875aaa384cb55abad77e0f
Instruction Fuzzy Hash: 72C14AF2D082549FFB14CB28DC59BEB7B78EB91314F0480FAD90D56280D67D5AC68A63

Function 3BEBD596 Relevance: 22.8, APIs: 1, Strings: 14, Instructions: 273
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

C, xrefs: 3BEBE0D5
a, xrefs: 3BEBE0EA
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0E3
^P, xrefs: 3BEBD5C0
F, xrefs: 3BEBE0FF
e, xrefs: 3BEBE0F8
i, xrefs: 3BEBE106
t, xrefs: 3BEBE0F1
W, xrefs: 3BEBE11B
e, xrefs: 3BEBE114
5P5M, xrefs: 3BEBE0B8
r, xrefs: 3BEBE0DC
_W, xrefs: 3BEBE0AE

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID: 5P5M$C$F$W$^P$_W$a$e$e$e$i$l$r$t
API String ID: 0-3650445608
Opcode ID: aac97f47407c8053540d91d15cea422ec1562f14f306bffc4a7a9c1790143d39
Instruction ID: 3eba7becf474da7e1c4b63c29e8b94bee7b1c06405eab2e04452f5327b00eca5
Opcode Fuzzy Hash: aac97f47407c8053540d91d15cea422ec1562f14f306bffc4a7a9c1790143d39
Instruction Fuzzy Hash: 76917AB2D082589FFB24C728DC59BEB7B68DB81314F0440FED80D56681DA7D5EC68A63

Function 3BEBD67C Relevance: 22.7, APIs: 1, Strings: 14, Instructions: 209
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

C, xrefs: 3BEBE0D5
a, xrefs: 3BEBE0EA
3EF4, xrefs: 3BEBD67C
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0E3
F, xrefs: 3BEBE0FF
e, xrefs: 3BEBE0F8
i, xrefs: 3BEBE106
t, xrefs: 3BEBE0F1
W, xrefs: 3BEBE11B
e, xrefs: 3BEBE114
5P5M, xrefs: 3BEBE0B8
r, xrefs: 3BEBE0DC
_W, xrefs: 3BEBE0AE

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 3EF4$5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3006875395
Opcode ID: 1f3159f272e2475ea0b8efac505ace3a6763449ae096e71ec23b8b93e50727dc
Instruction ID: 59be6971a0d5f49adbd8d794c2f8f2585e32c5928e710c9024b710e2e9bb9fc9
Opcode Fuzzy Hash: 1f3159f272e2475ea0b8efac505ace3a6763449ae096e71ec23b8b93e50727dc
Instruction Fuzzy Hash: 4E7149B2D0C2689EFB24C728DC89BDB7B68DB41314F0440FAD94C56281D67D5EC68AA3

Function 3BEBD5D6 Relevance: 21.3, APIs: 1, Strings: 13, Instructions: 254
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

C, xrefs: 3BEBE0D5
a, xrefs: 3BEBE0EA
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0E3
F, xrefs: 3BEBE0FF
e, xrefs: 3BEBE0F8
i, xrefs: 3BEBE106
t, xrefs: 3BEBE0F1
W, xrefs: 3BEBE11B
e, xrefs: 3BEBE114
5P5M, xrefs: 3BEBE0B8
r, xrefs: 3BEBE0DC
_W, xrefs: 3BEBE0AE

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: 60d55f7e49cf88aedff0039c5da0411b637dfab33f89107f7f83c44f389ec987
Instruction ID: 0d33d3e364c66e3f473adf7605ee6aaf54505c83de24af124a80a7938d0581ce
Opcode Fuzzy Hash: 60d55f7e49cf88aedff0039c5da0411b637dfab33f89107f7f83c44f389ec987
Instruction Fuzzy Hash: 269158B2D082589FFB24CB28DC59BEB7B68DB91314F0441FED80C16681D67D5EC68A63

Function 3BEBD92D Relevance: 21.2, APIs: 1, Strings: 13, Instructions: 246COMMON

Download Yara Rule

Strings

C, xrefs: 3BEBE0D5
a, xrefs: 3BEBE0EA
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0E3
F, xrefs: 3BEBE0FF
e, xrefs: 3BEBE0F8
i, xrefs: 3BEBE106
t, xrefs: 3BEBE0F1
W, xrefs: 3BEBE11B
e, xrefs: 3BEBE114
5P5M, xrefs: 3BEBE0B8
r, xrefs: 3BEBE0DC
_W, xrefs: 3BEBE0AE

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 0-3741801046
Opcode ID: 221986f34f902f84739f456817315552a3ed21400c2fd6772d97aad00215e27f
Instruction ID: 65750d0eb395550f76505488c38df6f3c947c9977290d332ce3e89135177acff
Opcode Fuzzy Hash: 221986f34f902f84739f456817315552a3ed21400c2fd6772d97aad00215e27f
Instruction Fuzzy Hash: D8815CB2D082689FFB24C728DC49AEB7B74DF42314F0441FAD84C16681D67D5EC68A63

Function 3BEBD8A6 Relevance: 21.2, APIs: 1, Strings: 13, Instructions: 239COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 3BEBE09D

Strings

C, xrefs: 3BEBE0D5
a, xrefs: 3BEBE0EA
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0E3
F, xrefs: 3BEBE0FF
e, xrefs: 3BEBE0F8
i, xrefs: 3BEBE106
t, xrefs: 3BEBE0F1
W, xrefs: 3BEBE11B
e, xrefs: 3BEBE114
5P5M, xrefs: 3BEBE0B8
r, xrefs: 3BEBE0DC
_W, xrefs: 3BEBE0AE

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: efd4a9f007888a262357efecc2e88af222ff4f8596168ecaed9e80c832c01fa9
Instruction ID: 83745cf46b28cc9f66376e9c4082e15ecd89a4647c900b7030e3685be02492d5
Opcode Fuzzy Hash: efd4a9f007888a262357efecc2e88af222ff4f8596168ecaed9e80c832c01fa9
Instruction Fuzzy Hash: C4816BB2D082689EFB24C728DC59BEB7B78DF81714F0440FAD84C56680DA7D5AC5CA63

Function 3BEBD685 Relevance: 21.2, APIs: 1, Strings: 13, Instructions: 208COMMON

Download Yara Rule

Strings

C, xrefs: 3BEBE0D5
a, xrefs: 3BEBE0EA
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0E3
F, xrefs: 3BEBE0FF
e, xrefs: 3BEBE0F8
i, xrefs: 3BEBE106
t, xrefs: 3BEBE0F1
W, xrefs: 3BEBE11B
e, xrefs: 3BEBE114
5P5M, xrefs: 3BEBE0B8
r, xrefs: 3BEBE0DC
_W, xrefs: 3BEBE0AE

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: 04b2870e4ee60f6e709d4db37dc8311052e61eba39c442a95dd2a82964225acc
Instruction ID: f8db2979b4dbbab73fa6a5618e4986b0847f909ee9cb9a2f9cef98711f696169
Opcode Fuzzy Hash: 04b2870e4ee60f6e709d4db37dc8311052e61eba39c442a95dd2a82964225acc
Instruction Fuzzy Hash: 3A713AB2D082689EFB24C728DC59BD77B64DF51314F0440FAD94C16281DA7D5AC68AA3

Function 3BEBDA3B Relevance: 21.2, APIs: 1, Strings: 13, Instructions: 204COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 3BEBE09D

Strings

C, xrefs: 3BEBE0D5
a, xrefs: 3BEBE0EA
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0E3
F, xrefs: 3BEBE0FF
e, xrefs: 3BEBE0F8
i, xrefs: 3BEBE106
t, xrefs: 3BEBE0F1
W, xrefs: 3BEBE11B
e, xrefs: 3BEBE114
5P5M, xrefs: 3BEBE0B8
r, xrefs: 3BEBE0DC
_W, xrefs: 3BEBE0AE

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: 783f3da648ad80af0167e4ebb0f72c09dcec68fb8928d0fc27bc9bc02b289132
Instruction ID: 3a4370c5283c1a7aa41a642f6aa83fe79ba204788481a91c55926d05cc8c1667
Opcode Fuzzy Hash: 783f3da648ad80af0167e4ebb0f72c09dcec68fb8928d0fc27bc9bc02b289132
Instruction Fuzzy Hash: 9B614AB2D082689EFB24C728DC49BEB7B78DB81314F0440FAD84D56281D67D5EC68A63

Function 026BDA3B Relevance: 21.2, APIs: 1, Strings: 13, Instructions: 204COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 026BE09D

Strings

C, xrefs: 026BE0D5
W, xrefs: 026BE11B
t, xrefs: 026BE0F1
F, xrefs: 026BE0FF
5P5M, xrefs: 026BE0B8
e, xrefs: 026BE114
e, xrefs: 026BE0E3
l, xrefs: 026BE10D
e, xrefs: 026BE0F8
a, xrefs: 026BE0EA
_W, xrefs: 026BE0AE
r, xrefs: 026BE0DC
i, xrefs: 026BE106

Memory Dump Source

Source File: 00000000.00000002.2667740199.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26b0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: 783f3da648ad80af0167e4ebb0f72c09dcec68fb8928d0fc27bc9bc02b289132
Instruction ID: 29c69726763d72b31f936bb4a6035f4a89917a6c2315b90c23901f0fd044a2a7
Opcode Fuzzy Hash: 783f3da648ad80af0167e4ebb0f72c09dcec68fb8928d0fc27bc9bc02b289132
Instruction Fuzzy Hash: 9C6136B2D081A49EF7248624DC49BEBBB69DF81310F0440FAD84D16281D67E5AC6CFA3

Function 3BEBD9A7 Relevance: 21.2, APIs: 1, Strings: 13, Instructions: 202COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 3BEBE09D

Strings

C, xrefs: 3BEBE0D5
a, xrefs: 3BEBE0EA
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0E3
F, xrefs: 3BEBE0FF
e, xrefs: 3BEBE0F8
i, xrefs: 3BEBE106
t, xrefs: 3BEBE0F1
W, xrefs: 3BEBE11B
e, xrefs: 3BEBE114
5P5M, xrefs: 3BEBE0B8
r, xrefs: 3BEBE0DC
_W, xrefs: 3BEBE0AE

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: 0a88f08a84d02579a82e252aca950a88f92323fa763318397690219be4a14cc0
Instruction ID: 8a669ad4617b0f76685192df6b99a1f899f6b1fbd3a62f9b510590eaec999d00
Opcode Fuzzy Hash: 0a88f08a84d02579a82e252aca950a88f92323fa763318397690219be4a14cc0
Instruction Fuzzy Hash: 866139B2D082689EFB24C728DC59BDBBB78DB41314F0440FAD84D16281DA7D5EC68A63

Function 3BEBD725 Relevance: 21.2, APIs: 1, Strings: 13, Instructions: 201COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 3BEBE09D

Strings

C, xrefs: 3BEBE0D5
a, xrefs: 3BEBE0EA
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0E3
F, xrefs: 3BEBE0FF
e, xrefs: 3BEBE0F8
i, xrefs: 3BEBE106
t, xrefs: 3BEBE0F1
W, xrefs: 3BEBE11B
e, xrefs: 3BEBE114
5P5M, xrefs: 3BEBE0B8
r, xrefs: 3BEBE0DC
_W, xrefs: 3BEBE0AE

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: 418ea4fcaf690e461b8a124f6b4756ded07c8140c36dae6f3b69dbd989b13edd
Instruction ID: da4661cb11c65aac05ac7e2418e1a1b66816ac166767fa650c53876d2bd49486
Opcode Fuzzy Hash: 418ea4fcaf690e461b8a124f6b4756ded07c8140c36dae6f3b69dbd989b13edd
Instruction Fuzzy Hash: 23615CB2D082589EFB24C728DC49BDBBB78DB91314F0440FAD84C16281D67D5EC68A63

Function 3BEBD6A3 Relevance: 21.2, APIs: 1, Strings: 13, Instructions: 199COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 3BEBE09D

Strings

C, xrefs: 3BEBE0D5
a, xrefs: 3BEBE0EA
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0E3
F, xrefs: 3BEBE0FF
e, xrefs: 3BEBE0F8
i, xrefs: 3BEBE106
t, xrefs: 3BEBE0F1
W, xrefs: 3BEBE11B
e, xrefs: 3BEBE114
5P5M, xrefs: 3BEBE0B8
r, xrefs: 3BEBE0DC
_W, xrefs: 3BEBE0AE

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: 570dbe96a03a2309e570ae95afc1d75423d5ca5492648b1f52c7618e6bc1d7bd
Instruction ID: af9f8d144e9dace97b90fcdf1e71036cf6d3770352c3393cdd3dfe48a9fc1ac1
Opcode Fuzzy Hash: 570dbe96a03a2309e570ae95afc1d75423d5ca5492648b1f52c7618e6bc1d7bd
Instruction Fuzzy Hash: 606149B2D082689EFB24C728DC49BDBBB78DB41314F0440FAD84D56281D67D5EC68AA3

Function 3BEBDA68 Relevance: 21.2, APIs: 1, Strings: 13, Instructions: 194COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 3BEBE09D

Strings

C, xrefs: 3BEBE0D5
a, xrefs: 3BEBE0EA
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0E3
F, xrefs: 3BEBE0FF
e, xrefs: 3BEBE0F8
i, xrefs: 3BEBE106
t, xrefs: 3BEBE0F1
W, xrefs: 3BEBE11B
e, xrefs: 3BEBE114
5P5M, xrefs: 3BEBE0B8
r, xrefs: 3BEBE0DC
_W, xrefs: 3BEBE0AE

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: f276221dcb1f148b786d1f4b89d12d0d7a8214e7e794047e0f51c4e6acf860e9
Instruction ID: 4620bea5babb222a0b7c14b39e023da81a0a671ecab55006e5539914c7243ada
Opcode Fuzzy Hash: f276221dcb1f148b786d1f4b89d12d0d7a8214e7e794047e0f51c4e6acf860e9
Instruction Fuzzy Hash: C46129B2D082689EFB24C728DC49BDBBB74DB91314F0440FAD84D16281D67D5EC68BA3

Function 026BDA68 Relevance: 21.2, APIs: 1, Strings: 13, Instructions: 194COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 026BE09D

Strings

C, xrefs: 026BE0D5
W, xrefs: 026BE11B
t, xrefs: 026BE0F1
F, xrefs: 026BE0FF
5P5M, xrefs: 026BE0B8
e, xrefs: 026BE114
e, xrefs: 026BE0E3
l, xrefs: 026BE10D
e, xrefs: 026BE0F8
a, xrefs: 026BE0EA
_W, xrefs: 026BE0AE
r, xrefs: 026BE0DC
i, xrefs: 026BE106

Memory Dump Source

Source File: 00000000.00000002.2667740199.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26b0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: f276221dcb1f148b786d1f4b89d12d0d7a8214e7e794047e0f51c4e6acf860e9
Instruction ID: 4a66115d61604d56b4fc49737d57fd045c7ab34a5c54afa3fe37d460e72d871f
Opcode Fuzzy Hash: f276221dcb1f148b786d1f4b89d12d0d7a8214e7e794047e0f51c4e6acf860e9
Instruction Fuzzy Hash: 166125B2D081A49EF7258624DC49BEBBB69DF91310F0440FAD84D16281D67E5EC6CFA3

Function 00540B40 Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 472COMMON

Download Yara Rule

Strings

e|, xrefs: 00540D17
A998, xrefs: 00540C74
3, xrefs: 00540D68

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID:
String ID: A998$e|$3
API String ID: 0-38523410
Opcode ID: 408a7830ef450858897fe0f000d71361db43786ad0d13a5b169aebc68a952048
Instruction ID: 1b34c731cd5d747cd9c2b0bb724f2a453b0cb7861124cdb7c6694c3612841721
Opcode Fuzzy Hash: 408a7830ef450858897fe0f000d71361db43786ad0d13a5b169aebc68a952048
Instruction Fuzzy Hash: C1128FB1E042289FEB248B18DC95BEABB75FF85314F1481EAD94D66280E6345FC1CF52

Function 00E4A3CA Relevance: 6.4, APIs: 1, Strings: 3, Instructions: 450COMMON

Download Yara Rule

Strings

e|, xrefs: 00E4A6A0
NGO2, xrefs: 00E4A96F
3, xrefs: 00E4A6F1

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID:
String ID: NGO2$e|$3
API String ID: 0-1385288365
Opcode ID: a541d9e685578881a0a3820b6711f6c956e83055bd975bbd285d7d8610155068
Instruction ID: 0a990f82e4599d36ea5cceffe38c6ea930c4a6af653c981c45f244e4cea61600
Opcode Fuzzy Hash: a541d9e685578881a0a3820b6711f6c956e83055bd975bbd285d7d8610155068
Instruction Fuzzy Hash: B302C0B1D042289AEB248B14EC947EAB7B5FF84324F1441FAD90DA2280E7385FC1CF52

Function 3BEC499C Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 448fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 3BEC5DA9

Strings

3, xrefs: 3BEC4ADB
e|, xrefs: 3BEC4A8A

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID: e|$3
API String ID: 2738559852-1726640827
Opcode ID: 2eeb45d96253b2151884a32a0819689958bf91d8e66806803fcb42383f478f7e
Instruction ID: 3e90767d62a35e8a258bdd8fd379473736f81bee3f65a08a2d13f54ee794c28a
Opcode Fuzzy Hash: 2eeb45d96253b2151884a32a0819689958bf91d8e66806803fcb42383f478f7e
Instruction Fuzzy Hash: 3A02BFB2D046289FF724CA18DD55AEBB7B5EFC4314F1481FAD80EA6640DA385FC18E52

Function 3BEBEB80 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 362COMMON

Download Yara Rule

Strings

3, xrefs: 3BEBED01
e|, xrefs: 3BEBECB0

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID: e|$3
API String ID: 0-1726640827
Opcode ID: a12b1f3561323e3a9e50ca8666f686866bebdad2c6da165e4b84fc490f9cf642
Instruction ID: efc3905305ad65e81ffd4e0942f93629c03f460228ea0d8b3f58e48c5adf69fa
Opcode Fuzzy Hash: a12b1f3561323e3a9e50ca8666f686866bebdad2c6da165e4b84fc490f9cf642
Instruction Fuzzy Hash: 6DE193B1D097289BEB28CB18DC95BEAB7B5EF44314F0441FAE90D62240E6755EC1CF52

Function 00E52964 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 352threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 00E53D9D

Strings

e|, xrefs: 00E52A8E
3, xrefs: 00E52ADF

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: ContextThreadWow64
String ID: e|$3
API String ID: 983334009-1726640827
Opcode ID: 6e2f2b2faca6fc602cd4f13d881d176325e7490ec863806486e630edf7a15016
Instruction ID: 16e16e8593a6a0817364af3ff6e697805c8b0b101047475c6d7bd11ef19c1205
Opcode Fuzzy Hash: 6e2f2b2faca6fc602cd4f13d881d176325e7490ec863806486e630edf7a15016
Instruction Fuzzy Hash: 57D1C4B1D056689BEB288B28DC44AEABBB5EF85300F1441FED90D62341E6395FC5CF51

Function 3BEB68BA Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 307COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Strings

e|, xrefs: 3BEB69E4
3, xrefs: 3BEB6A35

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID: e|$3
API String ID: 4241100979-1726640827
Opcode ID: be98b870f768b0764863c02b9be51a5480b9b19a110dc00e1caf068c91e24aa8
Instruction ID: fc27590b7184e338625be3469bda82fb3bb21c2aa993ce36c4f1fdb9c68e1c44
Opcode Fuzzy Hash: be98b870f768b0764863c02b9be51a5480b9b19a110dc00e1caf068c91e24aa8
Instruction Fuzzy Hash: 21C190B5D086688FEF25CB28DC916E9B7B5EF94310F0481EAE40DA6240EB395EC5CF11

Function 3BEB7276 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 277COMMON

Download Yara Rule

Strings

"r;, xrefs: 3BEB73C7
:FOK, xrefs: 3BEB7517

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID: "r;$:FOK
API String ID: 0-3416402625
Opcode ID: 0846f8f9e150cba83b22e891948e0deff9d1d4075edb240d1670727adb4aeb6b
Instruction ID: 244597cbc4fc1e728f49279ed45c859352b942b33bef57bc3110fcb74e3d3bfd
Opcode Fuzzy Hash: 0846f8f9e150cba83b22e891948e0deff9d1d4075edb240d1670727adb4aeb6b
Instruction Fuzzy Hash: C9A1F8F2D182545FF724CB28DC55AEB7B78EB85310F0441BAD84D96B80E63C5EC68E52

Function 005479AE Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 262memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00548D68

Strings

e|, xrefs: 00547AA7
3, xrefs: 00547AF8

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID: e|$3
API String ID: 544645111-1726640827
Opcode ID: cae61e771cb22d1ec9d6fb730fdf224020caad320cfa2fbf794f33348327e58f
Instruction ID: 24e771bb10c9e2469c13deddb57dda4bc22028dbf25eb96fdff3aa0456e7b3a9
Opcode Fuzzy Hash: cae61e771cb22d1ec9d6fb730fdf224020caad320cfa2fbf794f33348327e58f
Instruction Fuzzy Hash: 8FB19DB1E046698BEB24CB19CC85BEABBB4FF89314F1441EAD94D62240EB745EC1CE51

Function 3BEB765A Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Strings

"r;, xrefs: 3BEB73C7
:FOK, xrefs: 3BEB7517

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID: "r;$:FOK
API String ID: 4241100979-3416402625
Opcode ID: 5d7c9b944ede05850c535b242fa95d66b2bf6c21ba4a591a6506e7dd900abac3
Instruction ID: f15bee6afc844a4c07ddd7ae29b88d1424face8153b13e5102b5f124da52862c
Opcode Fuzzy Hash: 5d7c9b944ede05850c535b242fa95d66b2bf6c21ba4a591a6506e7dd900abac3
Instruction Fuzzy Hash: 309105F2C082685BFB20CB58DC45AEB7B74EF45314F0441BAD84DA6741EA785EC58E92

Function 00548201 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 171memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00548D68

Strings

EBM>, xrefs: 0054832E
V, xrefs: 00548338

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID: EBM>$V
API String ID: 544645111-4161760328
Opcode ID: 511fef2b0f98a73f72e07aea0ef24c1aaa7b19639a44f31e7bddc568de755ee3
Instruction ID: 59bde955e8c769a57cfa2723741041c1c349ffceb5d014491f68f0e53aa6f794
Opcode Fuzzy Hash: 511fef2b0f98a73f72e07aea0ef24c1aaa7b19639a44f31e7bddc568de755ee3
Instruction Fuzzy Hash: 3F5178B2D082915FF7108635DC48AFB7FB8FB80314F1484BAD84D96581D97C5EC68BA2

Function 00E35B99 Relevance: 4.9, APIs: 1, Strings: 2, Instructions: 436memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00E36AF4

Strings

_W, xrefs: 00E3653F
S, xrefs: 00E36088

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: S$_W
API String ID: 4275171209-1850906522
Opcode ID: a918a72dc0a519a873edfe62635adec78017186bf787e2d298642e1a91a5477a
Instruction ID: b913649ab68864febd3c1dd8f686c3754c65dec32960f9bf4c3bd7a71cb012ca
Opcode Fuzzy Hash: a918a72dc0a519a873edfe62635adec78017186bf787e2d298642e1a91a5477a
Instruction Fuzzy Hash: 8EF104B2D045645FE7208A24DC98BEBBBB9EB81315F1881FAD80DA6281D63C5FC5CF51

Function 00E35702 Relevance: 4.8, APIs: 1, Strings: 2, Instructions: 283COMMON

Download Yara Rule

Strings

3, xrefs: 00E35835
e|, xrefs: 00E357E4

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: e|$3
API String ID: 4275171209-1726640827
Opcode ID: 71a8212799ce9897f3b55d2e416be865066c5f18f8e16b7ebea9f0bd523dd697
Instruction ID: e3e77773356d1dba2d012de368662826de00833dad902ce388ecf5a141e3c79e
Opcode Fuzzy Hash: 71a8212799ce9897f3b55d2e416be865066c5f18f8e16b7ebea9f0bd523dd697
Instruction Fuzzy Hash: CAC18AB1D046689BEB25CA15DC88BEABBB5EF84315F1081EAD80DA6340E7785FC5CF11

Function 3BEB405B Relevance: 4.7, Strings: 3, Instructions: 918COMMON

Download Yara Rule

Strings

V, xrefs: 3BEB4704
?5IC, xrefs: 3BEB475D
O6@F, xrefs: 3BEB470E

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID: ?5IC$O6@F$V
API String ID: 0-1412617190
Opcode ID: f4c45bc074cc361c1bcd2bcbda37ad9fd1ce404022a626e4f18baf421a4016d0
Instruction ID: 342e4ba0085c71e71d9a22361140027763c6d84d1d5f9a426a77072db219bdc6
Opcode Fuzzy Hash: f4c45bc074cc361c1bcd2bcbda37ad9fd1ce404022a626e4f18baf421a4016d0
Instruction Fuzzy Hash: 8D821752E2826987DB78CB39DC116DBA2B3EF88300F05D4FD940DE7664F6744AC59B0A

Function 3BEB46DA Relevance: 4.5, Strings: 3, Instructions: 709COMMON

Download Yara Rule

Strings

V, xrefs: 3BEB4704
?5IC, xrefs: 3BEB475D
O6@F, xrefs: 3BEB470E

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID: ?5IC$O6@F$V
API String ID: 0-1412617190
Opcode ID: 4c2d31cb38cf5ac17f9d15dd05477bead84e40cd4cbb9ed60f6d7aec1e3fde91
Instruction ID: 4b9dc736bbf7baa6a77c99264d6596b8f4690eb43ab21c1a1570e33345edf9ce
Opcode Fuzzy Hash: 4c2d31cb38cf5ac17f9d15dd05477bead84e40cd4cbb9ed60f6d7aec1e3fde91
Instruction Fuzzy Hash: 9952C712E2866987DB78CB79DC1169FA2B3EF58300F04D4FD940DE7664F6704AC99B0A

Function 3BEB46E5 Relevance: 4.5, Strings: 3, Instructions: 706COMMON

Download Yara Rule

Strings

V, xrefs: 3BEB4704
?5IC, xrefs: 3BEB475D
O6@F, xrefs: 3BEB470E

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID: ?5IC$O6@F$V
API String ID: 0-1412617190
Opcode ID: d6d9f1b69b76863fd6f0513d3a3fc47d762c16b4b39a6db4d8da90e505b210f6
Instruction ID: 3644867f9308080a45b73ca60dec8c9a1ae0518774fcde12112da3596e54052f
Opcode Fuzzy Hash: d6d9f1b69b76863fd6f0513d3a3fc47d762c16b4b39a6db4d8da90e505b210f6
Instruction Fuzzy Hash: C452C712E2866987DB78CB79DC1169FA2B3EF58300F04D4FD940DE7664F6704AC99B0A

Function 3BEB46F1 Relevance: 4.5, Strings: 3, Instructions: 704COMMON

Download Yara Rule

Strings

V, xrefs: 3BEB4704
?5IC, xrefs: 3BEB475D
O6@F, xrefs: 3BEB470E

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID: ?5IC$O6@F$V
API String ID: 0-1412617190
Opcode ID: eb8dbc94bbbfb2e459a11031ced266b819da70190ea21eb6315c359c40bf1491
Instruction ID: 1f6991843798f2a6ccf62949f5ad2196342b656677c2f46ee1615f45682eaa0d
Opcode Fuzzy Hash: eb8dbc94bbbfb2e459a11031ced266b819da70190ea21eb6315c359c40bf1491
Instruction Fuzzy Hash: 7552D712E2466987DB78CB79DC1169FA2B3EF58300F04D4FD940DE7664F6704AC99B0A

Function 026B7276 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 277COMMON

Download Yara Rule

Strings

:FOK, xrefs: 026B7517

Memory Dump Source

Source File: 00000000.00000002.2667740199.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26b0000_AdobePDF.jbxd

Similarity

API ID:
String ID: :FOK
API String ID: 0-1546321273
Opcode ID: 0846f8f9e150cba83b22e891948e0deff9d1d4075edb240d1670727adb4aeb6b
Instruction ID: e470f2c5af43551ce085083b3a19c82e0964f815fb21c362b35061523583441d
Opcode Fuzzy Hash: 0846f8f9e150cba83b22e891948e0deff9d1d4075edb240d1670727adb4aeb6b
Instruction Fuzzy Hash: 67A116F2D042545FF7258A24DC44AEBBB78EF85310F0481BAE84D96680E63C6EC6CF52

Function 3BEB751C Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 258COMMON

Download Yara Rule

Strings

:FOK, xrefs: 3BEB7517

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID: :FOK
API String ID: 0-1546321273
Opcode ID: d598eb1bb29654b0315cb20ea9c137a6e233b77599fd1e229d9ae10b3548b176
Instruction ID: 01a0564da56e34b721cf8f5834f7117ce8972a188868fc6c7376a3fc47a23963
Opcode Fuzzy Hash: d598eb1bb29654b0315cb20ea9c137a6e233b77599fd1e229d9ae10b3548b176
Instruction Fuzzy Hash: FB9128F2C092689BFB24CB58DC41AEB7B74EF45314F0441BAD84DA6780E67C5EC5CA92

Function 00E3B271 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 216processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 00E3BE3D

Strings

jjjj, xrefs: 00E3BE2E

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: b85b2e1870348b1f434e1193003279f54dbab56a7bff8865984786254beac272
Instruction ID: 3d617da62a6f8d0ca02821b9c7f7af731837092b54ca52554cf8f3413ada3fb3
Opcode Fuzzy Hash: b85b2e1870348b1f434e1193003279f54dbab56a7bff8865984786254beac272
Instruction Fuzzy Hash: 766129F2D04114ABF7248614DC5ABFB7B78EBC0310F1491BEE60B66680E77D6AC5CA52

Function 0054A7A0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 205COMMON

Download Yara Rule

Strings

uCW, xrefs: 0054A9D1

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID:
String ID: uCW
API String ID: 0-3512965699
Opcode ID: 7e7f09b9ed1c3013eb8cb4f153e1eedc83683dd3943617ebe682761ee86a4c43
Instruction ID: 8a131b18f9af3267c82e17c4db3e7d5191e80546e57faf38735a12a96d56bea4
Opcode Fuzzy Hash: 7e7f09b9ed1c3013eb8cb4f153e1eedc83683dd3943617ebe682761ee86a4c43
Instruction Fuzzy Hash: F16105F1D401559AF7608B14DC84BFB7B75EBC0324F1481FAE90996380E63D4EC6CA52

Function 0054604D Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

YV, xrefs: 00546600

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: YV
API String ID: 4275171209-3702526815
Opcode ID: e129b39bb272e6c1086d2ab1c4d6b949f4505121c2c60168a226186916f66f79
Instruction ID: d313880c7898aa00ca48927a6ef2bc75878a90f65e3cb573be430fe4c8d585b5
Opcode Fuzzy Hash: e129b39bb272e6c1086d2ab1c4d6b949f4505121c2c60168a226186916f66f79
Instruction Fuzzy Hash: 6C617BF2C04250AFF3148A21DC4DBE77F69FBC2310F1581BEE84D56581D57D9A86CAA2

Function 3BEB3DA8 Relevance: 3.2, Strings: 2, Instructions: 683COMMON

Download Yara Rule

Strings

3, xrefs: 3BEB3EF1
e|, xrefs: 3BEB3EA0

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID: e|$3
API String ID: 0-1726640827
Opcode ID: aead20fb75e1edb8ff06e66f1231084d83737bc607f525dbc02a4fb36f4e3b52
Instruction ID: 3cd257fd64311c24158c784a518ef23be780b7a723df0c549db22353a9a41b43
Opcode Fuzzy Hash: aead20fb75e1edb8ff06e66f1231084d83737bc607f525dbc02a4fb36f4e3b52
Instruction Fuzzy Hash: E3629325E2466987DB78CB39DC516DBA2B3AF58300F04D4FD940DE3664FB704AC99B0A

Function 3BEB4B28 Relevance: 2.0, Strings: 1, Instructions: 786COMMON

Download Yara Rule

Strings

S, xrefs: 3BEB4B38

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID: S
API String ID: 0-1211208622
Opcode ID: 94efed3c7cd2ec85c97c610d9c2169c00336253853dbda92b1538781eb6b28b1
Instruction ID: b4075a90051c0c80179c464f82f4be14c0b94471a3c1f3468c43c55c3b2aa98f
Opcode Fuzzy Hash: 94efed3c7cd2ec85c97c610d9c2169c00336253853dbda92b1538781eb6b28b1
Instruction Fuzzy Hash: 05620752E2826987DB78CB79DC1179BA2B3EF58300F04D4FD940DE7664F6704AC99B0A

Function 3BEB4B4D Relevance: 1.9, Strings: 1, Instructions: 654COMMON

Download Yara Rule

Strings

HN;, xrefs: 3BEB4B50

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID: HN;
API String ID: 0-3860028145
Opcode ID: 00735a5ea730dcac5f8a8070ed5a97f3b743278dc926be25423d58b7a400fa87
Instruction ID: e664c286cba8f556303758100fa4576e239fc08f0dce591623f6e170c8aa950d
Opcode Fuzzy Hash: 00735a5ea730dcac5f8a8070ed5a97f3b743278dc926be25423d58b7a400fa87
Instruction Fuzzy Hash: E852B612E2466987DB78CB39DC1169FA2B3EF58300F05D8FD940DE7664F6704AC99B0A

Function 3BEB4845 Relevance: 1.9, Strings: 1, Instructions: 643COMMON

Download Yara Rule

Strings

5:=H, xrefs: 3BEB4845

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID: 5:=H
API String ID: 0-3718395605
Opcode ID: 16e6b03d8b47dc6da647b7365d1d4b59126a9cb7b2f2843216a8182b8df511f6
Instruction ID: f92985ce92618b3b3ad8a5b34a686b3c7362f0a994be18bd0c0e48f688b49bb3
Opcode Fuzzy Hash: 16e6b03d8b47dc6da647b7365d1d4b59126a9cb7b2f2843216a8182b8df511f6
Instruction Fuzzy Hash: B152C412E2466986DB78CB39DC1169FA2B3EF58300F05D8FD940DE7664F6704AC99B0A

Function 3BEBF054 Relevance: 1.9, APIs: 1, Instructions: 373fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 3BEBFFDF

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 6bd3ab02f75e6fdfae12dadf092c2ae3f9920db81dcd355e91ff4ebbb66a7206
Instruction ID: 3b7c6b0b0c29d12a7855bc83a7b03874b3c044e585013fbc4c29f23eb3972003
Opcode Fuzzy Hash: 6bd3ab02f75e6fdfae12dadf092c2ae3f9920db81dcd355e91ff4ebbb66a7206
Instruction Fuzzy Hash: B6C139F6D082249FFB24CB58DC94BEB7778EB81314F1481FAE90D56681D63C5EC18A92

Function 00E53783 Relevance: 1.9, APIs: 1, Instructions: 364threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 00E53D9D

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: e61044ce204f44a89e145b15e814b8e803e00d72af23b6f4de4e775baf2670bb
Instruction ID: 02aa6073c53f02b16d36ff5d2ebaaacac8e0c38ae6af8fd1c3660374762a9d09
Opcode Fuzzy Hash: e61044ce204f44a89e145b15e814b8e803e00d72af23b6f4de4e775baf2670bb
Instruction Fuzzy Hash: 77D103F2D081689BF7248A24DC85AEBB779EB81315F1441FADD0D63680D6386FC5CE91

Function 00E48FA8 Relevance: 1.9, APIs: 1, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: e2debdde9545a0a25019d22c40bf401d28b9c3b8660aef6d74ed33fd5364b72d
Instruction ID: 1ed479de60ba44bdf57e83bb9e5fc4d98b7ae12833c5c38753fd496d61f8ef23
Opcode Fuzzy Hash: e2debdde9545a0a25019d22c40bf401d28b9c3b8660aef6d74ed33fd5364b72d
Instruction Fuzzy Hash: 44C119F2D052549FE7208A25EC84AEBB778EF91310F1590BAD80D76641E6396EC1CF62

Function 00E49199 Relevance: 1.8, APIs: 1, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ba447f173d8f2018078c53583ccff1b0cd1edc04c3db07cb2c2324f4758fa26
Instruction ID: f0ea264e7fa20a3bf4738ea8e8baf575e38c321aae0b0d7253508c5abbce6587
Opcode Fuzzy Hash: 1ba447f173d8f2018078c53583ccff1b0cd1edc04c3db07cb2c2324f4758fa26
Instruction Fuzzy Hash: AEA11BB1D052259AEB208B65EC84AFBB775EF81310F1490FAD84D72682D6395EC1CF62

Function 00E493E5 Relevance: 1.8, APIs: 1, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb07eaeda05b18629f3a1e587c2e80e4375339f2c8fa65a828c1c5fe76f37a8a
Instruction ID: 3e5fe3f0dda122eb66ead801f987ebe275b29ba3a86036e97c80bd9b8ea9516c
Opcode Fuzzy Hash: eb07eaeda05b18629f3a1e587c2e80e4375339f2c8fa65a828c1c5fe76f37a8a
Instruction Fuzzy Hash: EA9129B2C052549FF7208A65EC84AEBB774EF81310F1590BAD84D72642E6396EC1CF62

Function 3BEC472C Relevance: 1.7, APIs: 1, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7dd2651572ae6da5b194640ccf87e6ce66ea495376b8ee1cbf91ed6f940d8c2
Instruction ID: 2517022fabe8259f7f911608015f9e25bbaedd316f92898af1011b5ec54e54a6
Opcode Fuzzy Hash: c7dd2651572ae6da5b194640ccf87e6ce66ea495376b8ee1cbf91ed6f940d8c2
Instruction Fuzzy Hash: E2816AF2C102655EF7148B58DC45BFB7778EB84710F0042FAE94E96280EB785EC58BA2

Function 00547833 Relevance: 1.7, APIs: 1, Instructions: 236memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00548D68

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d102ac4ff3878d5864cfe36421bde35fceb51514663232590fe4006672993b8e
Instruction ID: f5c197db9dd7e573f00c174396671f485bf4271ad916959efb5916df041fe0fe
Opcode Fuzzy Hash: d102ac4ff3878d5864cfe36421bde35fceb51514663232590fe4006672993b8e
Instruction Fuzzy Hash: E98125B2D085299EF7208A25DC88BFF7B79FF94318F1440BAD50D56681E7781EC1CA51

Function 00E526E3 Relevance: 1.7, APIs: 1, Instructions: 219threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 00E53D9D

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: fc21e648c8c087616ae5d5528f96d871e9bd7c5e89a7f1e409a1efe12d2e9e9d
Instruction ID: c3a5581293ae6816250b3d7224a53df1625c342ae0092e627274a16340f2cc6b
Opcode Fuzzy Hash: fc21e648c8c087616ae5d5528f96d871e9bd7c5e89a7f1e409a1efe12d2e9e9d
Instruction Fuzzy Hash: 208126B2D041289AE7248B14DC40AFBB775FB89315F1045FEEA0E76380E7785EC58B91

Function 3BEB677A Relevance: 1.7, APIs: 1, Instructions: 176COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 045df64edd3187d55d3600802d343d91f80cc52611ccd44e66415812e35ff24b
Instruction ID: dd45d6208be35e8fa12c60e4474bb3dfc9f5bfd058c9ebd655d4852f6e05ef4c
Opcode Fuzzy Hash: 045df64edd3187d55d3600802d343d91f80cc52611ccd44e66415812e35ff24b
Instruction Fuzzy Hash: D851E5B1D192689FFF14CB28DC406BABB75EB84710F1481FAD44D96294EA385EC1CF12

Function 3BEB661F Relevance: 1.7, APIs: 1, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: ddafbac98dafecdc0c6f186c96e46466472c9e2a036e6063019e5ebfd68827f4
Instruction ID: 71179fe1110e69c84a2ab2a5284771af10fe50c2b6077d6dd9fc358fa0552758
Opcode Fuzzy Hash: ddafbac98dafecdc0c6f186c96e46466472c9e2a036e6063019e5ebfd68827f4
Instruction Fuzzy Hash: DF51E6A2C1C3589EFF18CB28DC55AEABB74EB84710F1481FED50D96254EA385EC18F12

Function 3BEB7261 Relevance: 1.6, APIs: 1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f09817fd55b519218c5437ceef01c5dd953251b8902771339dd0cce1f4edee88
Instruction ID: 01e63426c153461609c3fca07dcad3dfcaf301f2cea4468872f1d496389060b9
Opcode Fuzzy Hash: f09817fd55b519218c5437ceef01c5dd953251b8902771339dd0cce1f4edee88
Instruction Fuzzy Hash: 4351F9F2C093645FFB20CB58DC95ADB7B68DB41300F0541BAD98D66B41E9345EC6CA63

Function 026B7261 Relevance: 1.6, APIs: 1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2667740199.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26b0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f09817fd55b519218c5437ceef01c5dd953251b8902771339dd0cce1f4edee88
Instruction ID: f2be1b13315b2d980a11acb144bfb43380ebe1658e26810fd71e60959aaae20c
Opcode Fuzzy Hash: f09817fd55b519218c5437ceef01c5dd953251b8902771339dd0cce1f4edee88
Instruction Fuzzy Hash: 4B514BF3C052645FF7269A54DC84AEBBB78EF81300F1540FAD84D66681E6345EC6CB62

Function 00E35AE1 Relevance: 1.5, APIs: 1, Instructions: 279memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00E36AF4

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1bcc00b4391b2f1a41975a47895ef9b353ab9a340ecb08a1b0407e0002b60be1
Instruction ID: 9f82103cd42dbdd9ebe81c41f93c24e638f0205f45c0d9bd8feb3c16bc54e65c
Opcode Fuzzy Hash: 1bcc00b4391b2f1a41975a47895ef9b353ab9a340ecb08a1b0407e0002b60be1
Instruction Fuzzy Hash: AFB192B2D045249FEB24CA14DC98BFBBBB9EB81305F1881E9D909A6240D7786FC5CF51

Function 00E352CE Relevance: 1.5, APIs: 1, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 55bc7e8588b0df7429bab6d50cab68840f1cb6a7baf53babb6114849edb26884
Instruction ID: 5ab7893e2611e644dafc74ea2ffd4cf00f0b687b9274f826454547d578547709
Opcode Fuzzy Hash: 55bc7e8588b0df7429bab6d50cab68840f1cb6a7baf53babb6114849edb26884
Instruction Fuzzy Hash: 27A124B2D046289EF7208A24DC587EABBB5EB84319F1490FAD80D66280E3791EC5CF51

Function 00E355F7 Relevance: 1.5, APIs: 1, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00E36AF4

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 865041f3515d9e3c0b2beeaade53c32c5c384d29c6d6d89fea3f4dab32c355b1
Instruction ID: 3a0e8245d77c4069d6a133747e2b1855f56a6832dda768299d6cf48075965140
Opcode Fuzzy Hash: 865041f3515d9e3c0b2beeaade53c32c5c384d29c6d6d89fea3f4dab32c355b1
Instruction Fuzzy Hash: F39134B2D045249EE7208A24DD58BFABBB5EF80318F1450FAD80E76280E3791EC5CF52

Function 00E4A164 Relevance: 1.4, APIs: 1, Instructions: 186memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00E4B9B1

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8637737a2cda087b05394439f0837218335f4fd6aec8735d006fb5abbeaeb29a
Instruction ID: 9707c60eca752772d3e47ffb0f5a703eb2035c4ccfad548d76561162948584d4
Opcode Fuzzy Hash: 8637737a2cda087b05394439f0837218335f4fd6aec8735d006fb5abbeaeb29a
Instruction Fuzzy Hash: 0D515CF2C04254AFF7248A24EC95BF77B78EB44324F1891FBD90966680D63D5FC18A62

Function 3BEB4886 Relevance: .8, Instructions: 759COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08f65020e94d74d7a5464b08046a8c1848eb556020a1b36c0e74f6d5e8771071
Instruction ID: 8b67df1087546e698f19b7384d6c88b36264ccb0d390c06c343030ed4233fb6d
Opcode Fuzzy Hash: 08f65020e94d74d7a5464b08046a8c1848eb556020a1b36c0e74f6d5e8771071
Instruction Fuzzy Hash: A862F752E2826987DB78CB79DC0169FA2B3EF58300F04D4FD940DE7664F6704AC99B0A

Function 3BEB48BD Relevance: .7, Instructions: 748COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c813152787d57767024cc3800705929a0d40be9e4ac78f321359257a69930c90
Instruction ID: 267d33db2f3266e6274c47a920730ad33d08f16436e8f4397433e3ce17a9a6cf
Opcode Fuzzy Hash: c813152787d57767024cc3800705929a0d40be9e4ac78f321359257a69930c90
Instruction Fuzzy Hash: 7062F752E2466986DB78CB79DC016AFA2B3EF58300F04D4FD940DE7664F6704AC99B0A

Function 3BEB48C5 Relevance: .7, Instructions: 745COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02da795bf4cbb92d8935b4de1afd1bdd49eda63cac24eaac875122976ca3098b
Instruction ID: 22696adc39d47b530dc1943bad546ee5ade9cea2ae9399c803238e2a29087ca2
Opcode Fuzzy Hash: 02da795bf4cbb92d8935b4de1afd1bdd49eda63cac24eaac875122976ca3098b
Instruction Fuzzy Hash: 5B62F752E2426986DB78CB79DC016AFA2B3EF58300F04D4FD940DF7664F6704AC99B0A

Function 3BEB3D70 Relevance: .7, Instructions: 741COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7ac4c557f5946ff02f6cf2dbf44d3f79844bddcdf92a479249219f284adf3d3
Instruction ID: 52611e7537de1194fadc76cd0c608c4c20043fe2b2534ebd30502604e277239d
Opcode Fuzzy Hash: f7ac4c557f5946ff02f6cf2dbf44d3f79844bddcdf92a479249219f284adf3d3
Instruction Fuzzy Hash: 1D62D512E2866987DB78CB39DC5169FA2B3EF58300F04D4FD940DE7664F6704AC99B0A

Function 3BEB3BC2 Relevance: .7, Instructions: 733COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8bbf48fcd32c86e603070d395c52ace2225f5b4064833b829fff2132518b372
Instruction ID: bcf6acf7e313eaf2f1d9aaef402fe0d982a698a04163360ca674eb78b9c2316b
Opcode Fuzzy Hash: c8bbf48fcd32c86e603070d395c52ace2225f5b4064833b829fff2132518b372
Instruction Fuzzy Hash: D062E812E2866987DB78CB39DC5169FA2B3EF58300F04D4FD940DE7664F6704AC99B0A

Function 3BEB4910 Relevance: .7, Instructions: 721COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90bfd4eb15e34d83f22be13f675db4a03ba3eb549f4d35418c813e3307ba7815
Instruction ID: 39cc1ddafbc40c4abc19b2a513848341d91bc8acba8e0812712a5fb5d5f0566f
Opcode Fuzzy Hash: 90bfd4eb15e34d83f22be13f675db4a03ba3eb549f4d35418c813e3307ba7815
Instruction Fuzzy Hash: 1662D612E2466986DB78CB79DC116AFA2B3EF58300F04D4FD940DE7664F6704AC99B0A

Function 3BEB491D Relevance: .7, Instructions: 717COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b39369b6d3e2a316b5cdfd461b327215efc797cc7153fd813a1101db4be85b49
Instruction ID: 3b26b5bc51a3f6476106d885e8e7e25dbd21b3ce5d0dbfcd61cd2b1d14f99008
Opcode Fuzzy Hash: b39369b6d3e2a316b5cdfd461b327215efc797cc7153fd813a1101db4be85b49
Instruction Fuzzy Hash: C562D512E2466986DB78CB79DC116AFA2B3EF58300F04D4FD940DE7664F6704AC99B0A

Function 3BEB4A32 Relevance: .7, Instructions: 686COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc401ac9bca6c51ffe5386bd677e5f7a66050eff258d8090602c72447a2e2464
Instruction ID: 75a938736eb43421336a5a8ca3dd996eb120f143aafe6030d9b60e34ffa5dc75
Opcode Fuzzy Hash: bc401ac9bca6c51ffe5386bd677e5f7a66050eff258d8090602c72447a2e2464
Instruction Fuzzy Hash: 2852C512E2466987DB78CB39DC116AFA2B3EF58300F05D4FD940DE7664F6704AC99B0A

Function 026B4A32 Relevance: .7, Instructions: 686COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2667740199.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26b0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc401ac9bca6c51ffe5386bd677e5f7a66050eff258d8090602c72447a2e2464
Instruction ID: bfdc8f68e098f2a396d31bb1b6812e10066bf724abaca19b31722e25557906a9
Opcode Fuzzy Hash: bc401ac9bca6c51ffe5386bd677e5f7a66050eff258d8090602c72447a2e2464
Instruction Fuzzy Hash: 1A52B512E2466986DB78CB39DC116AFA2B3EF58300F05D4FD940DE7664F6704AC99B0A

Function 3BEB481A Relevance: .7, Instructions: 654COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e9b2c6d0129b7197f5e0d567fc2c9b0ad63c94a80893e2640c336d128f9abc8
Instruction ID: 32c70b0d2bd71e5d6efc53f467c8350cd3f437779bc1651c5ffa086f874a8f01
Opcode Fuzzy Hash: 0e9b2c6d0129b7197f5e0d567fc2c9b0ad63c94a80893e2640c336d128f9abc8
Instruction Fuzzy Hash: 8F52C612E2466987DB78CB39DC1169FA2B3EF58300F04D4FD940DE7664F6704AC99B0A

Function 3BEB47A7 Relevance: .6, Instructions: 649COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3ce586c555638aa5c3cacd5409f31ee72e70314d592c7a7085301da82e52b5f
Instruction ID: 8dbb180ff7d379467c44fff40a254bdb316b0847803211bdc75485213976943b
Opcode Fuzzy Hash: e3ce586c555638aa5c3cacd5409f31ee72e70314d592c7a7085301da82e52b5f
Instruction Fuzzy Hash: 6952C512E2466986DB78CB39DC1169FA2B3EF58300F05D8FD940DF7664F6704AC99B0A

Function 3BEB47BA Relevance: .6, Instructions: 642COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3da72211c49fe12d8f9fae55512b75d470b920320e481364f7f116f4ddc7150d
Instruction ID: eb26ff11b52ed0d5703c543405097893cefea174ccdbaf231669f580d80fdbfe
Opcode Fuzzy Hash: 3da72211c49fe12d8f9fae55512b75d470b920320e481364f7f116f4ddc7150d
Instruction Fuzzy Hash: D952B412E2466986DB78CB39DC1169FA2B3EF58300F05D8FD940DE7664F6704AC99B0A

Function 3BEB419E Relevance: .6, Instructions: 638COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30c7cbe5f106f8e665b845b8f24c369cb1e96ac90dc81efbbdffb6c3eae4119a
Instruction ID: 9942f6df8d534607c12f6f6f9d24ad7548198e578ddbf5119d741232aca63d6e
Opcode Fuzzy Hash: 30c7cbe5f106f8e665b845b8f24c369cb1e96ac90dc81efbbdffb6c3eae4119a
Instruction Fuzzy Hash: 5752C616E2466986DB78CB39DC1169FA2B3EF58300F04D4FD940DE7664F6704AC99B0E

Function 3BEB41A9 Relevance: .6, Instructions: 636COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e02ad5263c43b13dac4e0d178338362ee8e674007681e7736d492d987b29252f
Instruction ID: 74b6a5d0932dcc534f62fa532fcf6076a5996193c1df58310224b794f251da94
Opcode Fuzzy Hash: e02ad5263c43b13dac4e0d178338362ee8e674007681e7736d492d987b29252f
Instruction Fuzzy Hash: 2E52C616E2466986DB78CB39DC1169FA2B3EF58300F04D8FD940DE7664F6704AC99B0E

Function 3BEB4BA0 Relevance: .6, Instructions: 628COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 195be972f1d730d91b1026e7e7e534d91ecea1062958c06adb46027cc3a40fa6
Instruction ID: 4fb4ae0acd37c307cc754f8b30f80899e287f1d67dbe89d36e5b91ac8e0cc66c
Opcode Fuzzy Hash: 195be972f1d730d91b1026e7e7e534d91ecea1062958c06adb46027cc3a40fa6
Instruction Fuzzy Hash: 8B42B312E2466986DB78CB39DC1169FA2B3EF58300F05D8FD940DF7664F6704A899B0E

Function 3BEB41E6 Relevance: .6, Instructions: 622COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b50e2cf1520ae2bb021e77a9aee82c7730d8c758ac6b8f61034498411b68bd55
Instruction ID: 48bf1735ff8579a4b94b894a6080895fb507776d3cb18c25fda20e88728f92cc
Opcode Fuzzy Hash: b50e2cf1520ae2bb021e77a9aee82c7730d8c758ac6b8f61034498411b68bd55
Instruction Fuzzy Hash: 1042C616A2466986DB78CB79DC1169FA2B3EF58300F04D8FD940DE3664F6704AC99B0E

Function 3BEB4155 Relevance: .6, Instructions: 621COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a58029a32e3ae80a5fcb53a12f6ba9a33169204e0740b3b193ae917c06cc3ff
Instruction ID: 4cfba287b7eefd83734ef1e6127c15c804de994aa1bee1bb6be3923eac00eda7
Opcode Fuzzy Hash: 2a58029a32e3ae80a5fcb53a12f6ba9a33169204e0740b3b193ae917c06cc3ff
Instruction Fuzzy Hash: FC42B512A2466986DB78CB79DC1169FA2B3EF58300F04D8FD940DF7664F6704AC99B0E

Function 3BEB45B1 Relevance: .6, Instructions: 620COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46b480305a4903cb3d57e3560f603391edfa14a395c5bb5888444e64f254d57e
Instruction ID: ec60b14d78073ac43c012481cc23090da987a982f0f427e08d0b19fae34b2907
Opcode Fuzzy Hash: 46b480305a4903cb3d57e3560f603391edfa14a395c5bb5888444e64f254d57e
Instruction Fuzzy Hash: B142B512A2466986DB78CB79DC1169FA2B3EF58300F04D8FD940DE7664F6704AC99B0E

Function 3BEB41F4 Relevance: .6, Instructions: 617COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 958caebf3c909686afe66b4fca4366fd237c9a0c17c975b157e4514bf1d0d591
Instruction ID: 448af4a5a0984e7975b5c979df479dff1da60906d577d4bf13944a2a84d59398
Opcode Fuzzy Hash: 958caebf3c909686afe66b4fca4366fd237c9a0c17c975b157e4514bf1d0d591
Instruction Fuzzy Hash: DE42C516A2466986DB78CB39DC1169FA2B3EF58300F04D8FD940DF7664F6704AC99B0E

Function 3BEB4BDC Relevance: .6, Instructions: 614COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15b320a4e12227806e836458203e605335f636a78f02788f222a048caacf3c2a
Instruction ID: 6b71e435b181a7ed9dda20d4b9f821338ffa78d0563d67ab3df6ff7ce49431aa
Opcode Fuzzy Hash: 15b320a4e12227806e836458203e605335f636a78f02788f222a048caacf3c2a
Instruction Fuzzy Hash: 9A42A312E2466986DB78CB39DC1169FA2B3EF58300F05D8FD940DE7664F6704AC99B0E

Function 3BEB4174 Relevance: .6, Instructions: 613COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 027654de364b2a499c5260a5da76652f652b28d684eb9e341d23cbc8b08444ac
Instruction ID: dd451640cab9ebebbf947e696c68ff25957900cc732cf56079804fbfc62b58eb
Opcode Fuzzy Hash: 027654de364b2a499c5260a5da76652f652b28d684eb9e341d23cbc8b08444ac
Instruction Fuzzy Hash: 8B42C512A2466986DB78CB39DC1169FA2B3EF58300F04D8FD940DF7664F6704AC99B0E

Function 3BEB40B6 Relevance: .6, Instructions: 613COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3ae2e5f62207797aa623202d320ba10f3064d7bf67d43d48157e8d72eb7eb0f
Instruction ID: fb82af8ffd0a65a2f91905a3b1e1360b197725b67678bf76b505393c7c914965
Opcode Fuzzy Hash: a3ae2e5f62207797aa623202d320ba10f3064d7bf67d43d48157e8d72eb7eb0f
Instruction Fuzzy Hash: A742C512A2466986DB78CB39DC1169FA2B3EF58300F04D8FD940DF7664F6704AC99B0E

Function 3BEB461C Relevance: .6, Instructions: 600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9ad59e0b4a6ddb01c31e2ff6bc38ce07b4524d8499eb671735305a5ce0f63b6
Instruction ID: b179bd0ae0ecd1a3b8f921d3aa9179185a937464ad2a32e54f91c5d0b45cde98
Opcode Fuzzy Hash: f9ad59e0b4a6ddb01c31e2ff6bc38ce07b4524d8499eb671735305a5ce0f63b6
Instruction Fuzzy Hash: 1F42B516A2466986DB78CB79DC1129FA2B3EF58300F04D8FD940DF7664F6704AC99B0E

Function 3BEB3A9A Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43e43047d96bd8fdf89e7b967bdd5215594aa3ecb9b60a9821df96cd253c2e59
Instruction ID: 46561edf0514077cd8941c18c8beac8106da09fbd3b4ff412bfd36a67209075c
Opcode Fuzzy Hash: 43e43047d96bd8fdf89e7b967bdd5215594aa3ecb9b60a9821df96cd253c2e59
Instruction Fuzzy Hash: C0429512A2466986DB78CB79DC1169FA2B3EF58300F04D8FD940DF7664F6704AC99B0E

Function 3BEB3A14 Relevance: .6, Instructions: 593COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 778af2e9367e54bfebc0ed1c0b3181fd8fba3d44f95bb9eed05216895a01096e
Instruction ID: 86bd064babacad0416d6d6fd3dbfb0051e543986e3ac45372a948cea62942cc9
Opcode Fuzzy Hash: 778af2e9367e54bfebc0ed1c0b3181fd8fba3d44f95bb9eed05216895a01096e
Instruction Fuzzy Hash: D942A512A2466986DB78CB79DC1169FA2B3EF58300F04D8FD940DF7664F6704AC99B0E

Function 026B3A14 Relevance: .6, Instructions: 593COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2667740199.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26b0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 778af2e9367e54bfebc0ed1c0b3181fd8fba3d44f95bb9eed05216895a01096e
Instruction ID: 2f49038bd8bb8ada5d60c0771359122de8304000337855d2dc64c6720a8bcc9f
Opcode Fuzzy Hash: 778af2e9367e54bfebc0ed1c0b3181fd8fba3d44f95bb9eed05216895a01096e
Instruction Fuzzy Hash: A0429312A2466986DB78CB79DC1169FA2B3EF58300F04D8FD940DF7664F6704AC99B0E

Function 3BEB4D1E Relevance: .6, Instructions: 589COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 423039d1ed93768a6da9b6d9a50670f5783d0a03a2d24fcc7babbba66be33c34
Instruction ID: 6decbb8c8be872071cc28c87a03047e10e90ad91afffaec5973e54d041adeef9
Opcode Fuzzy Hash: 423039d1ed93768a6da9b6d9a50670f5783d0a03a2d24fcc7babbba66be33c34
Instruction Fuzzy Hash: D042A412A2466987DB78CB79DC1169FA2B3EF58300F04D8FD940DF7664F6704A899B0E

Function 3BEB4CF9 Relevance: .6, Instructions: 586COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06e198531bca682c0e6a334e34a51219d10fed6ef348be7f4a271bab048c2525
Instruction ID: 8a44dac6d4ffb6568d88f1f2e5d753fc9bc2c239fb5e2781b0d7a57a7fd198b6
Opcode Fuzzy Hash: 06e198531bca682c0e6a334e34a51219d10fed6ef348be7f4a271bab048c2525
Instruction Fuzzy Hash: 5342A412A2466986DB78CB79DC1129FA2B3EF58300F04D8FD940DF7664F6704AC99B0E

Function 3BEB4CF6 Relevance: .6, Instructions: 586COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64de4c36bba4274c335fe3fc82e6ccff8b4f10cfb1c2c18ac7fde06db0f93f52
Instruction ID: fe513fbbf32a02aef760657581636fc3b886637e871e521fec743c26a60495a1
Opcode Fuzzy Hash: 64de4c36bba4274c335fe3fc82e6ccff8b4f10cfb1c2c18ac7fde06db0f93f52
Instruction Fuzzy Hash: F142A412A2466986DB78CB79DC1169FA2B3AF58300F04D8FD940DF7664F6704AC99B0E

Function 3BEB3DE4 Relevance: .6, Instructions: 583COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5f9d83e850b5b465ae3f6f99bb3024d845f713aa4a85bfb8b133f12f1fb832d
Instruction ID: acea215d9b8a2c639eec05cafb6f236f769b36e6d4e5c1b2ff2dcce5c9135c7f
Opcode Fuzzy Hash: e5f9d83e850b5b465ae3f6f99bb3024d845f713aa4a85bfb8b133f12f1fb832d
Instruction Fuzzy Hash: 4E429516A2466986DB78CB79DC1129FA2B3EF58300F04D8FD940DF7664F6704AC99B0E

Function 3BEB3DF2 Relevance: .6, Instructions: 582COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aa72bdebd5d8774cadf334b9a44f24f8e708f15d9682b7d029d80f7c0cf9c12
Instruction ID: 1ad34c21daa2d921f4e2919d39801cd7f7ce248ac4bc13784632b1d4b86d894d
Opcode Fuzzy Hash: 5aa72bdebd5d8774cadf334b9a44f24f8e708f15d9682b7d029d80f7c0cf9c12
Instruction Fuzzy Hash: 7E42A512A2466986DB78CB79DC1129FA2B3EF58300F04D8FD940DF7664F6704AC99B0E

Function 3BEB4D08 Relevance: .6, Instructions: 582COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07a6b9af00aa6b5addb2034024adf425b2db825dd1cf4e696e7218e765569c4c
Instruction ID: 1f6572e48835dbbc6e61420152056692ae8f83275ccbc9fff964782a808d1f4e
Opcode Fuzzy Hash: 07a6b9af00aa6b5addb2034024adf425b2db825dd1cf4e696e7218e765569c4c
Instruction Fuzzy Hash: DF42A416A2466987DB78CB79DC1129FA2B3AF58300F04D8FD940DF7664F6704AC99B0E

Function 3BEB4C51 Relevance: .6, Instructions: 581COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6edf4ff80c5186d7c465df4ca28dd7e431a386f84f280900057186c49d64aa27
Instruction ID: 7e5202ef97bf8d5a85f09c9c0a8cbe92bb53e13f6423c1276c2f79d2811dbfa9
Opcode Fuzzy Hash: 6edf4ff80c5186d7c465df4ca28dd7e431a386f84f280900057186c49d64aa27
Instruction Fuzzy Hash: 6E429416A2466987DB78CB79DC1129FA2B3EF58300F04D8FD940DF7664F6704A899B0E

Function 3BEB515D Relevance: .6, Instructions: 580COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7506965c8956c9522cb5ad1671b9a2be9bb744c6186d22e37f8e5331b8ea94af
Instruction ID: 8a9fda839145d317842585d161baca8b1e14619e234a0ee85bc4f9d159ceb73c
Opcode Fuzzy Hash: 7506965c8956c9522cb5ad1671b9a2be9bb744c6186d22e37f8e5331b8ea94af
Instruction Fuzzy Hash: 2042A412A2466986DB78CB79DC1169FA2B3AF58300F04D8FD940DF7664F6704AC99B0E

Function 3BEB4666 Relevance: .6, Instructions: 578COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 592ce802872181b0cb1209d126dd78f173533e5f2f12401b807aa78a459fefb4
Instruction ID: 0e352e61fcf78d8a6fab30b64cd2b81f10c6509641e4a9a0c5a2eae9f4100ee3
Opcode Fuzzy Hash: 592ce802872181b0cb1209d126dd78f173533e5f2f12401b807aa78a459fefb4
Instruction Fuzzy Hash: EC42A512A2466986DB78CB79DC1169FA2B3EF58300F04D8FD940DF7664F6704AC99B0E

Function 3BEB4D9B Relevance: .6, Instructions: 578COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06d3ed0f8cf187ee04761edeb0da165f4ab27256d0b76234c938bf774b390bb8
Instruction ID: 3ab763e024bb02e9d68c6b2166b47840fbd554aca72757c28bdcd7fdbf649465
Opcode Fuzzy Hash: 06d3ed0f8cf187ee04761edeb0da165f4ab27256d0b76234c938bf774b390bb8
Instruction Fuzzy Hash: 0742A412A2466987DB78CB79DC1129FA2B3AF58300F04D8FD940DF7664F6704AC99B0E

Function 3BEB3E09 Relevance: .6, Instructions: 576COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c638d9780fa64fa48e80259df8e3e293d456f4716728fd62fdedd40f1b01eb35
Instruction ID: 6e36c038dfea649a8423e71a97668fe42e016e356258b98d3948c5f87c903291
Opcode Fuzzy Hash: c638d9780fa64fa48e80259df8e3e293d456f4716728fd62fdedd40f1b01eb35
Instruction Fuzzy Hash: BD429412A2466986DB78CB79DC1169FA2B3EF58300F04D8FD940DF7664F6704AC99B0E

Function 3BEB4C66 Relevance: .6, Instructions: 576COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd09a76c61b781f371fe4427c7b9909b83b3685d8f477569ba6ac9d848e8ed0f
Instruction ID: cb10dac8ebfe84e1e1aea7512ebd4c1598c71b0b834716817985f808a03d2904
Opcode Fuzzy Hash: fd09a76c61b781f371fe4427c7b9909b83b3685d8f477569ba6ac9d848e8ed0f
Instruction Fuzzy Hash: 6242A412A2466987DB78CB79DC1129FA2B3AF58300F04D8FD940DF7664F6704A899B0E

Function 3BEB4C92 Relevance: .6, Instructions: 573COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef627ac3f6e8f67043b2491845b9a7e22600a9eb87b3e74e4a9bd86f4dc3d219
Instruction ID: 4507a445e7b8e9211cddc1637a998d1d84b65d20244d2086ca9a91915d7712c4
Opcode Fuzzy Hash: ef627ac3f6e8f67043b2491845b9a7e22600a9eb87b3e74e4a9bd86f4dc3d219
Instruction Fuzzy Hash: 5A429416A2466987DB78CB79DC1129FA2B3EF58300F04D8FD940DF7664F6704A899B0E

Function 00E4F9AE Relevance: 42.1, APIs: 2, Strings: 22, Instructions: 101
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,00000004,?), ref: 00E4FF17
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00E4FF69

Strings

i, xrefs: 00E4FFB0
o, xrefs: 00E4FFD3
t, xrefs: 00E4FFFD
e, xrefs: 00E4FFE1
t, xrefs: 00E4FFA9
p, xrefs: 00E5000B
u, xrefs: 00E4FF8D
r, xrefs: 00E4FFCC
s, xrefs: 00E4FFE8
e, xrefs: 00E4FFBE
P, xrefs: 00E4FFC5
S, xrefs: 00E4FFF6
g, xrefs: 00E4FF94
c, xrefs: 00E4FFDA
D, xrefs: 00E4FF78
A, xrefs: 00E4FF9B
s, xrefs: 00E4FFEF
o, xrefs: 00E50004
e, xrefs: 00E4FF7F
c, xrefs: 00E4FFA2
v, xrefs: 00E4FFB7
b, xrefs: 00E4FF86

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: MemoryProcess$ReadWrite
String ID: A$D$P$S$b$c$c$e$e$e$g$i$o$o$p$r$s$s$t$t$u$v
API String ID: 3589323503-550370799
Opcode ID: c4da620cf328e5b76d40d674ace19b86f5b670b37dfaab44288302693639f2cd
Instruction ID: 0b3b6cf61badf5717de53d6dc92191c364e37709ce8bcfb6859d87dd1a3fdf0f
Opcode Fuzzy Hash: c4da620cf328e5b76d40d674ace19b86f5b670b37dfaab44288302693639f2cd
Instruction Fuzzy Hash: 4C417F62D0D6A88AFB21C638CC187DAFFB55B52704F0441E9D54C66283D7BA1BC8CF62

Function 00E30607 Relevance: 25.6, APIs: 1, Strings: 16, Instructions: 73
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,000002CC,00001000,00000004), ref: 00E3FCC5

Strings

n, xrefs: 00E3FD6A
e, xrefs: 00E3FD78
x, xrefs: 00E3FD7F
T, xrefs: 00E3FD32
C, xrefs: 00E3FD5C
o, xrefs: 00E3FD63
t, xrefs: 00E3FD71
t, xrefs: 00E3FD86
e, xrefs: 00E3FD24
G, xrefs: 00E3FD1D
t, xrefs: 00E3FD2B
e, xrefs: 00E3FD47
d, xrefs: 00E3FD55
r, xrefs: 00E3FD40
a, xrefs: 00E3FD4E
h, xrefs: 00E3FD39

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: C$G$T$a$d$e$e$e$h$n$o$r$t$t$t$x
API String ID: 4275171209-902913966
Opcode ID: d82efc5077e4cb8f940cf63e6443f08b7563a7672d75b281068d14c4a0cdac30
Instruction ID: 9e24f356d068194e23d50c5cda407e200552cd9debf349898df6960fc19e2712
Opcode Fuzzy Hash: d82efc5077e4cb8f940cf63e6443f08b7563a7672d75b281068d14c4a0cdac30
Instruction Fuzzy Hash: BA314750C486DDCDEB218615CC087DABFF1BB52319F0491E9D5C926282CBBB1AD4CFA2

Function 3BEBDC25 Relevance: 21.2, APIs: 1, Strings: 13, Instructions: 156COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 3BEBE09D

Strings

C, xrefs: 3BEBE0D5
a, xrefs: 3BEBE0EA
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0E3
F, xrefs: 3BEBE0FF
e, xrefs: 3BEBE0F8
i, xrefs: 3BEBE106
t, xrefs: 3BEBE0F1
W, xrefs: 3BEBE11B
e, xrefs: 3BEBE114
5P5M, xrefs: 3BEBE0B8
r, xrefs: 3BEBE0DC
_W, xrefs: 3BEBE0AE

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: ea2726212cf36c4f0a508114a5e93c178df1c6a49787c28a2ed162b384f28155
Instruction ID: c301289ae32f43b82ddb3447624f4aa9de1daf31eeacc2ce74d7eefb833b54c8
Opcode Fuzzy Hash: ea2726212cf36c4f0a508114a5e93c178df1c6a49787c28a2ed162b384f28155
Instruction Fuzzy Hash: DC5104B2D082689EFB24C718DC59BDB7B78DB81714F0840FAD94C16280D67D5ED58EA3

Function 3BEBDBAB Relevance: 21.2, APIs: 1, Strings: 13, Instructions: 152COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 3BEBE09D

Strings

C, xrefs: 3BEBE0D5
a, xrefs: 3BEBE0EA
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0E3
F, xrefs: 3BEBE0FF
e, xrefs: 3BEBE0F8
i, xrefs: 3BEBE106
t, xrefs: 3BEBE0F1
W, xrefs: 3BEBE11B
e, xrefs: 3BEBE114
5P5M, xrefs: 3BEBE0B8
r, xrefs: 3BEBE0DC
_W, xrefs: 3BEBE0AE

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: ddb7bccc116bdbe94f2487397e8be9ed4cc79195d95d94e3b003af1e92a832ab
Instruction ID: 42f01c4dd40232fa062b302453edb29d6a63444171ccc369169394b4ff7f0333
Opcode Fuzzy Hash: ddb7bccc116bdbe94f2487397e8be9ed4cc79195d95d94e3b003af1e92a832ab
Instruction Fuzzy Hash: DB51F9B1D082689EFB248728DC49BDB7B74EB91714F0440FAD44D16281D67D5EC68FA3

Function 3BEBDC4E Relevance: 21.1, APIs: 1, Strings: 13, Instructions: 143COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 3BEBE09D

Strings

C, xrefs: 3BEBE0D5
a, xrefs: 3BEBE0EA
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0E3
F, xrefs: 3BEBE0FF
e, xrefs: 3BEBE0F8
i, xrefs: 3BEBE106
t, xrefs: 3BEBE0F1
W, xrefs: 3BEBE11B
e, xrefs: 3BEBE114
5P5M, xrefs: 3BEBE0B8
r, xrefs: 3BEBE0DC
_W, xrefs: 3BEBE0AE

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: d9297f27eb320548d5510cab110dc0976b1d6eb0051995f108286623b9f03be1
Instruction ID: d3139e9a8b13dca97a76f61522ca653b362d7cb1e1068b48c5d79f7dca04f270
Opcode Fuzzy Hash: d9297f27eb320548d5510cab110dc0976b1d6eb0051995f108286623b9f03be1
Instruction Fuzzy Hash: B75105B1D082689EFB24C728DC49BEB7B74AB51714F0440FAD84C16281D6795EC58FA3

Function 3BEBE025 Relevance: 21.1, APIs: 1, Strings: 13, Instructions: 140COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 3BEBE09D

Strings

C, xrefs: 3BEBE0D5
a, xrefs: 3BEBE0EA
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0E3
F, xrefs: 3BEBE0FF
e, xrefs: 3BEBE0F8
i, xrefs: 3BEBE106
t, xrefs: 3BEBE0F1
W, xrefs: 3BEBE11B
e, xrefs: 3BEBE114
5P5M, xrefs: 3BEBE0B8
r, xrefs: 3BEBE0DC
_W, xrefs: 3BEBE0AE

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: 322c783329bcc2983e533410743b8fa6ce166e40282c321a49490cb5e858d512
Instruction ID: e154a4aeebaef99965765db6c8d0cd0e1ac03480ccef939e4723694e50bc3cce
Opcode Fuzzy Hash: 322c783329bcc2983e533410743b8fa6ce166e40282c321a49490cb5e858d512
Instruction Fuzzy Hash: 014108B2D082A89EFB248728DC49BDB7F68DB51710F0400FAD84C16281D67D5FD58AA3

Function 3BEBDBEC Relevance: 21.1, APIs: 1, Strings: 13, Instructions: 132COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 3BEBE09D

Strings

C, xrefs: 3BEBE0D5
a, xrefs: 3BEBE0EA
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0E3
F, xrefs: 3BEBE0FF
e, xrefs: 3BEBE0F8
i, xrefs: 3BEBE106
t, xrefs: 3BEBE0F1
W, xrefs: 3BEBE11B
e, xrefs: 3BEBE114
5P5M, xrefs: 3BEBE0B8
r, xrefs: 3BEBE0DC
_W, xrefs: 3BEBE0AE

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: 4defacf141bbfd44142c436516b804d60fdcf417726a7344f93bee79191f3df3
Instruction ID: c992998db1305f42b037c82ad36f8455692a062393d04db5b7d3eebc97abedca
Opcode Fuzzy Hash: 4defacf141bbfd44142c436516b804d60fdcf417726a7344f93bee79191f3df3
Instruction Fuzzy Hash: 2141F5B1D0C2A89AFB24C728DC49BDB7F74AB91710F0840FAD44C16281D67D5AC68FA3

Function 3BEBDC75 Relevance: 21.1, APIs: 1, Strings: 13, Instructions: 132COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 3BEBE09D

Strings

C, xrefs: 3BEBE0D5
a, xrefs: 3BEBE0EA
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0E3
F, xrefs: 3BEBE0FF
e, xrefs: 3BEBE0F8
i, xrefs: 3BEBE106
t, xrefs: 3BEBE0F1
W, xrefs: 3BEBE11B
e, xrefs: 3BEBE114
5P5M, xrefs: 3BEBE0B8
r, xrefs: 3BEBE0DC
_W, xrefs: 3BEBE0AE

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: 1f6d4758d9ebff923557b00a34cf570b48c8a23050b5d15901241565f4359b9e
Instruction ID: ddd9f6e956be370ca3cba855a4d873980d76c16b409a2c69088f7dab7094d9d0
Opcode Fuzzy Hash: 1f6d4758d9ebff923557b00a34cf570b48c8a23050b5d15901241565f4359b9e
Instruction Fuzzy Hash: 4241F5B1D0C2A89EFB248728DC59BEB7F749B41714F0840FAD44D16281D67D5EC58BA3

Function 3BEBDB42 Relevance: 21.1, APIs: 1, Strings: 13, Instructions: 129COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 3BEBE09D

Strings

C, xrefs: 3BEBE0D5
a, xrefs: 3BEBE0EA
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0E3
F, xrefs: 3BEBE0FF
e, xrefs: 3BEBE0F8
i, xrefs: 3BEBE106
t, xrefs: 3BEBE0F1
W, xrefs: 3BEBE11B
e, xrefs: 3BEBE114
5P5M, xrefs: 3BEBE0B8
r, xrefs: 3BEBE0DC
_W, xrefs: 3BEBE0AE

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: 4c14ede1e96190d2c3dc6a99c705509ab44c6d77ff3013459abb8ca33e2cf27f
Instruction ID: 716d9848de01d787c7e59117c8ed9a63313bcee2b73dea4c5ac9c14a137ea7ce
Opcode Fuzzy Hash: 4c14ede1e96190d2c3dc6a99c705509ab44c6d77ff3013459abb8ca33e2cf27f
Instruction Fuzzy Hash: FC41E5B1D082A89AFB24C728DC49BDB7B74AB41714F0440FAD84D16281D67D5ED68FA3

Function 3BEBDC06 Relevance: 21.1, APIs: 1, Strings: 13, Instructions: 128COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 3BEBE09D

Strings

C, xrefs: 3BEBE0D5
a, xrefs: 3BEBE0EA
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0E3
F, xrefs: 3BEBE0FF
e, xrefs: 3BEBE0F8
i, xrefs: 3BEBE106
t, xrefs: 3BEBE0F1
W, xrefs: 3BEBE11B
e, xrefs: 3BEBE114
5P5M, xrefs: 3BEBE0B8
r, xrefs: 3BEBE0DC
_W, xrefs: 3BEBE0AE

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: 63136d7b5147379d68a01dc19f9929eca3b52eaf782c97765a0eafeaa6c4fef0
Instruction ID: e2e75eb23d1ebbcfea06d3d7f48de946e9eb7715e30c88b5033c18662ed54d3e
Opcode Fuzzy Hash: 63136d7b5147379d68a01dc19f9929eca3b52eaf782c97765a0eafeaa6c4fef0
Instruction Fuzzy Hash: D341F4B1D082A89AFB24C728DC49BDB7B74AF51710F0840FAD84C16281D67D5ED68FA3

Function 3BEBD569 Relevance: 21.1, APIs: 1, Strings: 13, Instructions: 123COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 3BEBE09D

Strings

C, xrefs: 3BEBE0D5
a, xrefs: 3BEBE0EA
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0E3
F, xrefs: 3BEBE0FF
e, xrefs: 3BEBE0F8
i, xrefs: 3BEBE106
t, xrefs: 3BEBE0F1
W, xrefs: 3BEBE11B
e, xrefs: 3BEBE114
5P5M, xrefs: 3BEBE0B8
r, xrefs: 3BEBE0DC
_W, xrefs: 3BEBE0AE

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: eb165844d20164fe60918f2b881a0ce7d4ec3ef8043857187399f09a3ce7c788
Instruction ID: 027179dd9026525e02d8d971c713e9bd0f5dcd0fd7a8d4b224981409406c18a9
Opcode Fuzzy Hash: eb165844d20164fe60918f2b881a0ce7d4ec3ef8043857187399f09a3ce7c788
Instruction Fuzzy Hash: 024106B2D0C2A89AFB248728DC49BDB7F74AB51714F0800FAD44C16281D67D5ED68FA3

Function 3BEBCCE9 Relevance: 21.1, APIs: 1, Strings: 13, Instructions: 123COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 3BEBE09D

Strings

C, xrefs: 3BEBE0D5
a, xrefs: 3BEBE0EA
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0E3
F, xrefs: 3BEBE0FF
e, xrefs: 3BEBE0F8
i, xrefs: 3BEBE106
t, xrefs: 3BEBE0F1
W, xrefs: 3BEBE11B
e, xrefs: 3BEBE114
5P5M, xrefs: 3BEBE0B8
r, xrefs: 3BEBE0DC
_W, xrefs: 3BEBE0AE

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: 17b541020c4e4771dc995c80583ba65604a53208e4a8a43109cf4fb5addc4ab4
Instruction ID: 01dacf853391698ec37bd80e2612ac53720a96fe5e4ac8948ed1ff7811484e53
Opcode Fuzzy Hash: 17b541020c4e4771dc995c80583ba65604a53208e4a8a43109cf4fb5addc4ab4
Instruction Fuzzy Hash: 9C41F6B1C0C2A89AFB248728DC49BDB7E64AB41714F0800FAD84D16281D67E5BD58BA3

Function 3BEBDB7B Relevance: 21.1, APIs: 1, Strings: 13, Instructions: 122COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 3BEBE09D

Strings

C, xrefs: 3BEBE0D5
a, xrefs: 3BEBE0EA
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0E3
F, xrefs: 3BEBE0FF
e, xrefs: 3BEBE0F8
i, xrefs: 3BEBE106
t, xrefs: 3BEBE0F1
W, xrefs: 3BEBE11B
e, xrefs: 3BEBE114
5P5M, xrefs: 3BEBE0B8
r, xrefs: 3BEBE0DC
_W, xrefs: 3BEBE0AE

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: 5438c3b9bcf6c2a69e8c448a2b21aa1f06211d9938ef59cccaac7db2c5cd728a
Instruction ID: 0841990237e35b17f336d8fe0d79f4d9e2ad10eeec08a1acbbf23e914250c472
Opcode Fuzzy Hash: 5438c3b9bcf6c2a69e8c448a2b21aa1f06211d9938ef59cccaac7db2c5cd728a
Instruction Fuzzy Hash: CE41E3B1D082A89AFB248728DC49BDB7B78AB51714F0800FAD84C16281D67D5ED58FA3

Function 3BEBD564 Relevance: 21.1, APIs: 1, Strings: 13, Instructions: 122COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 3BEBE09D

Strings

C, xrefs: 3BEBE0D5
a, xrefs: 3BEBE0EA
l, xrefs: 3BEBE10D
e, xrefs: 3BEBE0E3
F, xrefs: 3BEBE0FF
e, xrefs: 3BEBE0F8
i, xrefs: 3BEBE106
t, xrefs: 3BEBE0F1
W, xrefs: 3BEBE11B
e, xrefs: 3BEBE114
5P5M, xrefs: 3BEBE0B8
r, xrefs: 3BEBE0DC
_W, xrefs: 3BEBE0AE

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5P5M$C$F$W$_W$a$e$e$e$i$l$r$t
API String ID: 2962429428-3741801046
Opcode ID: 4e06b58ba96e5ace161f1916feb9944e6108d49ab3d8453ed04ba01d09d58737
Instruction ID: 3e22502358bd491e74b105627a8556c5df6c45a19cbdec01f2ec899dd7bfc0fe
Opcode Fuzzy Hash: 4e06b58ba96e5ace161f1916feb9944e6108d49ab3d8453ed04ba01d09d58737
Instruction Fuzzy Hash: EA41F6B1C0C2A89AFB248728DC09BDB7E649B41714F0840FAD44C16281D67E5ED58FA3

Function 3BEBC143 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNELBASE(?,?,00000000,00000001,?,?,?,?,3BEBC0E0,?,?,?,?,3BEBBBF0,3BEB969B,?), ref: 3BEBC1BF

Strings

e, xrefs: 3BEBC1E1
l, xrefs: 3BEBC1CC
n, xrefs: 3BEBC1F6
s, xrefs: 3BEBC1DA
H, xrefs: 3BEBC1E8
o, xrefs: 3BEBC1D3
e, xrefs: 3BEBC20B
C, xrefs: 3BEBC1C5
l, xrefs: 3BEBC204
a, xrefs: 3BEBC1EF
d, xrefs: 3BEBC1FD

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: Value
String ID: C$H$a$d$e$e$l$l$n$o$s
API String ID: 3702945584-2848555115
Opcode ID: edb567c4d405c8c125092bce87387bbadf313e197d0d1ebb8806aa53d65049a3
Instruction ID: 627444ea62e9caeb9a024cab4d18935a32938c94d82b1340ef1e5f62e3d0c28d
Opcode Fuzzy Hash: edb567c4d405c8c125092bce87387bbadf313e197d0d1ebb8806aa53d65049a3
Instruction Fuzzy Hash: AF31C671D08A998EEB18CA28CC54BEABBB29B41305F0441EDD14C67281D6BA1FC6CF21

Function 3BEC39A0 Relevance: 15.2, APIs: 1, Strings: 9, Instructions: 156COMMON

Download Yara Rule

Strings

F, xrefs: 3BEC3EF6
a, xrefs: 3BEC3EE8
e, xrefs: 3BEC3F0B
i, xrefs: 3BEC3EFD
R, xrefs: 3BEC3EDA
l, xrefs: 3BEC3F04
d, xrefs: 3BEC3EEF
^S, xrefs: 3BEC3F6F
e, xrefs: 3BEC3EE1

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: F$R$^S$a$d$e$e$i$l
API String ID: 4275171209-2377276599
Opcode ID: 3141dec147b558d62405240489b1ff15c4184e45e55e9d0543e5dd0558e22c4b
Instruction ID: 41fa5d9adfdf1f4dc7cf7666e1d03c3eb339a718b6a7603c42fbbf594df49d40
Opcode Fuzzy Hash: 3141dec147b558d62405240489b1ff15c4184e45e55e9d0543e5dd0558e22c4b
Instruction Fuzzy Hash: 225125B1C086949FE7218A24CC947DBBFB5EF82315F1440FAC54D5A281D27A4AC6CB22

Function 3BEC3A16 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 147memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,39335C83,00003000,00000004), ref: 3BEC3E85

Strings

F, xrefs: 3BEC3EF6
a, xrefs: 3BEC3EE8
e, xrefs: 3BEC3F0B
i, xrefs: 3BEC3EFD
R, xrefs: 3BEC3EDA
l, xrefs: 3BEC3F04
d, xrefs: 3BEC3EEF
^S, xrefs: 3BEC3F6F
e, xrefs: 3BEC3EE1

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: F$R$^S$a$d$e$e$i$l
API String ID: 4275171209-2377276599
Opcode ID: 41cc12e3f37aa8b4cbd49388fdff73f92e74825ada55826acc8b6e96cb0f9759
Instruction ID: 5191d31a6d03cb2bd230287d948d457742ca6455b4a0134eb8dcaec2fb8cfe27
Opcode Fuzzy Hash: 41cc12e3f37aa8b4cbd49388fdff73f92e74825ada55826acc8b6e96cb0f9759
Instruction Fuzzy Hash: 1B5148B2C087949FF7218624DD94BDBBF75EF92704F1440FAD54D5A281D6BA0BC1CA22

Function 026C3A16 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 147memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,39335C83,00003000,00000004), ref: 026C3E85

Strings

e, xrefs: 026C3F0B
R, xrefs: 026C3EDA
d, xrefs: 026C3EEF
F, xrefs: 026C3EF6
^S, xrefs: 026C3F6F
l, xrefs: 026C3F04
i, xrefs: 026C3EFD
a, xrefs: 026C3EE8
e, xrefs: 026C3EE1

Memory Dump Source

Source File: 00000000.00000002.2667740199.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26b0000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: F$R$^S$a$d$e$e$i$l
API String ID: 4275171209-2377276599
Opcode ID: 41cc12e3f37aa8b4cbd49388fdff73f92e74825ada55826acc8b6e96cb0f9759
Instruction ID: 364a0ab03a428b5d4cea7991c91d21fad376a4f97b7d528e60fcc1b66b022c7e
Opcode Fuzzy Hash: 41cc12e3f37aa8b4cbd49388fdff73f92e74825ada55826acc8b6e96cb0f9759
Instruction Fuzzy Hash: 385137B1C086949FE7219624DC54BEBBF75EF92314F1440FED54D5A281D2BA0AC2CE61

Function 3BEC39E1 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 145COMMON

Download Yara Rule

Strings

F, xrefs: 3BEC3EF6
a, xrefs: 3BEC3EE8
e, xrefs: 3BEC3F0B
i, xrefs: 3BEC3EFD
R, xrefs: 3BEC3EDA
l, xrefs: 3BEC3F04
d, xrefs: 3BEC3EEF
^S, xrefs: 3BEC3F6F
e, xrefs: 3BEC3EE1

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: F$R$^S$a$d$e$e$i$l
API String ID: 4275171209-2377276599
Opcode ID: 1ab85169e5283b87be0723a637f2047cc87a8f4f4395c44928ae34f695379456
Instruction ID: deb3449515a873ac73a2cb6aa5341366c8687f20b1c90da8f3a5c38410ee3c2b
Opcode Fuzzy Hash: 1ab85169e5283b87be0723a637f2047cc87a8f4f4395c44928ae34f695379456
Instruction Fuzzy Hash: DE514CB1C097949FF3218628DD957DB7F75AF82704F1400FAC54D5A281D2BA4BC5CB62

Function 3BEC3A30 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 143memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,39335C83,00003000,00000004), ref: 3BEC3E85

Strings

F, xrefs: 3BEC3EF6
a, xrefs: 3BEC3EE8
e, xrefs: 3BEC3F0B
i, xrefs: 3BEC3EFD
R, xrefs: 3BEC3EDA
l, xrefs: 3BEC3F04
d, xrefs: 3BEC3EEF
^S, xrefs: 3BEC3F6F
e, xrefs: 3BEC3EE1

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: F$R$^S$a$d$e$e$i$l
API String ID: 4275171209-2377276599
Opcode ID: 7904322ccc2628d201d8326f4c62d4224f80ceb5d94975cf54b6622a622109d5
Instruction ID: 8320a4700a3ee7e07a7d94ae1bf240092ecee6030e28a70850a0bb29fbd0cec0
Opcode Fuzzy Hash: 7904322ccc2628d201d8326f4c62d4224f80ceb5d94975cf54b6622a622109d5
Instruction Fuzzy Hash: 245147B1C046A49FF3218625DD88BDBBF75EF82704F1400FAD54D66281D2BA0BC1CA62

Function 026C3A30 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 143memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,39335C83,00003000,00000004), ref: 026C3E85

Strings

e, xrefs: 026C3F0B
R, xrefs: 026C3EDA
d, xrefs: 026C3EEF
F, xrefs: 026C3EF6
^S, xrefs: 026C3F6F
l, xrefs: 026C3F04
i, xrefs: 026C3EFD
a, xrefs: 026C3EE8
e, xrefs: 026C3EE1

Memory Dump Source

Source File: 00000000.00000002.2667740199.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26b0000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: F$R$^S$a$d$e$e$i$l
API String ID: 4275171209-2377276599
Opcode ID: 7904322ccc2628d201d8326f4c62d4224f80ceb5d94975cf54b6622a622109d5
Instruction ID: c23425afe22901016202836cdd9f109c85a94435278420a9e3ed8dcbd512b813
Opcode Fuzzy Hash: 7904322ccc2628d201d8326f4c62d4224f80ceb5d94975cf54b6622a622109d5
Instruction Fuzzy Hash: 215146B1C046A49BE7219625DC58BEBBF75EF82314F1440FED54D66281D2BA0AC2CE61

Function 3BEC3A3B Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 138memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,39335C83,00003000,00000004), ref: 3BEC3E85

Strings

F, xrefs: 3BEC3EF6
a, xrefs: 3BEC3EE8
e, xrefs: 3BEC3F0B
i, xrefs: 3BEC3EFD
R, xrefs: 3BEC3EDA
l, xrefs: 3BEC3F04
d, xrefs: 3BEC3EEF
^S, xrefs: 3BEC3F6F
e, xrefs: 3BEC3EE1

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: F$R$^S$a$d$e$e$i$l
API String ID: 4275171209-2377276599
Opcode ID: 30d72032d7fcb36dd7c1532728cce3d959da61ef05a18c806bd9c6943fdf3140
Instruction ID: d90645b9463051faaf3d7b42ff59c8adc76cf74b96ee8a19c2cb5380e0e5ad48
Opcode Fuzzy Hash: 30d72032d7fcb36dd7c1532728cce3d959da61ef05a18c806bd9c6943fdf3140
Instruction Fuzzy Hash: B45146B2C046A49FF7218628DD84BDBBF75AF82705F1400FAD54D66281D2BA0BC1CF62

Function 026C3A3B Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 138memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,39335C83,00003000,00000004), ref: 026C3E85

Strings

e, xrefs: 026C3F0B
R, xrefs: 026C3EDA
d, xrefs: 026C3EEF
F, xrefs: 026C3EF6
^S, xrefs: 026C3F6F
l, xrefs: 026C3F04
i, xrefs: 026C3EFD
a, xrefs: 026C3EE8
e, xrefs: 026C3EE1

Memory Dump Source

Source File: 00000000.00000002.2667740199.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26b0000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: F$R$^S$a$d$e$e$i$l
API String ID: 4275171209-2377276599
Opcode ID: 30d72032d7fcb36dd7c1532728cce3d959da61ef05a18c806bd9c6943fdf3140
Instruction ID: 5562bc1864444d3848957a6e22eced77dbf5f3fdb98d68e9f4c3f88ee1bb4fdf
Opcode Fuzzy Hash: 30d72032d7fcb36dd7c1532728cce3d959da61ef05a18c806bd9c6943fdf3140
Instruction Fuzzy Hash: 3C5145B1D046A49BE7218624DC54BEBBF75EF82315F1440FED54D66281D2BA0BC2CF61

Function 3BEC3A68 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 131memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,39335C83,00003000,00000004), ref: 3BEC3E85

Strings

F, xrefs: 3BEC3EF6
a, xrefs: 3BEC3EE8
e, xrefs: 3BEC3F0B
i, xrefs: 3BEC3EFD
R, xrefs: 3BEC3EDA
l, xrefs: 3BEC3F04
d, xrefs: 3BEC3EEF
^S, xrefs: 3BEC3F6F
e, xrefs: 3BEC3EE1

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: F$R$^S$a$d$e$e$i$l
API String ID: 4275171209-2377276599
Opcode ID: 61db9a7b50d170d37c675933f2721a7f3ee4c2dabc97a5208ae357cc764a9919
Instruction ID: ab395aeb75a8291aad3f28fe001a032987a1bea0edf2c75e7ae4302fa0ea44e5
Opcode Fuzzy Hash: 61db9a7b50d170d37c675933f2721a7f3ee4c2dabc97a5208ae357cc764a9919
Instruction Fuzzy Hash: 7D4136B2C086A49FF3218624DC95BDBBF75AF92715F1400FAD54D1A281D2BA0BC1CB62

Function 026C3A68 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 131memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,39335C83,00003000,00000004), ref: 026C3E85

Strings

e, xrefs: 026C3F0B
R, xrefs: 026C3EDA
d, xrefs: 026C3EEF
F, xrefs: 026C3EF6
^S, xrefs: 026C3F6F
l, xrefs: 026C3F04
i, xrefs: 026C3EFD
a, xrefs: 026C3EE8
e, xrefs: 026C3EE1

Memory Dump Source

Source File: 00000000.00000002.2667740199.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26b0000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: F$R$^S$a$d$e$e$i$l
API String ID: 4275171209-2377276599
Opcode ID: 61db9a7b50d170d37c675933f2721a7f3ee4c2dabc97a5208ae357cc764a9919
Instruction ID: 0f0ed8f55945a44676668f64da89c116d5a6dbd4a6c07a682609c77af959ff1b
Opcode Fuzzy Hash: 61db9a7b50d170d37c675933f2721a7f3ee4c2dabc97a5208ae357cc764a9919
Instruction Fuzzy Hash: 9B4146B1D086A49FE3219624DC54BEBBF75EF92315F1440FEC54D1A281D2BA0AC2CF62

Function 3BEC39F4 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,39335C83,00003000,00000004), ref: 3BEC3E85

Strings

F, xrefs: 3BEC3EF6
a, xrefs: 3BEC3EE8
e, xrefs: 3BEC3F0B
i, xrefs: 3BEC3EFD
R, xrefs: 3BEC3EDA
l, xrefs: 3BEC3F04
d, xrefs: 3BEC3EEF
^S, xrefs: 3BEC3F6F
e, xrefs: 3BEC3EE1

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: F$R$^S$a$d$e$e$i$l
API String ID: 4275171209-2377276599
Opcode ID: 7ea7f55bef0f78ade4f06369be76c9845dc51543b7c7060e6ea3de02a0614b5b
Instruction ID: f2648983d746ffc65ea85dcdc2d8c2ca7c076a9c2f91992921deafb80c266987
Opcode Fuzzy Hash: 7ea7f55bef0f78ade4f06369be76c9845dc51543b7c7060e6ea3de02a0614b5b
Instruction Fuzzy Hash: 714137B1D086949FF7218625DC897DBBF75AF92705F1400F9D54D5A281D2BA0BC1CF22

Function 3BEC3936 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,39335C83,00003000,00000004), ref: 3BEC3E85

Strings

F, xrefs: 3BEC3EF6
a, xrefs: 3BEC3EE8
e, xrefs: 3BEC3F0B
i, xrefs: 3BEC3EFD
R, xrefs: 3BEC3EDA
l, xrefs: 3BEC3F04
d, xrefs: 3BEC3EEF
^S, xrefs: 3BEC3F6F
e, xrefs: 3BEC3EE1

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: F$R$^S$a$d$e$e$i$l
API String ID: 4275171209-2377276599
Opcode ID: a731e432bd37d839fc8ec193ce9b251205cd9bb0238adbb90797d4b789d16cb5
Instruction ID: 152c454d80641c3712396b26495d69c077c485ba8dc10adbfb1348bb169e64db
Opcode Fuzzy Hash: a731e432bd37d839fc8ec193ce9b251205cd9bb0238adbb90797d4b789d16cb5
Instruction Fuzzy Hash: E04149B2C092A49FF7218624DC957DBBF75AF92705F1400F9C54D1A281D2BA0BC1CF62

Function 3BEC3E48 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,39335C83,00003000,00000004), ref: 3BEC3E85

Strings

F, xrefs: 3BEC3EF6
a, xrefs: 3BEC3EE8
e, xrefs: 3BEC3F0B
i, xrefs: 3BEC3EFD
R, xrefs: 3BEC3EDA
l, xrefs: 3BEC3F04
d, xrefs: 3BEC3EEF
^S, xrefs: 3BEC3F6F
e, xrefs: 3BEC3EE1

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: F$R$^S$a$d$e$e$i$l
API String ID: 4275171209-2377276599
Opcode ID: 529d7e5447e120ba61df0b1e12f795e1f9cfde3fbe69496b2375f69555bbd19d
Instruction ID: 799970ee4c70e0a9071e9eaed243ab0b6855e9942c1f3984344723027d219c63
Opcode Fuzzy Hash: 529d7e5447e120ba61df0b1e12f795e1f9cfde3fbe69496b2375f69555bbd19d
Instruction Fuzzy Hash: 474149B1C082A49FF7218624DC85BDBBF75AF92715F1440FAC54D1A281D2BA0BC1CF62

Function 3BEC2ADB Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 119memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,39335C83,00003000,00000004), ref: 3BEC3E85

Strings

F, xrefs: 3BEC3EF6
a, xrefs: 3BEC3EE8
e, xrefs: 3BEC3F0B
i, xrefs: 3BEC3EFD
R, xrefs: 3BEC3EDA
l, xrefs: 3BEC3F04
d, xrefs: 3BEC3EEF
^S, xrefs: 3BEC3F6F
e, xrefs: 3BEC3EE1

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: F$R$^S$a$d$e$e$i$l
API String ID: 4275171209-2377276599
Opcode ID: 023a0cbf1f71054875a8b6face02e6ad2f281ff22ac6ce6c96b586584fd9b362
Instruction ID: 6e518e51c4a7298ddb7764693893ed5052a04fc6356ed96673ba98703163d661
Opcode Fuzzy Hash: 023a0cbf1f71054875a8b6face02e6ad2f281ff22ac6ce6c96b586584fd9b362
Instruction Fuzzy Hash: CF4159A2C083949FF3218624DC99BD7BF75DF92715F1400F9D54D5A281D2BA0BC1CB22

Function 3BEC3968 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 118memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,39335C83,00003000,00000004), ref: 3BEC3E85

Strings

F, xrefs: 3BEC3EF6
a, xrefs: 3BEC3EE8
e, xrefs: 3BEC3F0B
i, xrefs: 3BEC3EFD
R, xrefs: 3BEC3EDA
l, xrefs: 3BEC3F04
d, xrefs: 3BEC3EEF
^S, xrefs: 3BEC3F6F
e, xrefs: 3BEC3EE1

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: F$R$^S$a$d$e$e$i$l
API String ID: 4275171209-2377276599
Opcode ID: e4e65e63fb9d55602adcc2f0a85e4d13e558049cc347d8fa74676ab262af103e
Instruction ID: 6f775729bdfc3fa4cf3e5500fbcd069c39a1534226837f2ed4423152d27237a0
Opcode Fuzzy Hash: e4e65e63fb9d55602adcc2f0a85e4d13e558049cc347d8fa74676ab262af103e
Instruction Fuzzy Hash: 9F4127B1D096A49FF7218624DC99BDBBF75AF92705F1400F9D54D1A281D2BA0BC1CF22

Function 3BEC3356 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 117memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,39335C83,00003000,00000004), ref: 3BEC3E85

Strings

F, xrefs: 3BEC3EF6
a, xrefs: 3BEC3EE8
e, xrefs: 3BEC3F0B
i, xrefs: 3BEC3EFD
R, xrefs: 3BEC3EDA
l, xrefs: 3BEC3F04
d, xrefs: 3BEC3EEF
^S, xrefs: 3BEC3F6F
e, xrefs: 3BEC3EE1

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: F$R$^S$a$d$e$e$i$l
API String ID: 4275171209-2377276599
Opcode ID: 1d96e366ad7ae2cfa47566351e481602f0f91ddc3d4e29037e6cf0c91c6741e8
Instruction ID: e2885ece506147528feae6806952333baa4a5378810d5bfa93c63f6e400125c4
Opcode Fuzzy Hash: 1d96e366ad7ae2cfa47566351e481602f0f91ddc3d4e29037e6cf0c91c6741e8
Instruction Fuzzy Hash: DD4157B2C083949FF3218624DC59BD7BFB5AF92715F1400F9D54D5A281D2BA0BC1CB62

Function 3BEB9BFC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 3BEBA0FB

Strings

557C, xrefs: 3BEB9BFC
Qh?, xrefs: 3BEBA0E7

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: Open
String ID: 557C$Qh?
API String ID: 71445658-219458933
Opcode ID: 3cb653597bc64d961f8f4ae0a1d08e0bbc5b2a95d2a0e29e8a3dee2843e3208e
Instruction ID: fa1ba82a78c41ffdc5be78f7784d0c1a6f2f17bddbdbace1c69e968a90c4dfdf
Opcode Fuzzy Hash: 3cb653597bc64d961f8f4ae0a1d08e0bbc5b2a95d2a0e29e8a3dee2843e3208e
Instruction Fuzzy Hash: AC11E2FAD143189EFB14CB18CC44BFA76B5EB84310F00E1BAD58996680DA399EC58E52

Function 3BEB7A94 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Strings

K, xrefs: 3BEB7C69

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID: K
API String ID: 4241100979-856455061
Opcode ID: d17a66c6a1fb85ad1f00bd7f9ef20fde77fd129ea050c0d1258e21f55d8bd975
Instruction ID: a61ebb541d81c86e1a94be9a3477989e4ab68bee628c297859d91c9b46b0c52f
Opcode Fuzzy Hash: d17a66c6a1fb85ad1f00bd7f9ef20fde77fd129ea050c0d1258e21f55d8bd975
Instruction Fuzzy Hash: 2551F0B0D0C3985AEF14CB18DDD07AA7BBAEB45305F1840EACA4D56B42DA385BC18E12

Function 3BEB6667 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 135COMMON

Download Yara Rule

Strings

;ZQS, xrefs: 3BEB6669

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID: ;ZQS
API String ID: 4241100979-914843521
Opcode ID: 2a60bbca95aa46d13a933386d657eaf3397486c2e2617a7e6b4dbfda275d0657
Instruction ID: ad41866a012368e11f3d71e736d9a07ec0621b744dc602bf13ad100b44ecefee
Opcode Fuzzy Hash: 2a60bbca95aa46d13a933386d657eaf3397486c2e2617a7e6b4dbfda275d0657
Instruction Fuzzy Hash: 6041E6A1D1C3589EEF14CB28DC446EABB75EF84700F1481EAD50D96295EA381AC08F16

Function 00541A3F Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

K32GetPerformanceInfo.KERNEL32(?,00000038), ref: 00541FDB

Strings

>9MJ, xrefs: 00541B14

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: InfoPerformance
String ID: >9MJ
API String ID: 3070290716-3386120023
Opcode ID: 1e3ca6a2eb1fbbdb94920b2adb9bed1a38b8a3d3ba7fd2f160861eebe2c7d90e
Instruction ID: 2a4afc837041121e3bfe3334d9db2c67196c281d4cafe6a74e2ba7233e38de6f
Opcode Fuzzy Hash: 1e3ca6a2eb1fbbdb94920b2adb9bed1a38b8a3d3ba7fd2f160861eebe2c7d90e
Instruction Fuzzy Hash: 3151BEB2D156289BE728CF14CD94BEABBB5FB90304F14C1E9D40D6A784D6386EC58F44

Function 005487DD Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00548D68

Strings

=M<4, xrefs: 005488A6

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID: =M<4
API String ID: 544645111-151022777
Opcode ID: 6b449beb5ec40ea697394cf505f180c7ebe87447f53f60f71666c0006ac580c9
Instruction ID: 8c6a14a01cc8813a3283c3d0cecb2b8429e1b1d1bbf78ec5efad4d07a39c6fe3
Opcode Fuzzy Hash: 6b449beb5ec40ea697394cf505f180c7ebe87447f53f60f71666c0006ac580c9
Instruction Fuzzy Hash: B13124B1D042199FEB208A24CC84BFE7B75FB90308F1481FAD54A6A682DE301ED5CF52

Function 3BEB671C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

A2L:, xrefs: 3BEB671C

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID: A2L:
API String ID: 4241100979-3217229825
Opcode ID: e30be1e314151d5dd159db7691d13d1b836159c35da81fcad1178ccc75eba72a
Instruction ID: 70a65a379d4f3c2b4f965f857f7730aa1922bb1174db1727ade84ae062dcf3c5
Opcode Fuzzy Hash: e30be1e314151d5dd159db7691d13d1b836159c35da81fcad1178ccc75eba72a
Instruction Fuzzy Hash: 1731E5B1D1D3A89EEF24CB68DC447EABB74EF85700F1081EAD44D9A155EA780AC5CF12

Function 3BEB76E4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

;GM^, xrefs: 3BEB76E5

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID: ;GM^
API String ID: 4241100979-3133109826
Opcode ID: 84b5d8deae7373197ffdb3b76443b1e1e566bdebe1fdbd7deb08a4906065d452
Instruction ID: 55d0a1baf73a0e5c0ab768ed1c4db9a95f781c58f6ba26c14b5cceee7c0d6b07
Opcode Fuzzy Hash: 84b5d8deae7373197ffdb3b76443b1e1e566bdebe1fdbd7deb08a4906065d452
Instruction Fuzzy Hash: C431F8F1C093A85FEB20DB54CC90ADA7B74DF85704F1581FAD98C66641DA344EC6CB92

Function 00E3B8FD Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 76processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 00E3BE3D

Strings

jjjj, xrefs: 00E3BE2E

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 4455b64cdea1b26f6edff0b999ce5551bc52efe780797bddcb0211565cb0704c
Instruction ID: d85743ed7268f6cdfe88fa83fba1d5226d49d3b2a9fbe9473cf211903dac6db5
Opcode Fuzzy Hash: 4455b64cdea1b26f6edff0b999ce5551bc52efe780797bddcb0211565cb0704c
Instruction Fuzzy Hash: 1F21A472E4121D9AF7348A14CD85BFA7B78E744310F2451F9EA0AA65C0D6355F809F50

Function 00E3B913 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 69processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 00E3BE3D

Strings

jjjj, xrefs: 00E3BE2E

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 904e06bd45bd9fdf50ddd58c086326ef73d7893ea4a6e4ff4d6f230e9fc175fb
Instruction ID: ffbba9601a52263d831a0697b84cf2e78f4f11f0acc19d1b64e15ba6e597f803
Opcode Fuzzy Hash: 904e06bd45bd9fdf50ddd58c086326ef73d7893ea4a6e4ff4d6f230e9fc175fb
Instruction Fuzzy Hash: 7421C372E4021D9AF734CA15CC95BFA7B78EB44300F1051F9E909AA6C0D6355F80DF80

Function 005487B2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

7;PF, xrefs: 005487D5

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID: 7;PF
API String ID: 544645111-1099082884
Opcode ID: 3a19ca62995d2c28e97c3dcd1b95990e7a350f8078187c2eeae706a144347792
Instruction ID: a6874fc4fe02c79d032309a430a846c5687fb61d88b1092537850fad30f1645a
Opcode Fuzzy Hash: 3a19ca62995d2c28e97c3dcd1b95990e7a350f8078187c2eeae706a144347792
Instruction Fuzzy Hash: 6D2102B2D041559FEB208A24CC58BFF7AB4FB80348F2081FAE60E67681DE344EC58B51

Function 3BEB7C50 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Strings

K, xrefs: 3BEB7C69

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID: K
API String ID: 4241100979-856455061
Opcode ID: 113ad6bb2380edc36fc4b847648b066c376f0e3ed5ca20c6d6dca9cf2380ffb3
Instruction ID: 187194ddbf5e467e806333967b9c713888ff7423c9b63ecfa203f438c9f2afee
Opcode Fuzzy Hash: 113ad6bb2380edc36fc4b847648b066c376f0e3ed5ca20c6d6dca9cf2380ffb3
Instruction Fuzzy Hash: 7611DFB0C093986FEB11CB10DC807EA7B74EB46304F0940DBD48DAA642E6394ECA8F52

Function 3BEB7C65 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Strings

K, xrefs: 3BEB7C69

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID: K
API String ID: 4241100979-856455061
Opcode ID: 6a291d858259b90ed948322e226fd18828e5b6510c0699e9ddc9ca19d3840a5b
Instruction ID: 23edb5f167424481ce0ba802085c8f38d275b5c6a279af7f536e1178eebea862
Opcode Fuzzy Hash: 6a291d858259b90ed948322e226fd18828e5b6510c0699e9ddc9ca19d3840a5b
Instruction Fuzzy Hash: CE119DB0C08398AEEB108B14DC816EA7B78EB45700F0880EAD48D65641EA395EC58E52

Function 3BEB9C09 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 3BEBA0FB

Strings

Qh?, xrefs: 3BEBA0E7

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: 0198249a4045f7c3f1497b2a8630e81faab1d8669acd1561e853a4e98890e6e9
Instruction ID: 8d2fe53cf15915831402509c5b9427a516214baa37c769fa1c706ca66eb323ed
Opcode Fuzzy Hash: 0198249a4045f7c3f1497b2a8630e81faab1d8669acd1561e853a4e98890e6e9
Instruction Fuzzy Hash: 9211C1B6D14318AEFB14CB28CC44BFAB6B5EB84310F00E1BAD54996680DA395EC58E11

Function 00E3BD82 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 00E3BE3D

Strings

jjjj, xrefs: 00E3BE2E

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 0b67a3e93217666004ff40da8b37dee503d237bef2fb6423eb3e0ff8ee471c7f
Instruction ID: 55bb591cdaea919fe6c8fac6fc4e878712e9625869d8fdf932b44fe701b5a57b
Opcode Fuzzy Hash: 0b67a3e93217666004ff40da8b37dee503d237bef2fb6423eb3e0ff8ee471c7f
Instruction Fuzzy Hash: 701170B1E442189AEB388A51CC56BFA7BB4EB00705F6095EAEA0B761C0DB741FC0DF51

Function 00E3B9D6 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 00E3BE3D

Strings

jjjj, xrefs: 00E3BE2E

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: e4de883d4ce3135bbe8338da155d89f484d7090c259057cc541c34b4ac4b9941
Instruction ID: 64d40923964a8ae0040a2a0f0e8dff32e483eed5005d556302f2747cd460a64b
Opcode Fuzzy Hash: e4de883d4ce3135bbe8338da155d89f484d7090c259057cc541c34b4ac4b9941
Instruction Fuzzy Hash: 1701D6B2E042189AF734C905CC95FFAB774EB00701F2054E5EE09B52C0E6756F809F90

Function 3BEBA07C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 3BEBA0FB

Strings

Qh?, xrefs: 3BEBA0E7

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: f8526c289196378cd7bff4ec3010927700e7c0c1bc176cab9d48bfc231d53c4d
Instruction ID: 8a3f2959ee46624c311a7adffef0dbb3f2c4da057430190a0898e889216c4645
Opcode Fuzzy Hash: f8526c289196378cd7bff4ec3010927700e7c0c1bc176cab9d48bfc231d53c4d
Instruction Fuzzy Hash: DF01B5F2C18718AFEF24CB18CC54AFB7A68EF40701F4061AAA88951581EE745FC1CE53

Function 00E3AA2D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 00E3BE3D

Strings

jjjj, xrefs: 00E3BE2E

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 3890283ce0457eb32d0766ba7cfa8f33abbd822ea9efb7c2a4984ae7506b213a
Instruction ID: 238d51d522aa7cccdf1a7761047d12c6d6496cd0ca1faa8e01663913bc85e303
Opcode Fuzzy Hash: 3890283ce0457eb32d0766ba7cfa8f33abbd822ea9efb7c2a4984ae7506b213a
Instruction Fuzzy Hash: 7001FC73F45258AAF7348916CC49FEE7B75AB80701F6051E9EA0A7A5C0D7F41B809B41

Function 00E3BDAE Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 00E3BE3D

Strings

jjjj, xrefs: 00E3BE2E

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 66204683e165099a07daaae221ba03c19274fa427e00a6513269654286639aab
Instruction ID: 3e37f5d011485b5f65debdb0cbad0471ae6a53e17d97f2103f02fbcd126ef988
Opcode Fuzzy Hash: 66204683e165099a07daaae221ba03c19274fa427e00a6513269654286639aab
Instruction Fuzzy Hash: 7C017171E442589AEB388A51CC56BF9BB74EB40701F2041DEEA4B7A1C0DB711B809F44

Function 00E3B2AD Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 43processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 00E3BE3D

Strings

jjjj, xrefs: 00E3BE2E

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: f7bd3e088d5ec32d4f3b5729740d0f0a05f0531191a536fa2145f56e457d0eb8
Instruction ID: ddb0f038c27b749d0449d9aade5ba12e2ab88211a1060da2349d93032356b6bb
Opcode Fuzzy Hash: f7bd3e088d5ec32d4f3b5729740d0f0a05f0531191a536fa2145f56e457d0eb8
Instruction Fuzzy Hash: 2601F972B4561896EB34C941CC4AFFD7775EB81701F2491D5E60A395C0E7741A80DB41

Function 00E3B8A3 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 00E3BE3D

Strings

jjjj, xrefs: 00E3BE2E

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 9e5ea8e323a16d38abe5f09f51a2b246070780c19cec1e0154d0e243c047ac8b
Instruction ID: fefb6f97ea0150560254c44d3c73207c15d1c7e2294b7173ce228100905d90d5
Opcode Fuzzy Hash: 9e5ea8e323a16d38abe5f09f51a2b246070780c19cec1e0154d0e243c047ac8b
Instruction Fuzzy Hash: B601DB72E4021D9ADB34CA55CC56FEABB74EB04701F2055D6FA0ABA180D3755F80DF91

Function 00E3A9FC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 00E3BE3D

Strings

jjjj, xrefs: 00E3BE2E

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: e84534659dc528a21b8cc372649596e82f120c6d65e9462b429148fe5c93b6bd
Instruction ID: d9d22c2e03a8df88d96b3dc985bdf3c1586717e49f2ca35dc0e67e26c517a392
Opcode Fuzzy Hash: e84534659dc528a21b8cc372649596e82f120c6d65e9462b429148fe5c93b6bd
Instruction Fuzzy Hash: 3801F233F052189AEB248906CC09BE9BB64AB80705F6050E5EA0A3A4C0D6B41A809B41

Function 00E3B2B2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 00E3BE3D

Strings

jjjj, xrefs: 00E3BE2E

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 70634f26b1ae7896aab81c46e35f1fe2971a447744ae8384650db3339f45d4e5
Instruction ID: 123fae7d6ac97bed4905edcbe7d05fc0f7d03ea94d9dc01266535e9142f46a82
Opcode Fuzzy Hash: 70634f26b1ae7896aab81c46e35f1fe2971a447744ae8384650db3339f45d4e5
Instruction Fuzzy Hash: 76012671B092589AEB34CA41CC46FFA7B70EF81705F2490D9E60B7A5C1D7711A84DB81

Function 3BEBA09D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 3BEBA0FB

Strings

Qh?, xrefs: 3BEBA0E7

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: 16f2fb86c47d75584d352aa26e954248e87630d4248e3aa84dc9d8df5d958252
Instruction ID: cb1ac7982a225f6c2d093b830e28f6e30e47912af347b0d63084fc52948eccf8
Opcode Fuzzy Hash: 16f2fb86c47d75584d352aa26e954248e87630d4248e3aa84dc9d8df5d958252
Instruction Fuzzy Hash: D6F081F5C18318AEEF24CB18CD54AFA7A78EF40700F40A1EAA88A65540DE745FC18F13

Function 3BEB9CD9 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 38registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 3BEBA0FB

Strings

Qh?, xrefs: 3BEBA0E7

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: aa7d00d81ec189bd87bcce02e013ad21ecad6f15d85b88b15f178ff42c514edf
Instruction ID: eaf8d74ccbeabaddc0d390f039fcb25ea9f2f24b6f7f275583a6253563d18451
Opcode Fuzzy Hash: aa7d00d81ec189bd87bcce02e013ad21ecad6f15d85b88b15f178ff42c514edf
Instruction Fuzzy Hash: A1F081F5914358AEEF15CB14CC44BFEBA78EF40700F40A5AAA489A6540DA755FC5CE12

Function 00E3B2CC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 00E3BE3D

Strings

jjjj, xrefs: 00E3BE2E

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 6840c7b78c91cc49818bcc54ba458770c795cccbbb4a63c346a1c11938a36e1b
Instruction ID: 61cb5a743d20fd64a81a19c83bd1d8411706d03ff088cf85098447a57d75536d
Opcode Fuzzy Hash: 6840c7b78c91cc49818bcc54ba458770c795cccbbb4a63c346a1c11938a36e1b
Instruction Fuzzy Hash: D5F0F672B0565C96EB34C942CC46FFCB770AB40701F2091D9EA0A795C0E7B01E80DF81

Function 3BEBA0AB Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 3BEBA0FB

Strings

Qh?, xrefs: 3BEBA0E7

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: 4797f77d120bcea430a4ea180c78827df8a4a51a82db65e2143518f6d2acc2a5
Instruction ID: 23bba6e35871c84b725ad3d7857fa60d0d1a9c9a98ef8053f2b792cb68379709
Opcode Fuzzy Hash: 4797f77d120bcea430a4ea180c78827df8a4a51a82db65e2143518f6d2acc2a5
Instruction Fuzzy Hash: BCF03CB5814318AEEF29CF18CC44AFA7B78EF40701F40A1DAA98A65540DE755F85CF12

Function 3BEB8D36 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35COMMON

Download Yara Rule

Strings

Qh?, xrefs: 3BEBA0E7

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: eea14d86ca8880136b55622ad33732fe315635168edc1a1ba26f3762c0602ce5
Instruction ID: 1800ff0ceb93f86a16d5a3a1738e352ad388bb80bd430819feca994ead1a5723
Opcode Fuzzy Hash: eea14d86ca8880136b55622ad33732fe315635168edc1a1ba26f3762c0602ce5
Instruction Fuzzy Hash: CEF0AFE1808348AEEF54CB24DC44BAA3E64EF50B00F40A19AD58914481EE744AC5CE23

Function 3BEB9BA0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 3BEBA0FB

Strings

Qh?, xrefs: 3BEBA0E7

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: 0da8e396d210691994c2e90656efe39bcbe6442fd234bd89f04e4363b2550418
Instruction ID: b8810f29cf0d7157060cc10a395f61ccc2a6522cd1a5841d01b6221bda0d40a0
Opcode Fuzzy Hash: 0da8e396d210691994c2e90656efe39bcbe6442fd234bd89f04e4363b2550418
Instruction Fuzzy Hash: 48F04FF5D14318AEEF25CB14CC44AEABAB4EF84700F40A2AAA98965540EA755F85CE12

Function 00E3B8E9 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 00E3BE3D

Strings

jjjj, xrefs: 00E3BE2E

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 779d8010a804dd515a025a59d640c0ab89725a1a6ec7f095d3abcb0305f164e7
Instruction ID: 52a8ac94c86cb12dcf0d7a84e9745ef6183864fc0cf2fb0875b3d8182b733ece
Opcode Fuzzy Hash: 779d8010a804dd515a025a59d640c0ab89725a1a6ec7f095d3abcb0305f164e7
Instruction Fuzzy Hash: 41F04F71F4421DAAEB34CA45CC46FE9B7B4AB44701F2095D9EA0ABA180E7716F80DF94

Function 3BEBA0B4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 3BEBA0FB

Strings

Qh?, xrefs: 3BEBA0E7

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: ee6cdc6fa1045018a9f7885b9809f726e9f942854c9b775476831f21130f4635
Instruction ID: dfac78bf89a150c9129d2feff3881352d7109a0a4cfaa18bc6707abfd57f089b
Opcode Fuzzy Hash: ee6cdc6fa1045018a9f7885b9809f726e9f942854c9b775476831f21130f4635
Instruction Fuzzy Hash: 6BF049F581431CAEEF25CB18CC40AFABAB8EF40701F40A2DAA48961540DA755F80CE12

Function 3BEB9BD2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 3BEBA0FB

Strings

Qh?, xrefs: 3BEBA0E7

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: d99a864e144566c439742d7ac9f73c60f77b21b85667bbf3f7e558ad0b62cdc7
Instruction ID: 67b5797c7db6363d00f0f14ba34d8c1f85f957dec82e5edf8b84223dd5f90685
Opcode Fuzzy Hash: d99a864e144566c439742d7ac9f73c60f77b21b85667bbf3f7e558ad0b62cdc7
Instruction Fuzzy Hash: 20F01DF591431CAEEF25CB14CC44BFABAB8EF44700F40A2DAA58965540DA755F85CF12

Function 3BEB95C1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 3BEBA0FB

Strings

Qh?, xrefs: 3BEBA0E7

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: 665f146a684a2591f8f3a9a9f039a0c2e2d969dd48a818ec78092ec9fedefca4
Instruction ID: 068737e0b24e00ff50907a552ebe3528a0b6e08fa0b7c6c0b4d933f20b86748c
Opcode Fuzzy Hash: 665f146a684a2591f8f3a9a9f039a0c2e2d969dd48a818ec78092ec9fedefca4
Instruction Fuzzy Hash: 75F082F5904318ADFF14CB14DD04BFE7A74DF40700F40A2AAE189144809A745FC5CE13

Function 3BEB8D4C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,000F003F,?), ref: 3BEBA0FB

Strings

Qh?, xrefs: 3BEBA0E7

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: Open
String ID: Qh?
API String ID: 71445658-2306691335
Opcode ID: 805d408ccdf3c82228bd8776d5eddff33284df6a6d235308b070bd827510ef29
Instruction ID: 31d59b04086d972770f867ea0dfe582b24493c3882c145c1628fde32753515de
Opcode Fuzzy Hash: 805d408ccdf3c82228bd8776d5eddff33284df6a6d235308b070bd827510ef29
Instruction Fuzzy Hash: 77F082F5808318ADFF14CB14DC04BFA7A74DF40700F40A2AAE189144809E745FC5CE13

Function 3BEC5D53 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 3BEC5DA9

Strings

P@65, xrefs: 3BEC5D54

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID: P@65
API String ID: 2738559852-1165756456
Opcode ID: b026a87512f5465d5cd140d5b333ca79d552e11c47dd94f92bf6601c36060fbe
Instruction ID: 6c2c196a23940e26bb4818d726ba06b07e22efbe2198182507d8eede84fcfeb6
Opcode Fuzzy Hash: b026a87512f5465d5cd140d5b333ca79d552e11c47dd94f92bf6601c36060fbe
Instruction Fuzzy Hash: 10F08275D457298BE724CE04DD84BDFF3B5AB88745F0081E9E80DA7200DA715ED08F81

Function 3BEC5267 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 3BEC5DA9

Strings

8G2D, xrefs: 3BEC5267

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID: 8G2D
API String ID: 2738559852-4258219503
Opcode ID: 49260080b530d25edf066e949fa31f889f055353704453b1a5575e106d6df536
Instruction ID: c61ebb63efe67b0ebf37b80bf8ee6bfd7bce813901015f351dc1e34a076476ec
Opcode Fuzzy Hash: 49260080b530d25edf066e949fa31f889f055353704453b1a5575e106d6df536
Instruction Fuzzy Hash: C8E01A71A453189BF720CE48CD85BDFB7F9BB88B09F1082D9E50CE6140EA319A908B91

Function 026C5267 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 026C5DA9

Strings

8G2D, xrefs: 026C5267

Memory Dump Source

Source File: 00000000.00000002.2667740199.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26b0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID: 8G2D
API String ID: 2738559852-4258219503
Opcode ID: 49260080b530d25edf066e949fa31f889f055353704453b1a5575e106d6df536
Instruction ID: c50096459ae095758cf7a1fe846e696099174f1f482aa862224651f8931b7618
Opcode Fuzzy Hash: 49260080b530d25edf066e949fa31f889f055353704453b1a5575e106d6df536
Instruction Fuzzy Hash: 1BE012719452149BE724DE448C84BFEB3B5FB84705F5042DDE509E6140DB3169918B91

Function 00E4A974 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 223COMMON

Download Yara Rule

Strings

EHO<, xrefs: 00E4AEEC

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: EHO<
API String ID: 4275171209-2877916198
Opcode ID: fa3bb901346e56f1d64e71a227321cea0d925e510832e7948290e1ccf5cec822
Instruction ID: d037fa8aa79b7255550aa90cbb57bebad98fe0150b724fb60eb507dd89a3932f
Opcode Fuzzy Hash: fa3bb901346e56f1d64e71a227321cea0d925e510832e7948290e1ccf5cec822
Instruction Fuzzy Hash: 1C7125F2D041146FF7248A24EC59BFB7B79EB80314F1481BEE80966680E77C9EC5CA52

Function 00546880 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00546BBA

Strings

@7@:, xrefs: 00546937

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: @7@:
API String ID: 4275171209-2902581891
Opcode ID: a281decdbc1ef60d1bcf704059be086208a4271f60b5a3f17bb634401339e879
Instruction ID: e63054a0582db16fa87fae7b91436714afcc4da6379ac6ae1e97b401ac532b56
Opcode Fuzzy Hash: a281decdbc1ef60d1bcf704059be086208a4271f60b5a3f17bb634401339e879
Instruction Fuzzy Hash: 3A31EFB1D051649FE710CA10CC84BEA7BB5FFC2309F14C4FAD8496B285D6395E868FA2

Function 00E35642 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

M3HI, xrefs: 00E35642

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: M3HI
API String ID: 4275171209-1505179660
Opcode ID: aaeb17e6b2f8533bad25e1fce4f4af2e064babcdd19e3efd74f6016498aec9bf
Instruction ID: c59636d8f884ea17a1a53594fc0d08aeb6d2e7eb20601b536a0dd3d2af26669b
Opcode Fuzzy Hash: aaeb17e6b2f8533bad25e1fce4f4af2e064babcdd19e3efd74f6016498aec9bf
Instruction Fuzzy Hash: 0031E8B1D00559AFFB348A21CC5C7EABB75AB8130AF1450EED109B6181D7B90EC8CF52

Function 00E3565F Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

5IDD, xrefs: 00E3565F

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: 5IDD
API String ID: 4275171209-2086563400
Opcode ID: 3913714fbfc300ba91229a2dcbf09d1c8f0ac023df71876ab593a30ab23e52a1
Instruction ID: c7361884678d8fcdff68bb1c18f67e4417f3a8639ae253b0d8202a26c9ecc656
Opcode Fuzzy Hash: 3913714fbfc300ba91229a2dcbf09d1c8f0ac023df71876ab593a30ab23e52a1
Instruction Fuzzy Hash: AB31E971904659AFEB348A21CC5C7EABBB5AB4130EF2450EED00AB5181D7B94EC9CF12

Function 00E36642 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00E36AF4

Strings

P?O6, xrefs: 00E36643

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: P?O6
API String ID: 4275171209-2099622976
Opcode ID: 4520258b1aab29a83e53f34ae7dc110cfa6dc16e8f2a8f4730fa3cf27b6a972c
Instruction ID: 8f13a8e0f754a423144c7d64e089a9c1d4afcd9858089031c18b6679c6b7c4ca
Opcode Fuzzy Hash: 4520258b1aab29a83e53f34ae7dc110cfa6dc16e8f2a8f4730fa3cf27b6a972c
Instruction Fuzzy Hash: 4C217771904559AFEB318A25DC4CBEABB75AB81309F2094E9D40DB6180D7790EC8CF11

Function 00E36594 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00E36AF4

Strings

EM6^, xrefs: 00E36596

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID: EM6^
API String ID: 4275171209-4026762246
Opcode ID: 5aee7129e3d90f36188c5794b13980fc991cc71b331e445d9f66b058ad28cb14
Instruction ID: 2c4c3b633936a6c493d0fd7fb21164c86f80427bc36f056716e0887a84b5fcd3
Opcode Fuzzy Hash: 5aee7129e3d90f36188c5794b13980fc991cc71b331e445d9f66b058ad28cb14
Instruction Fuzzy Hash: 3121A4B0904529AFEB348E20DC5C7FABBB5AB4030AF1054E9D409B6180D7790EC8CF01

Function 3BEC56F7 Relevance: 1.8, APIs: 1, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 154bbdbe0896aa84e98682a674c764b959cd4845bf8c97da833bee5e2ea63196
Instruction ID: 89fce2adea4d8279b376a99715dccd6d432012ffd30b05b5e281b5103856cff3
Opcode Fuzzy Hash: 154bbdbe0896aa84e98682a674c764b959cd4845bf8c97da833bee5e2ea63196
Instruction Fuzzy Hash: 738109F2D102155FF7148A14DD85BFB77B9EB80314F1482BAD90D96280E67C5EC18F92

Function 00548A06 Relevance: 1.7, APIs: 1, Instructions: 229memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00548D68

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: f06cffc4548ebeebeaecc282717a4f9b24fd6150206d6321807e80ff7e0921b9
Instruction ID: 2673e868d8cdbc85732c8f6cc1dd295b3cb9aa0c56c91ab49c4fd11079968a5a
Opcode Fuzzy Hash: f06cffc4548ebeebeaecc282717a4f9b24fd6150206d6321807e80ff7e0921b9
Instruction Fuzzy Hash: D47136F2D041689FE714CA14DC94AFF7B79FB81318F1881FAD94A57680DA385E818F92

Function 3BEBEFC7 Relevance: 1.7, APIs: 1, Instructions: 227fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 3BEBFFDF

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 448fbc7bbbf37520996c4ac79a6ae751dab3c0a66d0d8c7d2c3b77ced75d1009
Instruction ID: 13ae408fd5bc32e619acc32e6ccf4bae4b30155d03ea5f2ed22394c6f89454e7
Opcode Fuzzy Hash: 448fbc7bbbf37520996c4ac79a6ae751dab3c0a66d0d8c7d2c3b77ced75d1009
Instruction Fuzzy Hash: DD8125B6D042249FFB24CB18DC95BEBB779EB84318F1481F9E90D57281D6385EC28E91

Function 0054122C Relevance: 1.7, APIs: 1, Instructions: 214COMMON

Download Yara Rule

APIs

K32GetPerformanceInfo.KERNEL32(?,00000038), ref: 00541FDB

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: InfoPerformance
String ID:
API String ID: 3070290716-0
Opcode ID: 66db2fd7d8560504131b1210d7cf6d2f26c934d3399b2fe85552ebff63edb38a
Instruction ID: bbf921ee582a9f2d0934f6865c60331b9a537dae2e7e8efd853446c97c3e2dea
Opcode Fuzzy Hash: 66db2fd7d8560504131b1210d7cf6d2f26c934d3399b2fe85552ebff63edb38a
Instruction Fuzzy Hash: 3781C471D046188BEB24CB24CD94BEEBF75FB41315F1482A9D80DA7644C638ABC1CF55

Function 3BEC54A5 Relevance: 1.7, APIs: 1, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 6dc36f09f61b9b0e4138b36efc47e182a1d24234fb390bcbf9444894c8b14a23
Instruction ID: b4bb4b42583b6c9792f3a3304de5728bd421d3a925b61416a75a06feaf3a0c2a
Opcode Fuzzy Hash: 6dc36f09f61b9b0e4138b36efc47e182a1d24234fb390bcbf9444894c8b14a23
Instruction Fuzzy Hash: 266109F2D102195AF7248A18DD45BFB76B9EBC0314F0482BAD90D96680EA7C5FC1CF92

Function 00547662 Relevance: 1.7, APIs: 1, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 432bcbe4fcfccd2a9311ffc963c6e47ba841499f3f533c5a611c04326f29994f
Instruction ID: 043a8f891fe602f778c2043d8da32fd8cad315076a950ba7974103348e4fa192
Opcode Fuzzy Hash: 432bcbe4fcfccd2a9311ffc963c6e47ba841499f3f533c5a611c04326f29994f
Instruction Fuzzy Hash: A76115B2D086189EE720CA25DC98BFABB75FF94314F1480BED90D56681E6781EC5CF01

Function 3BEBFA44 Relevance: 1.7, APIs: 1, Instructions: 174fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 3BEBFFDF

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 0207e1c8ba9895d34605f527f1132f0ae60f947e87d2d8b5e7840e1a364c8902
Instruction ID: f8305a0a317c7926a950771f3ae16bb063bd774c6d8a0c639c81ef474497c207
Opcode Fuzzy Hash: 0207e1c8ba9895d34605f527f1132f0ae60f947e87d2d8b5e7840e1a364c8902
Instruction Fuzzy Hash: 9D5146F2E042159FF714CA18DC95BEBB778EB91315F1042BAD90D67680D6785EC18E82

Function 026BFA44 Relevance: 1.7, APIs: 1, Instructions: 174fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 026BFFDF

Memory Dump Source

Source File: 00000000.00000002.2667740199.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26b0000_AdobePDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 0207e1c8ba9895d34605f527f1132f0ae60f947e87d2d8b5e7840e1a364c8902
Instruction ID: 05480b63f26e0b3ad0e5abfff4d5e7e3dfaec3bbbf183703f42cff870a7f8ad4
Opcode Fuzzy Hash: 0207e1c8ba9895d34605f527f1132f0ae60f947e87d2d8b5e7840e1a364c8902
Instruction Fuzzy Hash: CF5116F2E002159FE7288A14DC54BEBB779EB85321F1041BAE90A67680D7785EC18F42

Function 00547692 Relevance: 1.7, APIs: 1, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a0fe7db5d87114f430d5ea95307ef949ef19ab00eb2ee6e52caa221928509414
Instruction ID: 940b31fc76206a56ddd94d798b995246e57576849bc5daa2f673020583b054b1
Opcode Fuzzy Hash: a0fe7db5d87114f430d5ea95307ef949ef19ab00eb2ee6e52caa221928509414
Instruction Fuzzy Hash: 3D5126B2D186599EE7208A29DC887FEBB75FF94318F1440BAD50D66681E6781EC1CF01

Function 3BEB789F Relevance: 1.7, APIs: 1, Instructions: 152COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: c17c141243d89632c5bca43b2e2e20771c91457c21adc2697668b466b66bb401
Instruction ID: 62912dd39462c0eb0592d4c722d3d74cfd29cfceb8e9bae7a2abc2c540922965
Opcode Fuzzy Hash: c17c141243d89632c5bca43b2e2e20771c91457c21adc2697668b466b66bb401
Instruction Fuzzy Hash: 0F51BFF1C042599FEB14CB14CC91BEA7778EB44310F1881FADA0DA6741D678AFD68EA1

Function 00E526C6 Relevance: 1.7, APIs: 1, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee79c89831672dbc0103c262180335e773d94f0d27d10bbe31242cc516403a05
Instruction ID: 49c74f0d937cb81a41b09cf9411e61adc32cb5f4962cba370740f40063e6cf18
Opcode Fuzzy Hash: ee79c89831672dbc0103c262180335e773d94f0d27d10bbe31242cc516403a05
Instruction Fuzzy Hash: D35127B2D141249AF7248B28DC54AFBBBB5FF89301F1041FED90E63280E6785EC58B91

Function 3BEB648F Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 22943def984b4749cdea510464161d28ad266ab27ff147a3e70ae6b860567494
Instruction ID: 81c42a6eaa7349d4e4273811e4c21b728476dcedd32fbc5ea691ca2d79bb3630
Opcode Fuzzy Hash: 22943def984b4749cdea510464161d28ad266ab27ff147a3e70ae6b860567494
Instruction Fuzzy Hash: 4F5157F2C19264AFFB148B24DC95BE6BB78EB84314F0440FED94E56681DA3C5EC18E52

Function 00E497F9 Relevance: 1.6, APIs: 1, Instructions: 145COMMON

Download Yara Rule

APIs

VirtualProtectEx.KERNELBASE(?,?,00001000,00000040,?), ref: 00E49AA6

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 67f4bec60b06c6ed6250d2ffa7673ac6eafed5faca09221bfa6102c621714b21
Instruction ID: 64693bd82f8406bc344317feafff77e30c0e3ea332c5566f6cae4fc394a66874
Opcode Fuzzy Hash: 67f4bec60b06c6ed6250d2ffa7673ac6eafed5faca09221bfa6102c621714b21
Instruction Fuzzy Hash: 9E511A71E055648FD724CA18DC94BEBB7B5EF82301F1490EED54A76242D6346EC4CF91

Function 3BEB7763 Relevance: 1.6, APIs: 1, Instructions: 139COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: de270df7bd2d4b369acf6de477585933080516950fd91f9b6f0367c404a6f921
Instruction ID: 83ad544c01c27f8cfe4200b0cdc6e56ac23a56ea7553564a0ad4ad93aee20ad7
Opcode Fuzzy Hash: de270df7bd2d4b369acf6de477585933080516950fd91f9b6f0367c404a6f921
Instruction Fuzzy Hash: 7F51C5F1C052659FEB20CB18DC91AEA7B68EB44314F0481FAD84DA6741DA385EC5CF92

Function 3BEB762F Relevance: 1.6, APIs: 1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79ddfe5d1ae99cb9a9be34841f77cf07603370bf85bf465d4c0631434ca4da30
Instruction ID: 66199694955fc5adace489389d98ca16f4cec4cadf2fefb3cdc979795f692fb2
Opcode Fuzzy Hash: 79ddfe5d1ae99cb9a9be34841f77cf07603370bf85bf465d4c0631434ca4da30
Instruction Fuzzy Hash: 714129F2C092685FEB20CB58DC91BDB7B74DF41314F0541BAD98C66641E6385EC68A92

Function 3BEC562A Relevance: 1.6, APIs: 1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: c3c8ab112b453ecbf5ea80bbcc2006df0fe61ad9ea1939e6f0a169d5a99f2cce
Instruction ID: 2d03abd3aa1ec70b007c8f7e73f93ef6d05e13f67ff571165800b6adabf6a3aa
Opcode Fuzzy Hash: c3c8ab112b453ecbf5ea80bbcc2006df0fe61ad9ea1939e6f0a169d5a99f2cce
Instruction Fuzzy Hash: F4410BF2D143159FF3208914DD89BEB76B9E781724F1482FADD0C56280DA794EC1CA92

Function 3BEC55A7 Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 0260ac7a12b8da3f03b3ea55001efad2f778feba14eb989b932dcc9031ed6b0f
Instruction ID: fd9152a6ede2524db62f13a4461569fec892c2ef504545165d339c1b13ec05a9
Opcode Fuzzy Hash: 0260ac7a12b8da3f03b3ea55001efad2f778feba14eb989b932dcc9031ed6b0f
Instruction Fuzzy Hash: F7412DF3D143159FF3248A19DD89BEB76B9EB80714F0441BADD0D56280E67D4EC1CA92

Function 3BEB72A2 Relevance: 1.6, APIs: 1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49cf5d8e988ad70f2551776466fedb5aaa04893754d50f5256e89e92a64829e0
Instruction ID: fc0e32942d9df353ba019ae86e3c35e05334623341c2790343ac74bd99cb8b06
Opcode Fuzzy Hash: 49cf5d8e988ad70f2551776466fedb5aaa04893754d50f5256e89e92a64829e0
Instruction Fuzzy Hash: A74119F2C093685FFB20CB58DC84ADB7B78DB42704F0541BAD98C66B41D5384EC6CA92

Function 00541112 Relevance: 1.6, APIs: 1, Instructions: 128COMMON

Download Yara Rule

APIs

K32GetPerformanceInfo.KERNEL32(?,00000038), ref: 00541FDB

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: InfoPerformance
String ID:
API String ID: 3070290716-0
Opcode ID: eab8fc66906546019ae276725d91048389f8147c6f1130660f6595b0227e8ea9
Instruction ID: 779d507799ec980ca8df1e6e6593a8c48cba0da00ee3335ee99d3b7f2f7dd561
Opcode Fuzzy Hash: eab8fc66906546019ae276725d91048389f8147c6f1130660f6595b0227e8ea9
Instruction Fuzzy Hash: DC51AE71A046288BDB28CF28CD88BEABB75FB85304F1081EAD50E66644C634AEC1CF45

Function 3BEB759C Relevance: 1.6, APIs: 1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8f8330ff5f79ff84ff696969fa5b217d43685b9c9ccd7b2dd62515f2e38bf2e
Instruction ID: 9462e69b4cfe799c1f484d5aee9045b571d4fd55884090f60cb9281716a5d8ee
Opcode Fuzzy Hash: c8f8330ff5f79ff84ff696969fa5b217d43685b9c9ccd7b2dd62515f2e38bf2e
Instruction Fuzzy Hash: 4C41E7F1C093689FEB20CB58DC50AEA7B749F45715F0541FAD88C66741DA388EC5CB92

Function 3BEBEF1D Relevance: 1.6, APIs: 1, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 3BEBFFDF

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ed6f68940b5903b9a17427009fd8e135ecbdf3ca8486a0b2450f2564fbc617c9
Instruction ID: 1d2e3f7d3c0046845e6d2d96e0649de3158b4ac47dbe0b90b86cfa893ba123ca
Opcode Fuzzy Hash: ed6f68940b5903b9a17427009fd8e135ecbdf3ca8486a0b2450f2564fbc617c9
Instruction Fuzzy Hash: C14180F2D053155BF7288628DCC9FEB7728E740729F0442BAE90DA51C0DA7D4BD18E92

Function 3BEC5643 Relevance: 1.6, APIs: 1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 166d84b7039606cce79c7a785697705e7764e9df5fc9b977d17da093553ccfad
Instruction ID: 8cf818b2ba2a80b6e853cdf9e171dd1e48ccd07db704b95c9909f07e0bbafb65
Opcode Fuzzy Hash: 166d84b7039606cce79c7a785697705e7764e9df5fc9b977d17da093553ccfad
Instruction Fuzzy Hash: 9D410AF2D143159BF3208A18DD89BEB76B9EB81714F1482FAD90C56280DB7D4EC1CA92

Function 00E498B3 Relevance: 1.6, APIs: 1, Instructions: 122COMMON

Download Yara Rule

APIs

VirtualProtectEx.KERNELBASE(?,?,00001000,00000040,?), ref: 00E49AA6

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 0a1ef45a37b0ae3ec12c27a84a993e95d202f66eacf545d0da283d9f6d85b83f
Instruction ID: 6b7e4d766e9278bbb8349cce919cd7bc597bfad58c5fd7d1913391d68fc32fd5
Opcode Fuzzy Hash: 0a1ef45a37b0ae3ec12c27a84a993e95d202f66eacf545d0da283d9f6d85b83f
Instruction Fuzzy Hash: 2E414971D055648FEB24CA14EC94BEBBB71AF82305F1850EED94E76242D6346E84CF91

Function 0054754B Relevance: 1.6, APIs: 1, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00548D68

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: e93e8602b9d09eaa24bc998d90b8564e186b2126cf0e9b0d75df7acd9a3c97a4
Instruction ID: ce935d3db3fd4be4e30b39b29a5cf97aac9d054caf5ccae7a2358adf1bf47d19
Opcode Fuzzy Hash: e93e8602b9d09eaa24bc998d90b8564e186b2126cf0e9b0d75df7acd9a3c97a4
Instruction Fuzzy Hash: 8F4168B3E056989FF7208615DCC4BEB7B69FBD1318F2940BAD88D16180D63C4EC18B91

Function 3BEB66B8 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 46cf632d203e8cd23bf5353f2c7e549a20bad2b8bcf745159d0d7278d5142f2b
Instruction ID: 628b955bc9c09cbf67bee9d1d00ca3f893cf45c8c9874cea25f3e6a9c2442861
Opcode Fuzzy Hash: 46cf632d203e8cd23bf5353f2c7e549a20bad2b8bcf745159d0d7278d5142f2b
Instruction Fuzzy Hash: E241E5A5D1D3A89EEF24CB28DC447EABB74EF85714F1081EAD44D96255DA380EC1CF12

Function 3BEB72D7 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: dd41ca2f4b0c7fb0e83873a318c7f655133dce68a4cbe7d849ed1deaffeabdd9
Instruction ID: f24f9b06d42ef5c2745f61ca54362b67d282eda5066b4e66a7a3575761999938
Opcode Fuzzy Hash: dd41ca2f4b0c7fb0e83873a318c7f655133dce68a4cbe7d849ed1deaffeabdd9
Instruction Fuzzy Hash: 66411AF2C093A45FEB20CB58DC84ADB7B789F46704F0541FAD98C66B41D5384EC6CAA2

Function 00541BC3 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: InfoPerformance
String ID:
API String ID: 3070290716-0
Opcode ID: 01532963112f6c93a6a1e5fdb1873c5799f3ea1270b26c7ceb75a75b5b850c11
Instruction ID: 021ec91b8e707c063ea25e8237fa53170177e776866b31daf990ec7e9014642e
Opcode Fuzzy Hash: 01532963112f6c93a6a1e5fdb1873c5799f3ea1270b26c7ceb75a75b5b850c11
Instruction Fuzzy Hash: 76514A72E015288BDB24CB28CD98BE9BBB5FB94305F1082E9D80DA7645C634AFC5CF45

Function 00E494F9 Relevance: 1.6, APIs: 1, Instructions: 112COMMON

Download Yara Rule

APIs

VirtualProtectEx.KERNELBASE(?,?,00001000,00000040,?), ref: 00E49AA6

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ae518b18211c5d548e74141f0833fc21c56a992079c3ffc4309b7f20cf9c9a14
Instruction ID: f3088863c37365d4cd686e85f0e4f135ca4f3f8aed59db569f8c5bce6ef9ac4e
Opcode Fuzzy Hash: ae518b18211c5d548e74141f0833fc21c56a992079c3ffc4309b7f20cf9c9a14
Instruction Fuzzy Hash: 2D410BF1D082149FEB248B64EC85ADBB7B4EB44310F2051FAE94D77241E6356EC5CE62

Function 3BEB7D96 Relevance: 1.6, APIs: 1, Instructions: 111COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,3BEB7703,3BEB73C3,?,?,?,?,?,?,?,?), ref: 3BEB7E45

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 48de234e33b9d92d7dafd543fd4b5963a1eb4849d3d4b5e927810c831e4933f3
Instruction ID: 0bf13ae9a81ad42e486b522962ae177a4aa41465814a5931697483dd793451b8
Opcode Fuzzy Hash: 48de234e33b9d92d7dafd543fd4b5963a1eb4849d3d4b5e927810c831e4933f3
Instruction Fuzzy Hash: 534168B19046198FEB24CF28DC80AAAB776FF84711F1041EBD80DA6740EA399ED5CF51

Function 3BEB72EE Relevance: 1.6, APIs: 1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 48994c0321cd5804a90462c7d819d8a8dc31c4c24744caf832e09ce566417afd
Instruction ID: b1a11e00796aa8f729d74cefcb59c4c169c40efca77e81e46bb064207e34ff2a
Opcode Fuzzy Hash: 48994c0321cd5804a90462c7d819d8a8dc31c4c24744caf832e09ce566417afd
Instruction Fuzzy Hash: 093126F2C093A45FEB20CB58DC80ADB7B749F42314F0541FAD98CA6A41D9348EC5CAA2

Function 3BEBB229 Relevance: 1.6, APIs: 1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: dee5b51a8d31946304e9e6745785cb10370e8c9180f4a4ea5b6ce47603d406e4
Instruction ID: 4e443b1a832d95d2ca286e224f7f4cc7152d02e383eaebfcb5c74ae20ba2895c
Opcode Fuzzy Hash: dee5b51a8d31946304e9e6745785cb10370e8c9180f4a4ea5b6ce47603d406e4
Instruction Fuzzy Hash: 9E3105F3D143159FF3208A18DD89BEB7AB9EB81314F0542FADD0C56680D67D5EC18A92

Function 3BEB75F0 Relevance: 1.6, APIs: 1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 7efe0de4004fca09eb8b8350133f6cdb31ad9e63baeda4bf5f5d8b84aeed2d14
Instruction ID: 49b29cc097f0ed53c9eea5ac5c545b2238839a675e43e5feb53191fea4991298
Opcode Fuzzy Hash: 7efe0de4004fca09eb8b8350133f6cdb31ad9e63baeda4bf5f5d8b84aeed2d14
Instruction Fuzzy Hash: 7C41E7F2C093649FEB20DB58DC506DA7B749F46704F0541FAD98C66B41D9344EC6CB92

Function 026BB229 Relevance: 1.6, APIs: 1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2667740199.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26b0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: dee5b51a8d31946304e9e6745785cb10370e8c9180f4a4ea5b6ce47603d406e4
Instruction ID: 92c7f2a3748105167d192c20aa9dccf6902b5fbfa5561e19004d09eda9669e6e
Opcode Fuzzy Hash: dee5b51a8d31946304e9e6745785cb10370e8c9180f4a4ea5b6ce47603d406e4
Instruction Fuzzy Hash: 603122F3D142159FF3249914DC88BFB7A79EB81310F1541BADD0E66280D67D6EC1CA92

Function 026B72EE Relevance: 1.6, APIs: 1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2667740199.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26b0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 48994c0321cd5804a90462c7d819d8a8dc31c4c24744caf832e09ce566417afd
Instruction ID: 377a94a429ab9d5f9af7c1abaee3fcce89457b840c1e393be05cea22348ecbd2
Opcode Fuzzy Hash: 48994c0321cd5804a90462c7d819d8a8dc31c4c24744caf832e09ce566417afd
Instruction Fuzzy Hash: 02312EF2C052A45FE7229B54DC40AEBBB74DF91310F1540FADD8D66641D5344EC6CB92

Function 3BEC5376 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 9c717ff99189620bb0d91669373df7311c01e3f2672d85510bc23e749a0a9f0a
Instruction ID: 1ac93003d1c117a798e1d97112092fb8827d9f07e7d96211aa3ec562693ffa01
Opcode Fuzzy Hash: 9c717ff99189620bb0d91669373df7311c01e3f2672d85510bc23e749a0a9f0a
Instruction Fuzzy Hash: 1A3106F3D542149BF3208918DD89FEB7AB9EBD1314F0541BAED0C56280E67D5EC18A92

Function 3BEC541A Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 91b7f0cfd6e6778632c4a0493640f2beb1c912ab51a16ca792ee3e91e636a1a5
Instruction ID: 12a4448b2adb9bd5fa151779e0b9f4c7276f64dfeceea8f3ab6687fc689f669f
Opcode Fuzzy Hash: 91b7f0cfd6e6778632c4a0493640f2beb1c912ab51a16ca792ee3e91e636a1a5
Instruction Fuzzy Hash: 513136F3D042149FF3208A18DD89BEB7BB9EB81314F0441FADD0D56280DA7D5EC28A92

Function 3BEC568A Relevance: 1.6, APIs: 1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: b33ad60a93b8723726970dab594f64571a80319b5be96778bb49e798b31c4eae
Instruction ID: 6044ab0b1a33da419adfdaa1d12b104dd3fef7acea3c292eaaaade03460a1b97
Opcode Fuzzy Hash: b33ad60a93b8723726970dab594f64571a80319b5be96778bb49e798b31c4eae
Instruction Fuzzy Hash: F53144F3D442159FF3108A18DC89BEB7BB8EB81314F0442FADD0C56280D6794EC18A92

Function 3BEC5414 Relevance: 1.6, APIs: 1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7cbf9ed9b0556598971011baa83853088ff4d02bf17136a49f052051870be3ee
Instruction ID: fdd9ca55525bc0b7ff196258a57a98a3d17a3810111d1de3cb325f9efe01eda7
Opcode Fuzzy Hash: 7cbf9ed9b0556598971011baa83853088ff4d02bf17136a49f052051870be3ee
Instruction Fuzzy Hash: 533106F3D043149FF3108918DD89BEB76B9EB81714F0441BADD0D56280EA795EC18A92

Function 3BEB6701 Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 43c0c8d59aa039e76fae9f4bbede326c151c74e910c835137f34a6c3b022f26b
Instruction ID: d5bc930a4a57f7fd6a98c9a487f6c820eb6248e78b767ab6947dc250f1b1e089
Opcode Fuzzy Hash: 43c0c8d59aa039e76fae9f4bbede326c151c74e910c835137f34a6c3b022f26b
Instruction Fuzzy Hash: 9C31F3A1D1D3A89EFF20CB68DC447EABB74EB84710F1081EAD44D56195EA380AC5CF12

Function 005413D8 Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

K32GetPerformanceInfo.KERNEL32(?,00000038), ref: 00541FDB

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: InfoPerformance
String ID:
API String ID: 3070290716-0
Opcode ID: e57f17bca775a4cba941344dff07329e8cebe9a660e70891345fe5ee7f9a3899
Instruction ID: 77bb47a0b3041d37c323ba8a946fb85113c76ba581f8ad9308884aee96c87735
Opcode Fuzzy Hash: e57f17bca775a4cba941344dff07329e8cebe9a660e70891345fe5ee7f9a3899
Instruction Fuzzy Hash: 3B414E71D046288BDB24CF28CD98BEABB79FB54344F1081EAD40E66684D6346FC5CF56

Function 00548C09 Relevance: 1.6, APIs: 1, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00548D68

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 7a055f59dd572563da4cfee343eec35629aa6c6565f17d40d66f0e251b5aed5d
Instruction ID: b22fa4607739fbffc3bc056fce19bcda5330741559967292fb40e7f8dd78db90
Opcode Fuzzy Hash: 7a055f59dd572563da4cfee343eec35629aa6c6565f17d40d66f0e251b5aed5d
Instruction Fuzzy Hash: 0A3176B1D052549EFB108A20CCD97FF7AB9FBC1305F2881FAD60A5A584DE384EC28A11

Function 3BEC4570 Relevance: 1.6, APIs: 1, Instructions: 98fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 3BEC5DA9

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 792918b68ad0570aed088b55ae9a05dcb16dc928289881c4a1fd5555ea45542d
Instruction ID: d6b2c699900a76b3e23f08b8e3a130ee686fac8c4cb10f99ea0cd312c41d7555
Opcode Fuzzy Hash: 792918b68ad0570aed088b55ae9a05dcb16dc928289881c4a1fd5555ea45542d
Instruction Fuzzy Hash: 0431F6F2C002149BF3148519DC45BEB7678EB84715F0481BAE90D56684EA7D5ED18A92

Function 00E38911 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 3764279dd8291681b3d11e6df7c7f8fa81a0cf55e4e8202c4b827c8a82d0d410
Instruction ID: 4d13cd0c503332a7198ce7fd5e80ba8e6b3e3faa7f8a59c81d4a9e8cb065350d
Opcode Fuzzy Hash: 3764279dd8291681b3d11e6df7c7f8fa81a0cf55e4e8202c4b827c8a82d0d410
Instruction Fuzzy Hash: 7D316CB1C083959FEB215774AC946E7BBB4EF01314F2520AAD589B3143D3356D85CB63

Function 00541E9B Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: InfoPerformance
String ID:
API String ID: 3070290716-0
Opcode ID: 8e9242e715e0327d3a372392b7648ff72f67b6afd57d499904267497e88c3b3c
Instruction ID: 83a19b0e2393c7889e0687035f498ac3aec3b9b2254b6605b5b8db3569ca6f81
Opcode Fuzzy Hash: 8e9242e715e0327d3a372392b7648ff72f67b6afd57d499904267497e88c3b3c
Instruction Fuzzy Hash: 0C418B71915A588FCB29CB24CD947EABFB9FB80345F1081EED80DAA245D7346AC6CF04

Function 005477E9 Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 3d5cd673fe1ac5b16fc193afb21d8813b415ec79c06e9627c6725af9fe42573a
Instruction ID: 2b59b97096271c9cb8a716df5703201786a864b496eb3c14ba975d341e4dffbd
Opcode Fuzzy Hash: 3d5cd673fe1ac5b16fc193afb21d8813b415ec79c06e9627c6725af9fe42573a
Instruction Fuzzy Hash: DC3108B2D0921DDEFB248A65DC887FFBA74FB94318F1440BBD50A66680E7780EC0DA11

Function 3BEB76DF Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 23c7471dde136f9756eb8fcf5e87ffcf6a2163e7c5bc3c4fe6d2e3ae23ac423e
Instruction ID: c964936d330becc2cc69c383c6a200382053f97a98b68dcb21edc71f9855ba82
Opcode Fuzzy Hash: 23c7471dde136f9756eb8fcf5e87ffcf6a2163e7c5bc3c4fe6d2e3ae23ac423e
Instruction Fuzzy Hash: 0831E7F1C093A85FEB20DB58DC80ADA7B749F45704F0581FAD98C66745DA344EC6CB92

Function 3BEBEEA8 Relevance: 1.6, APIs: 1, Instructions: 87fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 3BEBFFDF

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 16cc02e03bacd042b0960f71c8c26008a750402e3b2476e7af989659fe7f606e
Instruction ID: 66c63dad571616e44e6f6618c24cfd4c0a533a25f1b3aad921fc30725a8aff02
Opcode Fuzzy Hash: 16cc02e03bacd042b0960f71c8c26008a750402e3b2476e7af989659fe7f606e
Instruction Fuzzy Hash: B8210CB2D443246AF7288614DC95BE77768E744728F1442BAE50E251C0EE7D5BD18D82

Function 3BEBF3C3 Relevance: 1.6, APIs: 1, Instructions: 84fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 3BEBFFDF

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 88a8fdf1158f9b6ef6308e2631de6be0c7a09fbfb5a741af9c738e36ac2f5a93
Instruction ID: 5799e9d9f1cd245e6ade3160626568e5cfabe39d6cbb27b1c86e2b9a9ed2b826
Opcode Fuzzy Hash: 88a8fdf1158f9b6ef6308e2631de6be0c7a09fbfb5a741af9c738e36ac2f5a93
Instruction Fuzzy Hash: E2213BB2D04324ABF7288614DC95BEBB768E744724F1442FEF50E661C0EE781BD18E82

Function 00541B1B Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

K32GetPerformanceInfo.KERNEL32(?,00000038), ref: 00541FDB

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: InfoPerformance
String ID:
API String ID: 3070290716-0
Opcode ID: 3295b77c102e5479a205250b9385847f25fa995a10d7d466d9be68d33d5e37ee
Instruction ID: 50dfcfc905e5a78e2708e0088d2543a85495eef5ef2a4e8618c250b7029086d5
Opcode Fuzzy Hash: 3295b77c102e5479a205250b9385847f25fa995a10d7d466d9be68d33d5e37ee
Instruction Fuzzy Hash: 00318DB2D116248BE728CB14CD95BEABBB9FB90301F14C1EAD40D6A684D634AFC5CF41

Function 00540F37 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

K32GetPerformanceInfo.KERNEL32(?,00000038), ref: 00541FDB

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: InfoPerformance
String ID:
API String ID: 3070290716-0
Opcode ID: 419ba04ed0065d64b02fbc22af5ffb7f69c5872622f70732a00a2d4c97e46059
Instruction ID: 43ba64220a5e7d4a74e24de11ba85edbd874d1409af0dcccf03266fb27887a63
Opcode Fuzzy Hash: 419ba04ed0065d64b02fbc22af5ffb7f69c5872622f70732a00a2d4c97e46059
Instruction Fuzzy Hash: 3E315E729057188BDB28CF28CD94BE9FB79FB54345F1081EA980EA6644D634AFC4CF46

Function 00540FF5 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

K32GetPerformanceInfo.KERNEL32(?,00000038), ref: 00541FDB

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: InfoPerformance
String ID:
API String ID: 3070290716-0
Opcode ID: 293e5aac52db295fbc69209f7d8fbe0757cb4bc1509d3be12168b1c1035ebe18
Instruction ID: 547859ae92dd60aa9260141a7204dd7f75237448dce3ff50264829e9f5bed53d
Opcode Fuzzy Hash: 293e5aac52db295fbc69209f7d8fbe0757cb4bc1509d3be12168b1c1035ebe18
Instruction Fuzzy Hash: 1D314F71D046288BDB24CE28CD84BE9BBB9FB54345F1081EA980DA6644D634AFC4CF55

Function 00541EF9 Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: InfoPerformance
String ID:
API String ID: 3070290716-0
Opcode ID: 828a1af6cd9bd161917df4452a965fc8fc13873e74504190283ac943f38f3123
Instruction ID: c6165e997f2481f49cd0cf3cc1a041d5428464cb2b6b904b44da257cae0a8208
Opcode Fuzzy Hash: 828a1af6cd9bd161917df4452a965fc8fc13873e74504190283ac943f38f3123
Instruction Fuzzy Hash: 3C318D71D05A688BDB29CF24CD987E9BFB5BB54305F1082DED40EAA285D7306AC6CF04

Function 3BEB67DC Relevance: 1.6, APIs: 1, Instructions: 79COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 014142690a51cfb8258c38911791845c451d488647bb2735937fc00838c0971c
Instruction ID: 63daa760c185d39baaabfa75d264170bcc8a642af7c9c10cacc09b6f23bb2032
Opcode Fuzzy Hash: 014142690a51cfb8258c38911791845c451d488647bb2735937fc00838c0971c
Instruction Fuzzy Hash: 4621F3B1D0A3599EFF248B68DC44BAABB74EB85720F1081FAD44D55586E9380BC68F12

Function 3BEBFECC Relevance: 1.6, APIs: 1, Instructions: 77fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 3BEBFFDF

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b0a4904acb5ebe495f3b9491dee742ed392bd6b4dd9fbffc607a4328077eb79d
Instruction ID: 7619c1b474359aa83b3ec4cf96f8cc3a51d9f8568498716bf088963790abe91a
Opcode Fuzzy Hash: b0a4904acb5ebe495f3b9491dee742ed392bd6b4dd9fbffc607a4328077eb79d
Instruction Fuzzy Hash: 6F216AB1D4431A9EFB30C654ECD5BEBB7A4E701715F1083F9E959251C0CA780EC28E81

Function 3BEB6586 Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 9a0c4664ee44f037e7e1ec4fb55dc2abc9cceb5c19d8b236ffe2716a0e969c31
Instruction ID: 17b578e1904ea0276565ccba53c521231ef024a0dd56c4d0c3b2c35ebe087897
Opcode Fuzzy Hash: 9a0c4664ee44f037e7e1ec4fb55dc2abc9cceb5c19d8b236ffe2716a0e969c31
Instruction Fuzzy Hash: 8C2144B1C0D3949FEF148B64DC587A5BB78EB05314F1144DFC58E96182DA380AC1CF42

Function 3BEB770C Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 772e49b6f2a94eac37bbc9b07aa8315b4ac42801ac8b29a76241099e30e1d045
Instruction ID: aa10538b34c1c661492b83023c86958130e2b4def69998c03fed844d5a1250e3
Opcode Fuzzy Hash: 772e49b6f2a94eac37bbc9b07aa8315b4ac42801ac8b29a76241099e30e1d045
Instruction Fuzzy Hash: 6E21E5F1C093B89FEB20DB58CC806DA7B749F85704F1581FAD88C66655DA344EC6CB92

Function 00E5263B Relevance: 1.6, APIs: 1, Instructions: 74threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 00E53D9D

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 71fcaa7b283a5adc705c79b6f884d09556cbc1bfa489417a0facee1f136eeecc
Instruction ID: f3d8407f980df4e3493b235fc6eb23e18e6d48fd61f52b91a17c5d95cd401324
Opcode Fuzzy Hash: 71fcaa7b283a5adc705c79b6f884d09556cbc1bfa489417a0facee1f136eeecc
Instruction Fuzzy Hash: A42125B2D051188EF7148A14DC84BE6B378EB85315F108AFEDD0976282D6785EC58F61

Function 3BEBF413 Relevance: 1.6, APIs: 1, Instructions: 72fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 3BEBFFDF

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 82c49bd3fcc2810f4499da027e02ddd2662c198e14416363311eff8696f22350
Instruction ID: 7d410e55ee81d2dcde368965270c23ff680fe3d7f6fe5128c1bb3cb82eb5e22c
Opcode Fuzzy Hash: 82c49bd3fcc2810f4499da027e02ddd2662c198e14416363311eff8696f22350
Instruction Fuzzy Hash: 47215CB2D043246BF7288614DC5AFEB7768E704728F0443BEF50E661C0EE780AD18E92

Function 00541F40 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: InfoPerformance
String ID:
API String ID: 3070290716-0
Opcode ID: bc575ed9843f92030097b587413c541b4c0acbefa72511a3fc88b7fe0ad37e9b
Instruction ID: 27083a1483f11fcb8210d3c26ac0a5184a0db1e5b29f0fbb95e92adc443113bd
Opcode Fuzzy Hash: bc575ed9843f92030097b587413c541b4c0acbefa72511a3fc88b7fe0ad37e9b
Instruction Fuzzy Hash: E8316B719146288BDB68CF24CD987E9BFB4FB50304F1082EE940EAA284D734ABC58F45

Function 00E525B8 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 646f72b3c14c139bcc8eeeccbe21822e70c07dc77489fde3d3794c06ac9c9fd0
Instruction ID: 0f201894206e538d0744a8e27434666e36da019d5f226a18612aa11fcf8fa418
Opcode Fuzzy Hash: 646f72b3c14c139bcc8eeeccbe21822e70c07dc77489fde3d3794c06ac9c9fd0
Instruction Fuzzy Hash: 622104F2D451248BF720CA20DC54BE7B774EB82315F1044EEDD0D76281E2785D858EA2

Function 3BEBFEE8 Relevance: 1.6, APIs: 1, Instructions: 70fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 3BEBFFDF

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5bab3415f7013527199010557ae4539b1f906dab9df2abb5fa46f05cb91d432c
Instruction ID: 016bce4ac4fa578a14deae7f3247ac99d7b664ac161ce9ec6da83ab3a9ce2669
Opcode Fuzzy Hash: 5bab3415f7013527199010557ae4539b1f906dab9df2abb5fa46f05cb91d432c
Instruction Fuzzy Hash: BF2138B0D4531A9EF730CA54DCD5BEBB7A4E701719F1082F5E959651C0DA790AC28F81

Function 3BEB7BE1 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: ce4c98e8994502494c2a81f2a59aaf112a9c61754689ede13511e47f3d563c5e
Instruction ID: bc99a44f3740a9f96e91fbce6dd14f16b1df0214ba0401339380792135616efa
Opcode Fuzzy Hash: ce4c98e8994502494c2a81f2a59aaf112a9c61754689ede13511e47f3d563c5e
Instruction Fuzzy Hash: 4821D6B0C087989FEB21CB54CDC07D97BB4EB45314F1491DAC84D66646EA384FC58F42

Function 3BEB771B Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 082da9981b512a71b572943eea41a15821c00543735791e0b7aa44e5cd38dafc
Instruction ID: 8594fb22ee07907451a5a8957f0716c98cf5beb5617c5139774aeac87726a3b1
Opcode Fuzzy Hash: 082da9981b512a71b572943eea41a15821c00543735791e0b7aa44e5cd38dafc
Instruction Fuzzy Hash: 9621B2F1C092B89FEB20DB58CC806DABB749F45301F1581FA998C66655DA344EC6CB91

Function 026C9A2A Relevance: 1.6, APIs: 1, Instructions: 68fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,39335C83,?,00000000), ref: 026C9B9F

Memory Dump Source

Source File: 00000000.00000002.2667740199.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26b0000_AdobePDF.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 2a6a7494fdd83de1cbd5889b41e201824d9884a75cb925b72206d9d0e9a1a81e
Instruction ID: cb9f00544958e0885464396f20c87b7068f928c478f79da0c5bb0babe7bc2625
Opcode Fuzzy Hash: 2a6a7494fdd83de1cbd5889b41e201824d9884a75cb925b72206d9d0e9a1a81e
Instruction Fuzzy Hash: C02146B2D42A589FFB248E14DD94FFAB7BADB80305F0441FED80E56284D6394EC18E40

Function 3BEBFF36 Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 3BEBFFDF

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 412b3a0c89312e6c4c8baab647f4918726c6888756c5ed7a4d3b7522a80c9b38
Instruction ID: 8672c55fd8ad3f933a805138efb0800cd04cb1f396b8150669c0f7e1f3981843
Opcode Fuzzy Hash: 412b3a0c89312e6c4c8baab647f4918726c6888756c5ed7a4d3b7522a80c9b38
Instruction Fuzzy Hash: AB115EF1D44319AEF7244A14EDD5BE77768E700714F1042BDE909251C0DABD1ED14E81

Function 3BEB7C02 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 0537f6831ef87b25b34bd2163f3d0d3b27189272a3781a38149688f3a105cca3
Instruction ID: dd63dd764533bcf79234e4b118d1b0ae8167590224fbc425c398a3123947cdd0
Opcode Fuzzy Hash: 0537f6831ef87b25b34bd2163f3d0d3b27189272a3781a38149688f3a105cca3
Instruction Fuzzy Hash: B421C2B0C097989FEB20CB54CD807E97BB4EB45305F1481EAD58965642DA384FC28F42

Function 3BEB77FA Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 2cb3affc2ff4254fecea336572ba4f095d382ef30dcc22da5fe8a5b8d7b92f09
Instruction ID: eb9dc73c3a5552127d9d16d3ddf9f4e05f60624c7dfc9ea487e32d43997fda5b
Opcode Fuzzy Hash: 2cb3affc2ff4254fecea336572ba4f095d382ef30dcc22da5fe8a5b8d7b92f09
Instruction Fuzzy Hash: 1021C9F1C057945FEB11CB24CC41AEA7B78EF45310F0441EAD58D56682D6344EC5CF51

Function 3BEB7738 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 8a3a25a25885ee490f4b3787fbbd16445d61efeef63b0ebf5783f7b653b1c234
Instruction ID: 1e1295b674e33d716efe1ae6599dbfb0135586b9696c21dfdf9dd81b5cb58396
Opcode Fuzzy Hash: 8a3a25a25885ee490f4b3787fbbd16445d61efeef63b0ebf5783f7b653b1c234
Instruction Fuzzy Hash: 6721F6F1C093A89FEB21DB64CC806DA7B74AF45300F1481EAC8CC66656DA344EC6CF51

Function 3BEB7BA9 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 8a83182f55129e42b541a3deee6ec87b93bd2de8058faa5c4ed02755bc0c932a
Instruction ID: 93075da0e0ad5c2b4f381b599c24afb53b09dd2f5f92a14db2cb8957dce3d34a
Opcode Fuzzy Hash: 8a83182f55129e42b541a3deee6ec87b93bd2de8058faa5c4ed02755bc0c932a
Instruction Fuzzy Hash: 6E11AFB0C087A8AFEB20CB18CD907E97BB4EB45305F1440DAD58D66646DA381FC58F02

Function 3BEC57EE Relevance: 1.6, APIs: 1, Instructions: 57fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 3BEC5DA9

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: ce05f57343fb6fb35f3750cd280c89d54947cfdcff4758994c5e5af25b243584
Instruction ID: f8a7b83cc0ea431c3e10b0eddc4c800227f91a71156d08bbedfd86c566c932e9
Opcode Fuzzy Hash: ce05f57343fb6fb35f3750cd280c89d54947cfdcff4758994c5e5af25b243584
Instruction Fuzzy Hash: 591108F2D002199FF714CA08DD89BDBB7B8EB84714F0042F9E90D96240EB355ED08E51

Function 3BEC48F8 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: bfc02db74607a2fad374082bc440882a44fdb18fa3eb009e915cf8e2cbe528fa
Instruction ID: 2a785aeea6b1f142ee41b4fdabbad3fbddee8ad24880823b57442e00eb11deba
Opcode Fuzzy Hash: bfc02db74607a2fad374082bc440882a44fdb18fa3eb009e915cf8e2cbe528fa
Instruction Fuzzy Hash: 9C01D6B2C403195BF7208A08CD49BEBB778EB80710F1082FED50E96140DE745ED58A92

Function 3BEC594E Relevance: 1.5, APIs: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 3BEC5DA9

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 2f0a7b190406e02f7951fdd5666d76d5f632156ab35112b740cbb095b10ba99e
Instruction ID: f2e5b7c45f143c9ab89107150fe6d14b1172c381313c2434df9fc8d9d621f16c
Opcode Fuzzy Hash: 2f0a7b190406e02f7951fdd5666d76d5f632156ab35112b740cbb095b10ba99e
Instruction Fuzzy Hash: 900180B1E002159FF724CA09DD44BEFB7B6EBC8705F0081E9E90C57644DA715AD1CE51

Function 00548CDD Relevance: 1.5, APIs: 1, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00548D68

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 7da9b34da933eb82b3e3d2cccf9ac03f4d69967fdff39dd7e497b7ac494cc5fe
Instruction ID: 04c98986fda7daa310abb878132b9646612bd4ce5c2002ac6166bbaac81e114a
Opcode Fuzzy Hash: 7da9b34da933eb82b3e3d2cccf9ac03f4d69967fdff39dd7e497b7ac494cc5fe
Instruction Fuzzy Hash: 9F0128B1D011599EFB60CA15DC88BFE7AB5FBD4308F1480FAD20D66684EE380EC19B11

Function 3BEBFB36 Relevance: 1.5, APIs: 1, Instructions: 46fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 3BEBFFDF

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 7687c3d5f5e5f32277f93cc1f520861e2e3a8ece9d3ce571f9534e378ed6e36b
Instruction ID: 8d06c94dcaaa7bbaff95de04bc0b6d066eb8e4bce2a566c6cf49c1f15dd6599a
Opcode Fuzzy Hash: 7687c3d5f5e5f32277f93cc1f520861e2e3a8ece9d3ce571f9534e378ed6e36b
Instruction Fuzzy Hash: 5F01C0F1D443019FF3248B10DC67FABB728D700B11F1043EDE605652C0DAB80A814F42

Function 005476A3 Relevance: 1.5, APIs: 1, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00548D68

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 3c1b38a25fdc8e2de1be5dce28c0abe0ca5413b6d9da61b2bb6b2dbed020f691
Instruction ID: 372667cc695d65750b9dd8f34a6b2d2ab6715c61892c39b6218722c5dda80af6
Opcode Fuzzy Hash: 3c1b38a25fdc8e2de1be5dce28c0abe0ca5413b6d9da61b2bb6b2dbed020f691
Instruction Fuzzy Hash: 81012BF6D55748AEFB108965DCDD7FF7A68F714308F1400BBD90A251C0AA780FC44A52

Function 3BEB65DB Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 0972d7d4e73790d41f25cf166dfa08cbf310786babae99a9382d6aa5c459bdeb
Instruction ID: e8e94615b8faf7a0027092f394428cb5c2ee721c2e43719e6875515a79785d55
Opcode Fuzzy Hash: 0972d7d4e73790d41f25cf166dfa08cbf310786babae99a9382d6aa5c459bdeb
Instruction Fuzzy Hash: 7301DEB0C0D3999EEF61CB58DC917A8BB78AB05704F1040EB848E95182DE784BC5CF02

Function 00540C7C Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

K32GetPerformanceInfo.KERNEL32(?,00000038), ref: 00541FDB

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: InfoPerformance
String ID:
API String ID: 3070290716-0
Opcode ID: 150e0bff3f0fd519c82fd932d26fb8c87dd71067398a1d6f4a9b709881dac62c
Instruction ID: c72a598bbfa7531c5ea741270d2e6bf9fae7d7814fe8404d895eaf2fe2c1d7c9
Opcode Fuzzy Hash: 150e0bff3f0fd519c82fd932d26fb8c87dd71067398a1d6f4a9b709881dac62c
Instruction Fuzzy Hash: CF2129729116188BDB68CF24CD947ADFBB9FB54341F20C6DD940DAA648D630AB85CF04

Function 00541F97 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

K32GetPerformanceInfo.KERNEL32(?,00000038), ref: 00541FDB

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: InfoPerformance
String ID:
API String ID: 3070290716-0
Opcode ID: 0dd488be67c450d0937639697e9db59565c8268bb5d4e7c7d32c4ab70e4c58b2
Instruction ID: 9204d2a037500546ae568a469c631a69d3d0a62ed755d00fe4a6a2d61bfd7e44
Opcode Fuzzy Hash: 0dd488be67c450d0937639697e9db59565c8268bb5d4e7c7d32c4ab70e4c58b2
Instruction Fuzzy Hash: BB21F571A116288BDB68CF14CD947E9FBB5FB94341F10C6DD940DAA648D630ABC5CF04

Function 00E416F2 Relevance: 1.5, APIs: 1, Instructions: 44threadCOMMON

Download Yara Rule

APIs

Wow64GetThreadContext.KERNEL32(?,?), ref: 00E41C52

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 8c098a6acac6bdf9bc360c7bf472d2d58f8e676682caf1c7629f84345a9c8b92
Instruction ID: ca71ecb8ffea69919ce73d7fb6e61f39cdefbb4b19e1e0e0a79de8d6fc8d5b3c
Opcode Fuzzy Hash: 8c098a6acac6bdf9bc360c7bf472d2d58f8e676682caf1c7629f84345a9c8b92
Instruction Fuzzy Hash: 38F049B3F4421557F7208606EC84DEBB779E7C1310F1441F6EC0D63240E9795E828BA2

Function 3BEC490F Relevance: 1.5, APIs: 1, Instructions: 43fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 3BEC5DA9

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7c99aa2ef1d6d4b43470d33901d0641c12083799034dd0b88006a91415536758
Instruction ID: fa2ac66ef56d2babff9d896f53d6b368fa2f7fe2a1da59afefe236442f471275
Opcode Fuzzy Hash: 7c99aa2ef1d6d4b43470d33901d0641c12083799034dd0b88006a91415536758
Instruction Fuzzy Hash: 0101A2B2D403159BF7248A08DD49BEFB7B8EB84710F1082FEE50D96140EE755ED08A92

Function 3BEC6891 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 69b08cefd49dd55b361896980a34b9b1129157685e22c8781d8cf5c82a3567dd
Instruction ID: 2ae6d91fd2d2550e8fa40cf9471d970aeb0aaf15651540be155ebc8bfed73881
Opcode Fuzzy Hash: 69b08cefd49dd55b361896980a34b9b1129157685e22c8781d8cf5c82a3567dd
Instruction Fuzzy Hash: B00126B084939C9FF7308B688E85F857BA0AB02710F1403CADA889B0C3DA7259E58747

Function 3BEC4692 Relevance: 1.5, APIs: 1, Instructions: 42fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 3BEC5DA9

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 2096d848a2c918bb73613acaf5a69768e41e2b836c55beb2415c0272f4ccb7fb
Instruction ID: d617fe25adc1c2ee7f998c61c6f40dcf927272fc56a805e8d7cc26ee8c156981
Opcode Fuzzy Hash: 2096d848a2c918bb73613acaf5a69768e41e2b836c55beb2415c0272f4ccb7fb
Instruction Fuzzy Hash: A101A9B2D403155BF7148908DD49BEF77B8EB84714F0042FEE50D96140DE795ED48B92

Function 00541C09 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

K32GetPerformanceInfo.KERNEL32(?,00000038), ref: 00541FDB

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: InfoPerformance
String ID:
API String ID: 3070290716-0
Opcode ID: ddf75e3c94f6f7eabd264be4095cd1d32540989ead409d24619650fbdcd16789
Instruction ID: 232ed0f6cb3c65ae7db1455384e31e2269f6e103d388e6c41198fd7aa5f79b50
Opcode Fuzzy Hash: ddf75e3c94f6f7eabd264be4095cd1d32540989ead409d24619650fbdcd16789
Instruction Fuzzy Hash: F521E471A116288BDB68CF14CD95BEDFBB9BB94341F10C6DE940DAA248D630AF85CF04

Function 00E52602 Relevance: 1.5, APIs: 1, Instructions: 42threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 00E53D9D

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 21fcc3bb1d36d2c5b908b31c74a7b8aab8a0c010522962dd52e27f6f91ca2d14
Instruction ID: bdb3e0c2d43fa7137d5943958b9b0f2c4c5c6775d71db50650aae1226a7e25f5
Opcode Fuzzy Hash: 21fcc3bb1d36d2c5b908b31c74a7b8aab8a0c010522962dd52e27f6f91ca2d14
Instruction Fuzzy Hash: 4E0126F2D091189FFB248A10EC54BFAB374EB81301F1045EEEA0E32381D2795EC58E52

Function 3BEBFBCC Relevance: 1.5, APIs: 1, Instructions: 40fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 3BEBFFDF

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8e377f1436017c98d852b5703657d093bcda267e2ca7d53ad50a524be4e803ee
Instruction ID: d356ffa141fa838cb882c1135feb2bfaa8d5a4e87e5046acdcdb7af4d854796a
Opcode Fuzzy Hash: 8e377f1436017c98d852b5703657d093bcda267e2ca7d53ad50a524be4e803ee
Instruction Fuzzy Hash: 7C0149B1E403159EF7248A14DC66B9AB764D704715F1042EAEA0A661C0CAB44A924F82

Function 00E47789 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000002), ref: 00E47B03

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 86f76b6614d17a051bda776851b527900005e954d89e016031733f699e39ec76
Instruction ID: b4ca58c4790469029e63aff14e99b98365d032e6eeff260ccd855cc67ef7445c
Opcode Fuzzy Hash: 86f76b6614d17a051bda776851b527900005e954d89e016031733f699e39ec76
Instruction Fuzzy Hash: 7D11AF74E042299FDB64CF14D884BD9B7B6BB89300F5082DAE40DA3245D7306EC1CF91

Function 3BEB6924 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 7ccd72c164a6a63abb6b1a0ca6adb13bf7a71921eec9e054ea4c4f66b8b686a3
Instruction ID: 73589e04e40ba5d9a2698aeb0643a79332e8f103f5b93e1bc04044eecbb282df
Opcode Fuzzy Hash: 7ccd72c164a6a63abb6b1a0ca6adb13bf7a71921eec9e054ea4c4f66b8b686a3
Instruction Fuzzy Hash: 7801ADB080DB989EEF218B64EC913E87F74EB85301F1485DB858A5A582DA344EC5CF42

Function 3BEC5829 Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 3BEC5DA9

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: a3ff26130b87f4c6e6cf8e8527dfe7ef5916ab7469b4874f2affc48c7914ffc7
Instruction ID: 5fc18bcf824affef868c1e668c0fd8b8b26b87db6aff9a71781a53eaaa7b957f
Opcode Fuzzy Hash: a3ff26130b87f4c6e6cf8e8527dfe7ef5916ab7469b4874f2affc48c7914ffc7
Instruction Fuzzy Hash: 48F0FFB29042259BE724CA08DD45BEBB3B9EB84744F0042F9E50CC6240EA309EC08B81

Function 3BEB7C97 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: b5b16123d979ef107935534d65d5280034cb6f277c15b7f94b4371f8bd0fd022
Instruction ID: dd780ec795cdb5cb3607ca565754beef006dfde77a823136e8d6e3c90c7455d2
Opcode Fuzzy Hash: b5b16123d979ef107935534d65d5280034cb6f277c15b7f94b4371f8bd0fd022
Instruction Fuzzy Hash: 5B019EB08497989FDB21CB64CC802E87BB4BF46300F1481DAC88966642D9354EC6CF02

Function 0054A9E3 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(4F56E159,?,?,?,?,?,?,?), ref: 0054AF1B

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 589bf3444c04627360982fcb91a84b097f39daff2c3a021ab98682fbcd18fbee
Instruction ID: 1fb7ca9e4a06676fdcce1ad24c486a509610ea55bb13cb0fe19003492f56ba8d
Opcode Fuzzy Hash: 589bf3444c04627360982fcb91a84b097f39daff2c3a021ab98682fbcd18fbee
Instruction Fuzzy Hash: DCF059F3E081059BF714591AEC598FBBBA1EB84310F1005B7D80F932C0E5791A879992

Function 3BEBEC1A Relevance: 1.5, APIs: 1, Instructions: 37fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 3BEBFFDF

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: bc28fe50a3e8f760e5f7430cb8f6fe7245352ee726830db6f4d766f2b14a25ad
Instruction ID: c6f4d85d226a2df1edcc9de2b201c0e993e13d764e51b2a0a468043ff2deaf90
Opcode Fuzzy Hash: bc28fe50a3e8f760e5f7430cb8f6fe7245352ee726830db6f4d766f2b14a25ad
Instruction Fuzzy Hash: 43F08BB0E483519EF7344614DC67BAA3B64D300B16F0003EAF246750C0C9B845914F82

Function 3BEBEC15 Relevance: 1.5, APIs: 1, Instructions: 37fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 3BEBFFDF

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3c93fb828ada443b9efa170ebd41a4fb8ecfc03bb988ab3c230753c55dd2ba9a
Instruction ID: 9f785bc9f4d8b679bd155113f40e95c30d7087b7068944d46f9122338b1a57b2
Opcode Fuzzy Hash: 3c93fb828ada443b9efa170ebd41a4fb8ecfc03bb988ab3c230753c55dd2ba9a
Instruction Fuzzy Hash: 44F02BB1D483559EF7344614DD67BAA7754D304B16F0003AAF61A750C0DDB946D14E83

Function 00E40888 Relevance: 1.5, APIs: 1, Instructions: 37threadCOMMON

Download Yara Rule

APIs

Wow64GetThreadContext.KERNEL32(?,?), ref: 00E41C52

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 3e1a71f1e1229be6389425e9d7b94b1e9cdb5c319d6177a78429b1da9a49a8e2
Instruction ID: b1964de38574d31db5e8d762f4685c7438967ec4abec7a7969baa1490c59e40e
Opcode Fuzzy Hash: 3e1a71f1e1229be6389425e9d7b94b1e9cdb5c319d6177a78429b1da9a49a8e2
Instruction Fuzzy Hash: C7F0C9A3F4410047F7148116EC88AF7B669A7C0318F1942F6F80D23180E57C1F8587E3

Function 00E41103 Relevance: 1.5, APIs: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Wow64GetThreadContext.KERNEL32(?,?), ref: 00E41C52

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: e8a0da94e03c2ca990e8df0baf023a24f2e9310f9c78de3821ab3bc752b7ce53
Instruction ID: f330858cfe582a58c57fc8e9016dcf4bb7c9c529b8f310f31f87234b98436021
Opcode Fuzzy Hash: e8a0da94e03c2ca990e8df0baf023a24f2e9310f9c78de3821ab3bc752b7ce53
Instruction Fuzzy Hash: 7EF059A3F5551557F7148512EC84AF7B669E3C0318F2891F6EC0D12540AA784E8547E2

Function 00E4368E Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: b1b0aa7b1dcbee0c97987e4577207dfe96ed0bb0c124736661a43d39d5c6097d
Instruction ID: f6d1dc2b1732343f44042ad4babc7c609cca3fb718f21027de978f8dc50ed90e
Opcode Fuzzy Hash: b1b0aa7b1dcbee0c97987e4577207dfe96ed0bb0c124736661a43d39d5c6097d
Instruction Fuzzy Hash: B7F0AF71E942698FDB24CE64CC81BA9B3B5EB40305F2045DAD949AB210EA316E948F51

Function 00E5397D Relevance: 1.5, APIs: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 00E53D9D

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: eb6e6033f83c1b800f464117a870e0b5270601a7969b9483d7cde954c8190ac9
Instruction ID: fdee9c9858efbe7d7bbc94916c464f758412d2ed05e16bac45c07ead64610ba4
Opcode Fuzzy Hash: eb6e6033f83c1b800f464117a870e0b5270601a7969b9483d7cde954c8190ac9
Instruction Fuzzy Hash: C5F0A4F2D140189BEB24CA24DC459EBB371EBC4310F1082EEE90D23740EA346F858F51

Function 3BEB7854 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 889e97d6c987780d42274e28564b4d68900ddf24bbc49eca2263a908929c36e8
Instruction ID: 3050c1aaa267490527685f98fad68d76076755d949caeb68c4e1c8309a75986c
Opcode Fuzzy Hash: 889e97d6c987780d42274e28564b4d68900ddf24bbc49eca2263a908929c36e8
Instruction Fuzzy Hash: 6F018BB0C097989FDB258F64CC806E97B74EF85300F1481DB858E6A686DA344EC6CF51

Function 00E3323C Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

VirtualProtectEx.KERNELBASE(?,?,00001000,00000040,?), ref: 00E49AA6

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 920ede8cd8b159d63038d3277db403f9fa6486ae6dc897cbd7d24e79075e18b2
Instruction ID: 5c3abe0c6eeace8e1ec7543d1673320f57bbbdf61d7c97d2d2532fdf3e06ec5a
Opcode Fuzzy Hash: 920ede8cd8b159d63038d3277db403f9fa6486ae6dc897cbd7d24e79075e18b2
Instruction Fuzzy Hash: 8DF0C2B1D05264ABEB208765AC49AEBBB64AF41310F1810A9E54EB3102F231BA55DB93

Function 3BEB71B6 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: a3673533a87154fac15baa9fbaad9243ba3a695150b45407d42062fa27ed3f64
Instruction ID: c1ce0eb21da213b938b4759a13900fa736395a06ce3bcd4b349a8d93f6ca5613
Opcode Fuzzy Hash: a3673533a87154fac15baa9fbaad9243ba3a695150b45407d42062fa27ed3f64
Instruction Fuzzy Hash: CBF062B08097989EEB119B64DC847E87B74EF46304F1485CB858959952D9344EC6CF12

Function 3BEB7CA9 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 8be58a5ba2d8708b62efebd91eaa6239e09be156fd4e2911a248c9f1854826e2
Instruction ID: d73b605ed607305f4834868ba14e6ab7879ada61edb42c8a85a060c6f06ed6c2
Opcode Fuzzy Hash: 8be58a5ba2d8708b62efebd91eaa6239e09be156fd4e2911a248c9f1854826e2
Instruction Fuzzy Hash: FB016DB0C097A89FDB21DF54CC806E9BBB4FF4A300F1484DAD989A6652DA345EC5CF51

Function 005488EE Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00548D68

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 59606b1561a1596bb3b3f7a52d5543d4f86b5cd184bd1a5d175335cdb2ad6d12
Instruction ID: a12b2f2d7e0b1a819ae424ff45600a5322098fc6dc9dd4e605b6b94e0f9a090e
Opcode Fuzzy Hash: 59606b1561a1596bb3b3f7a52d5543d4f86b5cd184bd1a5d175335cdb2ad6d12
Instruction Fuzzy Hash: C9F0F6B0D003599EDB508A54DCC8AEE7AB4FB14344F2440F5D60966140DA305F809F41

Function 00548976 Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00548D68

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 7f83a5948cd5fa08e66a535b4ca4a47da19c6527dbbe5bf6e712a519cd15ffd5
Instruction ID: 7730eb1af8466d1ac804f2c728d1f4fb9ed6b4115c5e9f5ededf855cea689a36
Opcode Fuzzy Hash: 7f83a5948cd5fa08e66a535b4ca4a47da19c6527dbbe5bf6e712a519cd15ffd5
Instruction Fuzzy Hash: 42F0F0B1D04259EEEB548A24DC98BFEBA74FB14344F2441EAE20A66280EE305F809F41

Function 3BEB7798 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 89d94bef9597d4d92e84d7933236b5f247e91ef74edf0ef0d6301d513ff85d72
Instruction ID: 0a6bf90621a59a0e15edda256ce34c6d58f2ac24aed5d6eaa228e63d9930168c
Opcode Fuzzy Hash: 89d94bef9597d4d92e84d7933236b5f247e91ef74edf0ef0d6301d513ff85d72
Instruction Fuzzy Hash: 24016DF0C097989FDB21CB64CC806E9BB74AF85300F1481DA858D66A56DA344FC6CF52

Function 3BEC5D47 Relevance: 1.5, APIs: 1, Instructions: 32fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 3BEC5DA9

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: c95596273da07887f75c34247230870368e1932c61e38ee3b380f087e92f8b45
Instruction ID: 0c192a79106b0717ae6f5ab34e09ee2b802b58050b3c45e68009719a4f9e5d9f
Opcode Fuzzy Hash: c95596273da07887f75c34247230870368e1932c61e38ee3b380f087e92f8b45
Instruction Fuzzy Hash: 95F09071D453259BE724CA08CD45BDFB7B9ABC4740F0081EAE80D97240DA715E918F92

Function 3BEC5D42 Relevance: 1.5, APIs: 1, Instructions: 32fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 3BEC5DA9

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 44e092d4f00f339af3886883f2f3d58f815fc98c0d3cbf728c229977b94ef947
Instruction ID: dca7bec64f297055ac0e9062a5594180e26d47661e4c938f79884ccc3e451106
Opcode Fuzzy Hash: 44e092d4f00f339af3886883f2f3d58f815fc98c0d3cbf728c229977b94ef947
Instruction Fuzzy Hash: D2F090B1E013299BE724CA09DD49BDFB7B9ABC4740F0081E9E80D57200EA715E918F92

Function 3BEB71B1 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 4da155b7270e5f763f467b2bbea9c4e1a0f2ecb59df55eef71f64e930374b23a
Instruction ID: 5830a3c5ab1e28fd9235a259c97ad4901c6226f48de6ef6b530a67b49515a5e3
Opcode Fuzzy Hash: 4da155b7270e5f763f467b2bbea9c4e1a0f2ecb59df55eef71f64e930374b23a
Instruction Fuzzy Hash: 5DF06DF080D398AEEB218B64DD807E97F74AF46300F1484DBC98D59A42E9344EC6CF52

Function 0054883B Relevance: 1.5, APIs: 1, Instructions: 31memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?), ref: 00548D68

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 9e9220c42fb87bd58d36238439cb5af835d38d135e16808607df36c22974fa7f
Instruction ID: 8c9ca9a7dca5ed771ed165a591ec9678ecae8819058ba7b89c7fff60b9c34f78
Opcode Fuzzy Hash: 9e9220c42fb87bd58d36238439cb5af835d38d135e16808607df36c22974fa7f
Instruction Fuzzy Hash: 10F0E9B5D00259EEDB508A24DC89BEE7BB8FB14348F1440EAE50A66240EE305FC09F51

Function 3BEB693B Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 73216912db791f1a54dbe9b6b37dc1ced7121c660562699ef8032e48f08030e6
Instruction ID: 880204e945a12b8915141b2ea8009258a35b997b13db92d3c4fc8559747f518e
Opcode Fuzzy Hash: 73216912db791f1a54dbe9b6b37dc1ced7121c660562699ef8032e48f08030e6
Instruction Fuzzy Hash: C0F049B080D7985EEB618B64DCA13E97F74AF4A300F5490CB858A59586DA784AC6CF42

Function 3BEC68AE Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(FFFFEC10,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 3BEC7C76

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5917ee02ac80a25e1e350b8ad602b8dec04e6f8841636b6bfab8aaae1c87dd5e
Instruction ID: 93458d21e52be1ac4ce7d9aa71ffcb2c4af22b71e96577cf26a00eaa68034c10
Opcode Fuzzy Hash: 5917ee02ac80a25e1e350b8ad602b8dec04e6f8841636b6bfab8aaae1c87dd5e
Instruction Fuzzy Hash: 06F0E2B084535C9AF7308B288F46F89B360B701714F5043C5DA4C6A0C2DE725AE88787

Function 00E3CD1F Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00E43BFA

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 625410a37b22a9b7d6fe6919a752dbb3e7a8ca3ed0d2f590c162f39962028468
Instruction ID: a49d7297d43b9a7170a6e372ea2df3e3d81513ccc0734ea085731615d03b686c
Opcode Fuzzy Hash: 625410a37b22a9b7d6fe6919a752dbb3e7a8ca3ed0d2f590c162f39962028468
Instruction Fuzzy Hash: 0DF04471A4426A9BDB24CF20CC81BE9B3B5FB44305F1052DA9909BB300EA71AF90CF91

Function 3BEC5254 Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 3BEC5DA9

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1737019ecd1178840d42969b53393d212ccb7ff45af6c1efb5a35208b3742a33
Instruction ID: 478afbd8f6fe1d765361eb85f37fa75f9c959812dbab8d57f1ded16ef341d99b
Opcode Fuzzy Hash: 1737019ecd1178840d42969b53393d212ccb7ff45af6c1efb5a35208b3742a33
Instruction Fuzzy Hash: 42E0E5B19453049BF714CE08DD85BDFB3B8FB84B00F0042D9E90C96140EE315AD04B92

Function 3BEB71C0 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 3BEB7CFA

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 3ceba7b5edd1d0aae760407d4cdb6dbc1adc1b9b3abc873ebccaf818db68ac8a
Instruction ID: a1bbf8d19ed28d423987352a7b902de8c9c6628a309dd3e4ec48fe195baf93e2
Opcode Fuzzy Hash: 3ceba7b5edd1d0aae760407d4cdb6dbc1adc1b9b3abc873ebccaf818db68ac8a
Instruction Fuzzy Hash: 8DF030B08097985EDB219B64DC807D87F74AF46300F1484CB858995546D5384AC6CF52

Function 026C5254 Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 026C5DA9

Memory Dump Source

Source File: 00000000.00000002.2667740199.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26b0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1737019ecd1178840d42969b53393d212ccb7ff45af6c1efb5a35208b3742a33
Instruction ID: 71086a76dd83362d858cc1223ea473c6d2d40d1500df737497d390c53aa66c22
Opcode Fuzzy Hash: 1737019ecd1178840d42969b53393d212ccb7ff45af6c1efb5a35208b3742a33
Instruction Fuzzy Hash: ABE0E5B19452049BF714C900DC80BFEB3B8FB84300F2042DDE90EA6240EA357AC18B91

Function 00E436A3 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00E43BFA

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 989f7e2691895f4c4eae5f5a1ac0169af1bae3fdc8fde973d8a10aeb4075cbd5
Instruction ID: 048e1df4eae03e5b7cb937391ca9fa1c823dd269d4eb66ea9c6ce0b5c71904e1
Opcode Fuzzy Hash: 989f7e2691895f4c4eae5f5a1ac0169af1bae3fdc8fde973d8a10aeb4075cbd5
Instruction Fuzzy Hash: C3F0A072E8425A8BDB24CE10CC91FF9B3B5FB44301F1005EAD909B7240EA316E90CF51

Function 3BEC590E Relevance: 1.5, APIs: 1, Instructions: 25fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 3BEC5DA9

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 47fe5f217c72ca5ca5e0fa0af1c64c4ca912e62872e5afa83144d4973201f4c0
Instruction ID: ee5dcfd491bbf3425d46816bb28d11d3725fa8965a215c1dce42f88f11bee442
Opcode Fuzzy Hash: 47fe5f217c72ca5ca5e0fa0af1c64c4ca912e62872e5afa83144d4973201f4c0
Instruction Fuzzy Hash: 71F01C71E452199FEB24CE08DD85BDFB3B5AB88740F0041E9E90D97240EB715E908F52

Function 00E53D60 Relevance: 1.5, APIs: 1, Instructions: 24threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 00E53D9D

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 6af1f9d2bdd9226b58ddcdfc8b66c678bf12d2fca36443aece06f2f9f4abe799
Instruction ID: 423ffeb4071652e8c2c6ec6748bee1b25ffe73f5fde30be4278e3f8749f638a1
Opcode Fuzzy Hash: 6af1f9d2bdd9226b58ddcdfc8b66c678bf12d2fca36443aece06f2f9f4abe799
Instruction Fuzzy Hash: 8AF0FEB6E591288BDB24CA55DC849DAF371AB88311F1085D9ED0D63300D6705F85CF85

Function 3BEC587C Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 3BEC5DA9

Memory Dump Source

Source File: 00000000.00000002.2699257004.000000003BEB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 3BEB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3beb0000_AdobePDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: f0330247564dc4767c04e071366ff6f88d16d1fcaafbe75ff3ee70370e0235b4
Instruction ID: 200bd145e95fa15cd4e579e93aa0e14f5dda8129bfb2cd4a8d22e6ab8e3620b8
Opcode Fuzzy Hash: f0330247564dc4767c04e071366ff6f88d16d1fcaafbe75ff3ee70370e0235b4
Instruction Fuzzy Hash: B5F01C71A452199FEB24CE04CD85BEFB3B5AB84641F0041DCE90D96240DB715E908F41

Function 00E5326E Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 00E53D9D

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 25eab12cdd1881c58f0784d1ea844a7281fa14ee3f30fa1b374599663eeac4c7
Instruction ID: 24f4b3ba3d2381afc9d7a70f1940688c0474e9f7e157edf0b0b7e0a607cf8dd8
Opcode Fuzzy Hash: 25eab12cdd1881c58f0784d1ea844a7281fa14ee3f30fa1b374599663eeac4c7
Instruction Fuzzy Hash: 61E012B2D5912C8BDB24DA64DC44AE9F374AB48311F1045C9EC0D73201D6715F84DF91

Function 00E354C7 Relevance: 1.4, APIs: 1, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 19e9cf5a1c1cc5203cd2dd0ba82218c2acd3c1330582572b0102b56d5fbdad39
Instruction ID: 757521b424d54c63a87875f3d71f492330d782973a81d202bbdc30bd188c16e3
Opcode Fuzzy Hash: 19e9cf5a1c1cc5203cd2dd0ba82218c2acd3c1330582572b0102b56d5fbdad39
Instruction Fuzzy Hash: 9E6144A2C045289AE7248B20DC587FABBB5EF81309F1050FAD44EB6280E3791EC5CF52

Function 00E36562 Relevance: 1.4, APIs: 1, Instructions: 185memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00E36AF4

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 3a2a005e3ecbe70028827913c9b8a22539d5b69178a6e777e11957e47e742657
Instruction ID: 3de1bc12bb958f41d33179ed6cc722362dbd6a14900d5e4a8b62580a0942e228
Opcode Fuzzy Hash: 3a2a005e3ecbe70028827913c9b8a22539d5b69178a6e777e11957e47e742657
Instruction Fuzzy Hash: 6361DFB1D04565AFEB308A24DC58BEBBBB5EB80319F1481FAD80DA6280D7785EC5CF51

Function 00E35467 Relevance: 1.4, APIs: 1, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 079e5bb0d5becda0254310098e1766e096602e53eadd165bae30918e560c8f3b
Instruction ID: 438170a547d92e17dae738a57098d85f08eeb4476c6c1dcfa466634f84e3b9f1
Opcode Fuzzy Hash: 079e5bb0d5becda0254310098e1766e096602e53eadd165bae30918e560c8f3b
Instruction Fuzzy Hash: 3151F2A2D04524AEE7248B25DC587FABBB5EF81309F1050FED40E66280E3B91EC5CF52

Function 00E35478 Relevance: 1.4, APIs: 1, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 320e515f3a01278530aed95d9e5a5059ef9cd0be8eeac83e70b76c15e0da0a7c
Instruction ID: 5ab4ae2f91f361c80c22512cc82a5c0f631a06a429998c8f5c0f8d0901e72ae8
Opcode Fuzzy Hash: 320e515f3a01278530aed95d9e5a5059ef9cd0be8eeac83e70b76c15e0da0a7c
Instruction Fuzzy Hash: EB51F3A2D04524AEE7248B25DC587FABBB5EF81309F1450FED40E66280E3B91EC5CF52

Function 00E354B0 Relevance: 1.4, APIs: 1, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41b728e973fefd40d84a6473778ed0205eabd845dd9657455c1ad525a2b8e602
Instruction ID: 86cf4cd1548c51017fdb62f5e5da1450645a058ee091c07ca9c14971354c3eb4
Opcode Fuzzy Hash: 41b728e973fefd40d84a6473778ed0205eabd845dd9657455c1ad525a2b8e602
Instruction Fuzzy Hash: 415103A1D045289EEB248B24DC587FABB75EF80309F1051EED40E76280E3B91EC5CF52

Function 00E35E5A Relevance: 1.4, APIs: 1, Instructions: 144memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00E36AF4

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6dc3772f428c3de515bb6db0cc3bc38c0145c5839b3ca07ec8f144fc5eaae238
Instruction ID: f66a007b2c1967462fd4543bf4a21b855a447bf7565cb1c11a08a0d9faa8e0ca
Opcode Fuzzy Hash: 6dc3772f428c3de515bb6db0cc3bc38c0145c5839b3ca07ec8f144fc5eaae238
Instruction Fuzzy Hash: C951D3B2904518ABE7348A25DC587EBBBB9EB80319F1481F9D40DA5680D77C5FC4CF51

Function 00E35505 Relevance: 1.4, APIs: 1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 30d6a27fcb588c09c6c8bb05ccd0091f17b35592794b2dd488fcaead06f647b6
Instruction ID: da7e26587f6deceaebfebd0e7eff49b2928d4283d2e98e3cb7fd19e68f1820d7
Opcode Fuzzy Hash: 30d6a27fcb588c09c6c8bb05ccd0091f17b35592794b2dd488fcaead06f647b6
Instruction Fuzzy Hash: 3241F1B2D045299AFB248A20DD597FABBB5EB80309F1451FED40E76280D3B91EC4CE52

Function 00E35AEC Relevance: 1.4, APIs: 1, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00E36AF4

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0a7c33062406aebd17d1a924a42dd99fe0caa8e63e02dcba4bea1733c862e851
Instruction ID: 963012548a5b46d3dfe90fe4478e72119db51966a1471695228c935d10636492
Opcode Fuzzy Hash: 0a7c33062406aebd17d1a924a42dd99fe0caa8e63e02dcba4bea1733c862e851
Instruction Fuzzy Hash: 9E41B5B2D045186BE7308A14DC48BEBBBB9EB80319F1490F9D50DA6680D7791FC4CF11

Function 00E359B0 Relevance: 1.4, APIs: 1, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00E36AF4

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 627a1c31879ae3f1f6f622f1c0c184054866aba6415f6fe3ecef29248e607345
Instruction ID: 58d7ba723628821b7dd67d7e5e13767936daefec48b08b5562f209614d41b77a
Opcode Fuzzy Hash: 627a1c31879ae3f1f6f622f1c0c184054866aba6415f6fe3ecef29248e607345
Instruction Fuzzy Hash: 6741A6B2904518ABFB308A25DC887EBBBB9EB80319F1490E9D40965680D7795FC9CF11

Function 00E369A9 Relevance: 1.4, APIs: 1, Instructions: 119memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00E36AF4

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6b52c9bd5cd35f8fde46274a5cadb98086fa936bbc3b249f4884afbc47d0d8e1
Instruction ID: 2ed765026d53ebaf3fb6e1f4ac9322014c5e5a3cb0f48d5beae7cb65acc6c972
Opcode Fuzzy Hash: 6b52c9bd5cd35f8fde46274a5cadb98086fa936bbc3b249f4884afbc47d0d8e1
Instruction Fuzzy Hash: 9E4103B1900168AFFB24CA61DC98BFBBBB5FB81319F2490E9D509A6180D7791EC4CF41

Function 004026B0 Relevance: 1.4, APIs: 1, Instructions: 109memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00546BBA

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 90853c554411dfcf14930fdbbeb2311955c14448743e8d1d2cd89427394e690a
Instruction ID: 92a2407643f5f06c86bf51bc5a26a80cc6295a71d8da75017e0fe8487857f1b5
Opcode Fuzzy Hash: 90853c554411dfcf14930fdbbeb2311955c14448743e8d1d2cd89427394e690a
Instruction Fuzzy Hash: E3316BB28096916FE7019B30AC4DBFA3F65FFC2309F0844FAE4455A483D239544AD762

Function 00E35B28 Relevance: 1.4, APIs: 1, Instructions: 105memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00E36AF4

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d5941c21ee62b00bdd138d896b61674c8fa5a209843a8ab524520f43a098dc5c
Instruction ID: 0c387a74aea05991ea858558f6a8ce1a80371b1449fc78a636d01dd43193e888
Opcode Fuzzy Hash: d5941c21ee62b00bdd138d896b61674c8fa5a209843a8ab524520f43a098dc5c
Instruction Fuzzy Hash: 4D41A6B2D04558ABE7348A25DC5C7EABBB9EB80309F1490E9D40D66680D7795FC8CF11

Function 00E359F9 Relevance: 1.3, APIs: 1, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00E36AF4

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7c00e052772e684cd05d6c0d41aca2f146f125b55617b865bf1b739c07cefec6
Instruction ID: d5f4e5f5e86707e0b3ac75e4a57000a20fc8766e45a8a2826309cc966c55357c
Opcode Fuzzy Hash: 7c00e052772e684cd05d6c0d41aca2f146f125b55617b865bf1b739c07cefec6
Instruction Fuzzy Hash: 734197B1904618AFEB318A25DC4C7EABBB5EB80319F1490E9D40DA5680D7795FC8CF11

Function 00E369EA Relevance: 1.3, APIs: 1, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00E36AF4

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ffadc30819fd47260dec25e684920bac409ef7f22704a88c59984bda8934808c
Instruction ID: 75f987d226013701c8817409a339f74701bc1da7204b5fe498e309f556e6cded
Opcode Fuzzy Hash: ffadc30819fd47260dec25e684920bac409ef7f22704a88c59984bda8934808c
Instruction Fuzzy Hash: 8241E1B0800659AFEB34CA61DC98BFABBB5FB4031DF2491E9D509A6181D7791EC8CF01

Function 0054663A Relevance: 1.3, APIs: 1, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00546BBA

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 40271f1d74712419302199915dbdcb29aedb7cd8383cc6fd1a28ca08dcc7dd0b
Instruction ID: b3f090e60090d80c4ec7009055afb4405dda0ac0d2ba6541383f34111ed5052a
Opcode Fuzzy Hash: 40271f1d74712419302199915dbdcb29aedb7cd8383cc6fd1a28ca08dcc7dd0b
Instruction Fuzzy Hash: DF3128B2D066559FF7108A20CD89FEA7F34FB92309F0441FBD84956681D6385DC68F22

Function 00E353CE Relevance: 1.3, APIs: 1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8164a54eaac1fe58dae35d80ddbff3eecd5c86d4d4afbb0638b86fcfcf3c9d56
Instruction ID: de7ac7aa61ffa99828293ca811915453c31a6b6b118736c1196c5617c16cf985
Opcode Fuzzy Hash: 8164a54eaac1fe58dae35d80ddbff3eecd5c86d4d4afbb0638b86fcfcf3c9d56
Instruction Fuzzy Hash: D531E5B1904658AFFB248A10DC5D7FABBB5EB8130AF1450EED10AA5181D7BD1EC9CF12

Function 005466F0 Relevance: 1.3, APIs: 1, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00546BBA

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6454830a4f054a16947425cb9900bbae0bf35ca6845a0f0611ab251f2c45df10
Instruction ID: 30ee51ec892e40171fe6d2e2ff3573e3b3de5bb88e1c9bee8844361c5e267ec0
Opcode Fuzzy Hash: 6454830a4f054a16947425cb9900bbae0bf35ca6845a0f0611ab251f2c45df10
Instruction Fuzzy Hash: E72155F2E053559FF3104A20CC88BA67E39FBD2309F0541FAD84C56285D6780EC68F22

Function 00E35344 Relevance: 1.3, APIs: 1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ed4a8d80a7f211fa34c9ea690a621adddbf6b81696f7452e8f3b4041c4f785d6
Instruction ID: 4347711191bc4f73974d3cbc7693f1e7f4d3bb44692d49db0a37b64b5c5193bf
Opcode Fuzzy Hash: ed4a8d80a7f211fa34c9ea690a621adddbf6b81696f7452e8f3b4041c4f785d6
Instruction Fuzzy Hash: 5C31E6B1904618AFFB349A21DC5C7EABBB5EB8130AF1450EAD409A5181D7BD0EC9CF12

Function 00E36A6A Relevance: 1.3, APIs: 1, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00E36AF4

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7ac4d2b4905567a6e88836432dafe0c2d797d912567251b6eb54dfbef2577bab
Instruction ID: 39012d5529f573ae00508ed2b6572a0384a63e485397010e2ea28031eb7f611b
Opcode Fuzzy Hash: 7ac4d2b4905567a6e88836432dafe0c2d797d912567251b6eb54dfbef2577bab
Instruction Fuzzy Hash: 243173B1800669AFFB248A25DC5CBFABBB5EB4031DF1450E9D509A6280D7B91FC8CF51

Function 00E35709 Relevance: 1.3, APIs: 1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b62ad6a7f0aab75346c870d8489d4f7b6f1fb45f3e973621976ff543b5d252eb
Instruction ID: 982b4676fa9dac945013d229d4b8d4a004d3c55469502c35665f95f26c32660c
Opcode Fuzzy Hash: b62ad6a7f0aab75346c870d8489d4f7b6f1fb45f3e973621976ff543b5d252eb
Instruction Fuzzy Hash: E721A671904658AFFB349A21CC5C7EABBB5EB4130AF2460DDD04AA5181D7B94EC9CF12

Function 00E4A565 Relevance: 1.3, APIs: 1, Instructions: 71memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00E4B9B1

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2ed40eebe5fdcb3757b8b5bdcf76114c6d36799300c4f5d03dc0aa0498150b5f
Instruction ID: 19caa8b6997271f412c83114ab5b4e19da4f994a64a7db27c138448d883922ab
Opcode Fuzzy Hash: 2ed40eebe5fdcb3757b8b5bdcf76114c6d36799300c4f5d03dc0aa0498150b5f
Instruction Fuzzy Hash: 0021F3A2E042189BFB244915EC587FB7B74EB80329F1511FAE90E365C0D7796EC08E22

Function 00E35737 Relevance: 1.3, APIs: 1, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00E36AF4

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e18a0dd44b4699bd0716cdf494cd7dae33980a68cc50f531410840667f69fd55
Instruction ID: 881a135178b58f8202b70fcec677dfd1384abe1557737567b5bb1246300528f4
Opcode Fuzzy Hash: e18a0dd44b4699bd0716cdf494cd7dae33980a68cc50f531410840667f69fd55
Instruction Fuzzy Hash: 6121A5B0904518ABFB348A21DC5C7EABBB5AB8130EF2450E9D409A6180D7B91EC8CF11

Function 00546B60 Relevance: 1.3, APIs: 1, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00546BBA

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8d9ee259ff3f94485c1f37c7a59302eb98429301dbdbfab71f1e43876b62d993
Instruction ID: d23a00b70988f22ca2388678a4acee2fd5b2280af2d9b29f9278514ec95cc5f3
Opcode Fuzzy Hash: 8d9ee259ff3f94485c1f37c7a59302eb98429301dbdbfab71f1e43876b62d993
Instruction Fuzzy Hash: E811E3F2D092619FF3104A10CD49BFA7E34FBD2315F1481FAD54D5A585D2391E868B62

Function 00546680 Relevance: 1.3, APIs: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00546BBA

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ac22baa1be71debf2615b1886561a3e15a5791230d8d2906a002dffa5220dbc6
Instruction ID: 06a482c6c4d7caa1dad016bb6d709eb7ef82b769fc9ce01a05f5b11c1df2d086
Opcode Fuzzy Hash: ac22baa1be71debf2615b1886561a3e15a5791230d8d2906a002dffa5220dbc6
Instruction Fuzzy Hash: 431123B2D066619FF3108A20CD4CBEA7F34FBC1306F0440FAD84C6A586C6380E86CB62

Function 00E366F0 Relevance: 1.3, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00E36AF4

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2b044ff38f519fdca33a3187307b03a8436c414e9064ba15c8dfb274331cbb5d
Instruction ID: d4a5aab686b7cc4fbdfcb56a702b13927e7447d98441672426c67dc55c6dbc90
Opcode Fuzzy Hash: 2b044ff38f519fdca33a3187307b03a8436c414e9064ba15c8dfb274331cbb5d
Instruction Fuzzy Hash: 422160B0904669AFEB35CE21DC5C7EABBB5AB4130AF2454E9D409B6281D7791EC8CF01

Function 00E36668 Relevance: 1.3, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00E36AF4

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e47c5292232cf840c791c5023726676e7b93899ee519080754b9ced792c4061f
Instruction ID: 17172a100c4374749cfbbc9da676e5b90d56b243b040294eca355a9f97a66283
Opcode Fuzzy Hash: e47c5292232cf840c791c5023726676e7b93899ee519080754b9ced792c4061f
Instruction Fuzzy Hash: E3216070904669AFEB35CE21CC5C7EABBB5AB8130AF2454D9D409B6181D3B90EC8CF01

Function 005467E1 Relevance: 1.3, APIs: 1, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00546BBA

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8a64bb7d22fe79e4a6ba6a127545e578cc1dabd6cc02dd890bf2f65a442d7bdd
Instruction ID: ed5d0494762b1713d714b6b182cd3bf426ad97ee38150477a7ff2a9b948da22e
Opcode Fuzzy Hash: 8a64bb7d22fe79e4a6ba6a127545e578cc1dabd6cc02dd890bf2f65a442d7bdd
Instruction Fuzzy Hash: 941104B2E096559FF7118A20CC89BAA7F34FBD1305F1481FBD8485A585D6381D868B22

Function 005460AE Relevance: 1.3, APIs: 1, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00546BBA

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 06025c6b92c312f3fa89734b5d4948693cea2a278f307bd66ed6b8d1c090434d
Instruction ID: a3b395560470add39c70eb7aa303f4c01e67d77fab3430dd53d01ad7f2ee20d7
Opcode Fuzzy Hash: 06025c6b92c312f3fa89734b5d4948693cea2a278f307bd66ed6b8d1c090434d
Instruction Fuzzy Hash: E201F5F2D09651AFF3004520CD89BB53E34EBD130AF0480FBE549994C6D67C0DCA8722

Function 0054586A Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00546BBA

Memory Dump Source

Source File: 00000000.00000002.2666462744.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2666440824.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666659705.00000000005B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666759847.0000000000636000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000638000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.0000000000725000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2666839988.000000000076D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 241407fc1974f478d2d1a1522664754b0e2eafcd23f3181f989bc6a9e52b4d69
Instruction ID: 5f6085b812e05f626550e2b3e0f01cac49b5ac2b5b499f667bab1e39752fa8b0
Opcode Fuzzy Hash: 241407fc1974f478d2d1a1522664754b0e2eafcd23f3181f989bc6a9e52b4d69
Instruction Fuzzy Hash: F101F5F2D09651AFF3004520CD89BA53E34FBD131AF0480F6D54999486D27C098A8722

Function 00E4A525 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00E4B9B1

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 65b5dd6e26cda41a4e31db3d83d987d477775779b49893aaea55f4ce02f84ce4
Instruction ID: c0a0e0cadc782e74b5c63e3ba02706b8e5d64b12a07ab82ac73299ff790f14c7
Opcode Fuzzy Hash: 65b5dd6e26cda41a4e31db3d83d987d477775779b49893aaea55f4ce02f84ce4
Instruction Fuzzy Hash: 7801F5B1D092589AFF688A14EC597FB7670EB04319F1411FEEA0A75180E7395FC0CE52

Function 00E4B45A Relevance: 1.3, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00E4B9B1

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0e37247ee947ea62f25ce27d4deef5ec3f3ab246f03bd2d6da71d5a33dfb5266
Instruction ID: e3654243d4e57bbdb67f2680bec44d2d0d21763e587e8da7939df07c5e2c9ac0
Opcode Fuzzy Hash: 0e37247ee947ea62f25ce27d4deef5ec3f3ab246f03bd2d6da71d5a33dfb5266
Instruction Fuzzy Hash: 65F06271D092189EFBA48E1198987FABB70EB44305F1051EADA4D76280D7355EC4DF42

Function 00E4AE80 Relevance: 1.3, APIs: 1, Instructions: 27memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 00E4B9B1

Memory Dump Source

Source File: 00000000.00000002.2667559047.0000000000E30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_AdobePDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4b9714fbc88346a8a0c7fb5c02921eaa106f25a7d9148b62748d440a230338bc
Instruction ID: 9966e9d569b5e778b374b16822a8c5d00f9499ffbb89bd6a8be7d64363589a7f
Opcode Fuzzy Hash: 4b9714fbc88346a8a0c7fb5c02921eaa106f25a7d9148b62748d440a230338bc
Instruction Fuzzy Hash: BEF0A071E092289EFF648A01A8987F9B7B0AF0431AF1021DAEE4A75180D7714EC4DE02

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report AdobePDF.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\csc.exe.log

C:\Users\user\Documents\Elaborate Bytes\HD Tach\hdtach.exe

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
AdobePDF.exe

Function 3BEBFC6B Relevance: 24.9, APIs: 1, Strings: 13, Instructions: 422
fileCOMMON

Function 3BEBC5DD Relevance: 24.3, APIs: 1, Strings: 15, Instructions: 339
COMMON

Function 3BEBD596 Relevance: 22.8, APIs: 1, Strings: 14, Instructions: 273
COMMON

Function 3BEBD67C Relevance: 22.7, APIs: 1, Strings: 14, Instructions: 209
COMMON

Function 3BEBD5D6 Relevance: 21.3, APIs: 1, Strings: 13, Instructions: 254
COMMON