Edit tour

Windows Analysis Report
AdobePremierPDF.exe

Overview

General Information

Sample name:	AdobePremierPDF.exe
Analysis ID:	1587431
MD5:	edd9264f6c649d84d19e31600d529c7d
SHA1:	471bdda3ce513b9309a5be2dc4de6a9609f341bf
SHA256:	675f89c9f4be1d34958ecb67bd7e8be731d76a3ce61b0379df79e8ad6426a9e3
Tags:	exeuser-zhuzhu0009
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (overwrites its own PE header)

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

AI detected suspicious sample

Allocates memory in foreign processes

Drops PE files to the document folder of the user

Drops large PE files

Injects a PE file into a foreign processes

May modify the system service descriptor table (often done to hook functions)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Writes to foreign memory regions

Yara detected Costura Assembly Loader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to query CPU information (cpuid)

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

AdobePremierPDF.exe (PID: 1056 cmdline: "C:\Users\user\Desktop\AdobePremierPDF.exe" MD5: EDD9264F6C649D84D19E31600D529C7D)

csc.exe (PID: 2056 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.3412543552.0000000007FE3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000004.00000002.3412954894.00000000096D0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000004.00000002.3412038687.0000000006E41000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: csc.exe PID: 2056	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: csc.exe PID: 2056	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.csc.exe.96d0000.3.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
4.2.csc.exe.80692a0.1.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\Documents\NordVPNnetworkTAP\Lang\RemotePCPrinter.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\AdobePremierPDF.exe, ProcessId: 1056, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NordicVPN

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: AdobePremierPDF.exe

Virustotal: Detection: 26%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\AdobePremierPDF.exe

Unpacked PE file: 0.2.AdobePremierPDF.exe.400000.0.unpack

Source: AdobePremierPDF.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source:	Binary string: D:\ActiveClean\src\user\TMCOMMENG\Release\tmcomeng.pdbPMZ source: AdobePremierPDF.exe, RemotePCPrinter.exe.0.dr
Source:	Binary string: D:\ActiveClean\src\user\tmavsetup\Release\TmEngDrv.pdbP source: AdobePremierPDF.exe, RemotePCPrinter.exe.0.dr
Source:	Binary string: D:\ActiveClean\src\user\tmavsetup\Release\TmEngDrv.pdb source: AdobePremierPDF.exe, RemotePCPrinter.exe.0.dr
Source:	Binary string: D:\ActiveClean\src\user\RootkitScanner\Release\RootkitBuster.pdb source: AdobePremierPDF.exe, RemotePCPrinter.exe.0.dr
Source:	Binary string: D:\ActiveClean\src\user\TMCOMMENG\Release\tmcomeng.pdb source: AdobePremierPDF.exe, RemotePCPrinter.exe.0.dr
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: csc.exe, 00000004.00000002.3412999631.0000000009730000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000004.00000003.2402257661.00000000082C1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000004.00000003.2402257661.00000000083FB000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: csc.exe, 00000004.00000002.3412999631.0000000009730000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000004.00000003.2402257661.00000000082C1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000004.00000003.2402257661.00000000083FB000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: d:\activeclean\src\sys\output\fre_wxp_x86\i386\tmcomm.pdb source: AdobePremierPDF.exe, RemotePCPrinter.exe.0.dr

Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_00406A80 FindFirstFileW,FindClose,		0_2_00406A80
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_00405570 SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,GetLastError,GetLastError,GetLastError,FindClose,		0_2_00405570

Source: C:\Users\user\Desktop\AdobePremierPDF.exe

Code function: 4x nop then push esi

0_2_0040A4B0

Source: global traffic

TCP traffic: 192.168.2.6:49817 -> 181.71.216.203:30203

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: newstaticfreepoint24.ddns-ip.net

Source: csc.exe, 00000004.00000002.3412038687.00000000070C3000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000004.00000002.3412038687.0000000006E41000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000004.00000002.3412038687.0000000006ED6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: csc.exe, 00000004.00000002.3412999631.0000000009730000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000004.00000003.2402257661.00000000082C1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000004.00000003.2402257661.00000000083FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: csc.exe, 00000004.00000002.3412999631.0000000009730000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000004.00000003.2402257661.00000000082C1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000004.00000003.2402257661.00000000083FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: csc.exe, 00000004.00000002.3412999631.0000000009730000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000004.00000003.2402257661.00000000082C1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000004.00000003.2402257661.00000000083FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: csc.exe, 00000004.00000002.3412999631.0000000009730000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000004.00000003.2402257661.00000000082C1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000004.00000003.2402257661.00000000083FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: csc.exe, 00000004.00000002.3412999631.0000000009730000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000004.00000003.2402257661.00000000082C1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000004.00000002.3412038687.0000000006E41000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000004.00000003.2402257661.00000000083FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: csc.exe, 00000004.00000002.3412999631.0000000009730000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000004.00000003.2402257661.00000000082C1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000004.00000003.2402257661.00000000083FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

System Summary

Drops large PE files

Source: C:\Users\user\Desktop\AdobePremierPDF.exe

File dump: RemotePCPrinter.exe.0.dr 959667331

Jump to dropped file

Source: C:\Users\user\Desktop\AdobePremierPDF.exe

Code function: 0_2_00407070 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,

0_2_00407070

Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_004124FE	0_2_004124FE
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_00415599	0_2_00415599
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_0041D044	0_2_0041D044
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_00413837	0_2_00413837
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_004138CB	0_2_004138CB
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_004138A4	0_2_004138A4
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_004138B9	0_2_004138B9
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_00412946	0_2_00412946
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_0041314A	0_2_0041314A
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_0041510B	0_2_0041510B
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_0041D1C0	0_2_0041D1C0
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_00412259	0_2_00412259
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_0041425A	0_2_0041425A
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_0041DAC8	0_2_0041DAC8
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_0042DAFA	0_2_0042DAFA
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_0041229F	0_2_0041229F
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_00413A9F	0_2_00413A9F
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_00413AB9	0_2_00413AB9
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_00413B6D	0_2_00413B6D
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_00416374	0_2_00416374
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_0041E310	0_2_0041E310
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_00416336	0_2_00416336
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_004143ED	0_2_004143ED
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_0041245D	0_2_0041245D
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_00413C61	0_2_00413C61
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_004144D9	0_2_004144D9
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_00412499	0_2_00412499
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_00415C98	0_2_00415C98
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_00415CA3	0_2_00415CA3
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_0042DCA9	0_2_0042DCA9
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_00412CB0	0_2_00412CB0
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_0041B558	0_2_0041B558
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_0041357A	0_2_0041357A
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_0041D52E	0_2_0041D52E
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_00426530	0_2_00426530
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_0041CDC5	0_2_0041CDC5
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_00416DC8	0_2_00416DC8
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_004135FC	0_2_004135FC
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_00413580	0_2_00413580
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_00412DA2	0_2_00412DA2
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_004125B9	0_2_004125B9
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_00439667	0_2_00439667
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_00416E0D	0_2_00416E0D
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_0041360C	0_2_0041360C
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_0042D6C8	0_2_0042D6C8
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_0042DE9B	0_2_0042DE9B
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_004136A8	0_2_004136A8
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_0041A77F	0_2_0041A77F
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_00413F10	0_2_00413F10
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_0041AFE9	0_2_0041AFE9
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_0041AFF6	0_2_0041AFF6
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_0041DFA5	0_2_0041DFA5
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007CE4CD	0_2_007CE4CD
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007C70A6	0_2_007C70A6
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007CA89B	0_2_007CA89B
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007CE095	0_2_007CE095
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007CA967	0_2_007CA967
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007CF146	0_2_007CF146
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007CC1FC	0_2_007CC1FC
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007CE1FA	0_2_007CE1FA
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007E4262	0_2_007E4262
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007E2225	0_2_007E2225
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007C521B	0_2_007C521B
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007CDACB	0_2_007CDACB
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007C7284	0_2_007C7284
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007C736F	0_2_007C736F
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007CEB65	0_2_007CEB65
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007CDB4A	0_2_007CDB4A
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007C8B47	0_2_007C8B47
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007CF338	0_2_007CF338
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007DAB04	0_2_007DAB04
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007DA473	0_2_007DA473
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007CDC1A	0_2_007CDC1A
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007E3413	0_2_007E3413
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007C6CEB	0_2_007C6CEB
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007D448F	0_2_007D448F
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007E4C81	0_2_007E4C81
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007C6D64	0_2_007C6D64
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007C6D2E	0_2_007C6D2E
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007C6D10	0_2_007C6D10
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007E6DEF	0_2_007E6DEF
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007CDDE3	0_2_007CDDE3
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007D9DC0	0_2_007D9DC0
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007E45C0	0_2_007E45C0
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007E1DBB	0_2_007E1DBB
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007E2E4C	0_2_007E2E4C
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007CBE11	0_2_007CBE11
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007CC6EF	0_2_007CC6EF
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007CA6EA	0_2_007CA6EA
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007E6ED4	0_2_007E6ED4
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007C6ED7	0_2_007C6ED7
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007E3ECD	0_2_007E3ECD
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007E26B8	0_2_007E26B8
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007E27FE	0_2_007E27FE
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007D97F8	0_2_007D97F8
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007E4797	0_2_007E4797
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022E3F44	0_2_022E3F44
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EDFFE	0_2_022EDFFE
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EC458	0_2_022EC458
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022F2D00	0_2_022F2D00
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022E9D6E	0_2_022E9D6E
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022E8A2E	0_2_022E8A2E
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EAA2F	0_2_022EAA2F
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EDA2D	0_2_022EDA2D
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022F4226	0_2_022F4226
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022F3225	0_2_022F3225
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022F323B	0_2_022F323B
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022F4231	0_2_022F4231
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022F4270	0_2_022F4270
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EAA46	0_2_022EAA46
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022F425C	0_2_022F425C
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022F3250	0_2_022F3250
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022E52AA	0_2_022E52AA
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022F42A4	0_2_022F42A4
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022E52C5	0_2_022E52C5
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022E52DB	0_2_022E52DB
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EFB3A	0_2_022EFB3A
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022F3334	0_2_022F3334
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022F3312	0_2_022F3312
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022F436D	0_2_022F436D
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022F337C	0_2_022F337C
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022F3375	0_2_022F3375
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022E9BBF	0_2_022E9BBF
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022E43B6	0_2_022E43B6
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EFB86	0_2_022EFB86
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022F439E	0_2_022F439E
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EDBCC	0_2_022EDBCC
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022F4027	0_2_022F4027
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022E9803	0_2_022E9803
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022F404A	0_2_022F404A
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022E8044	0_2_022E8044
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EE044	0_2_022EE044
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EE05C	0_2_022EE05C
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022F305A	0_2_022F305A
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022F40AC	0_2_022F40AC
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022F28AB	0_2_022F28AB
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022ED0BE	0_2_022ED0BE
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022F40BB	0_2_022F40BB
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EE085	0_2_022EE085
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EA897	0_2_022EA897
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_023008FA	0_2_023008FA
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022F30F4	0_2_022F30F4
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022ED0C3	0_2_022ED0C3
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022F40D6	0_2_022F40D6
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EE0D5	0_2_022EE0D5
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EF12B	0_2_022EF12B
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022F313F	0_2_022F313F
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EA93A	0_2_022EA93A
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_02300912	0_2_02300912
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022F410D	0_2_022F410D
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022E0106	0_2_022E0106
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EA97F	0_2_022EA97F
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022ED179	0_2_022ED179
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EE15F	0_2_022EE15F
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EA9A6	0_2_022EA9A6
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022F41A6	0_2_022F41A6
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022ED1BE	0_2_022ED1BE
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022ED19D	0_2_022ED19D
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EA996	0_2_022EA996
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EA9E3	0_2_022EA9E3
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022F31CD	0_2_022F31CD
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022F41DA	0_2_022F41DA
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022E41D9	0_2_022E41D9
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EA638	0_2_022EA638
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022E4E00	0_2_022E4E00
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022ECE00	0_2_022ECE00
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EAE1F	0_2_022EAE1F
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EDE68	0_2_022EDE68
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022E4E64	0_2_022E4E64
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022E8E63	0_2_022E8E63
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EDE73	0_2_022EDE73
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EDEAB	0_2_022EDEAB
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EDEBD	0_2_022EDEBD
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EDEB8	0_2_022EDEB8
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EA689	0_2_022EA689
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022E4EED	0_2_022E4EED
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EF6C7	0_2_022EF6C7
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EA6C3	0_2_022EA6C3
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EA6DC	0_2_022EA6DC
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EA6D2	0_2_022EA6D2
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022E46D0	0_2_022E46D0
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022E8728	0_2_022E8728
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022E4F0E	0_2_022E4F0E
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022E4713	0_2_022E4713
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022E3F73	0_2_022E3F73
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EDF4F	0_2_022EDF4F
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EE752	0_2_022EE752
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022E77AE	0_2_022E77AE
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EDFAC	0_2_022EDFAC
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EAFAB	0_2_022EAFAB
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022E9FBF	0_2_022E9FBF
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EA7BD	0_2_022EA7BD
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EDFED	0_2_022EDFED
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022E47E3	0_2_022E47E3
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EE7C7	0_2_022EE7C7
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022E47C4	0_2_022E47C4
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EDFC4	0_2_022EDFC4
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EDC20	0_2_022EDC20
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EDC77	0_2_022EDC77
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EB4A4	0_2_022EB4A4
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022F3CB6	0_2_022F3CB6
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022E44B2	0_2_022E44B2
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EDC8E	0_2_022EDC8E
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022E8C91	0_2_022E8C91
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022F3CC4	0_2_022F3CC4
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EE526	0_2_022EE526
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EDD27	0_2_022EDD27
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022E7521	0_2_022E7521
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022E753D	0_2_022E753D
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EE50D	0_2_022EE50D
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022E7512	0_2_022E7512
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022F3DA5	0_2_022F3DA5
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022ECDB6	0_2_022ECDB6
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022F3DB5	0_2_022F3DB5
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EDD8F	0_2_022EDD8F
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022E4587	0_2_022E4587
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022E7585	0_2_022E7585
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022F3D84	0_2_022F3D84
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022ECD80	0_2_022ECD80
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EBD9B	0_2_022EBD9B
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EDDEE	0_2_022EDDEE
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022ECDE3	0_2_022ECDE3
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EDDF5	0_2_022EDDF5
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022ECDCD	0_2_022ECDCD
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_022EDDC7	0_2_022EDDC7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4_2_04FC3008	4_2_04FC3008
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4_2_04FC2FF8	4_2_04FC2FF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4_2_06C0C5F0	4_2_06C0C5F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4_2_06C05250	4_2_06C05250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4_2_06C0D620	4_2_06C0D620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4_2_06C03D48	4_2_06C03D48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4_2_06C03D38	4_2_06C03D38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4_2_06C0C917	4_2_06C0C917
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4_2_09781528	4_2_09781528
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4_2_09786110	4_2_09786110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4_2_09780C58	4_2_09780C58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4_2_09781EF0	4_2_09781EF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4_2_09781EE0	4_2_09781EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4_2_097AE850	4_2_097AE850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4_2_097ACED8	4_2_097ACED8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4_2_097AE840	4_2_097AE840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4_2_097AE818	4_2_097AE818

Source: C:\Users\user\Desktop\AdobePremierPDF.exe

Code function: String function: 0041E430 appears 66 times

Source: AdobePremierPDF.exe	Static PE information: Resource name: DRIVER type: PE32 executable (native) Intel 80386, for MS Windows
Source: AdobePremierPDF.exe	Static PE information: Resource name: TMCOMMDLL type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: AdobePremierPDF.exe	Static PE information: Resource name: TMENGDRV type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: RemotePCPrinter.exe.0.dr	Static PE information: Resource name: DRIVER type: PE32 executable (native) Intel 80386, for MS Windows
Source: RemotePCPrinter.exe.0.dr	Static PE information: Resource name: TMCOMMDLL type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: RemotePCPrinter.exe.0.dr	Static PE information: Resource name: TMENGDRV type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Source: AdobePremierPDF.exe	Binary or memory string: %sOriginalFileName vs AdobePremierPDF.exe
Source: AdobePremierPDF.exe, 00000000.00000000.2138958562.00000000004BA000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameTmEngDrv.dllN vs AdobePremierPDF.exe
Source: AdobePremierPDF.exe, 00000000.00000000.2138958562.00000000004BA000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameRootkitBuster.exeN vs AdobePremierPDF.exe
Source: AdobePremierPDF.exe, 00000000.00000002.2407781667.0000000002985000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTmEngDrv.dllN vs AdobePremierPDF.exe
Source: AdobePremierPDF.exe, 00000000.00000002.2407781667.0000000002985000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRootkitBuster.exeN vs AdobePremierPDF.exe
Source: AdobePremierPDF.exe, 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenametmcomeng.dllN vs AdobePremierPDF.exe
Source: AdobePremierPDF.exe, 00000000.00000002.2407781667.0000000002924000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTmComm.sysN vs AdobePremierPDF.exe
Source: AdobePremierPDF.exe, 00000000.00000000.2138958562.000000000045C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameTmComm.sysN vs AdobePremierPDF.exe
Source: AdobePremierPDF.exe, 00000000.00000000.2138926875.000000000044E000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: %sOriginalFileName vs AdobePremierPDF.exe
Source: AdobePremierPDF.exe, 00000000.00000000.2138926875.000000000044E000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OD.H%sSpecialBuild%sPrivateBuild%sLegalTrademarks%sComments%sProductVersion%sProductName%sOriginalFileName%sLegalCopyright%sInternalName%sFileVersion%sFileDescription%sCompanyName\StringFileInfo\%04X%04X\\VarFileInfo\Translation\Leaving destruct CSICReportLogger objectD:\ActiveClean\src\user\RootkitScanner\source\SICReportLogger.cppCSICReportLogger::~CSICReportLogger()Entering destruct CSICReportLogger objectLog File Handle not Initialized.CSIC::LogString()No memory space can be allocated.CSIC::LogSingleString()leaving Initialize CSIC scan object ret=%d%s%s\%s\%sSICLOGCSICReportLogger::Initialize()Entering Initialize CSICReportLogger objectCSICReportLogger::LogBytes()CSICReportLogger::_CloseLogFileCloseLogFile\%%s%%.%dd.%%sCan't find next file, ErrNo=%d%s*.%sTXTCSICReportLogger::RotateFileName()X86PROCESSOR_ARCHITEW6432PROCESSOR_ARCHITECTUREAfter uninstall driver=%dD:\ActiveClean\src\user\RootkitScanner\source\TMRKScanWin.cpp(Needn't waiting)bStopped=%dWinAppDestructor()(After waiting)bStopped=%d+----------------------------------------------------+ vs AdobePremierPDF.exe
Source: AdobePremierPDF.exe, 00000000.00000002.2407606939.000000000258A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameVppuhvl.exe" vs AdobePremierPDF.exe
Source: AdobePremierPDF.exe, 00000000.00000002.2407781667.00000000028D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: %sOriginalFileName vs AdobePremierPDF.exe
Source: AdobePremierPDF.exe, 00000000.00000002.2407781667.00000000028D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OD.H%sSpecialBuild%sPrivateBuild%sLegalTrademarks%sComments%sProductVersion%sProductName%sOriginalFileName%sLegalCopyright%sInternalName%sFileVersion%sFileDescription%sCompanyName\StringFileInfo\%04X%04X\\VarFileInfo\Translation\Leaving destruct CSICReportLogger objectD:\ActiveClean\src\user\RootkitScanner\source\SICReportLogger.cppCSICReportLogger::~CSICReportLogger()Entering destruct CSICReportLogger objectLog File Handle not Initialized.CSIC::LogString()No memory space can be allocated.CSIC::LogSingleString()leaving Initialize CSIC scan object ret=%d%s%s\%s\%sSICLOGCSICReportLogger::Initialize()Entering Initialize CSICReportLogger objectCSICReportLogger::LogBytes()CSICReportLogger::_CloseLogFileCloseLogFile\%%s%%.%dd.%%sCan't find next file, ErrNo=%d%s*.%sTXTCSICReportLogger::RotateFileName()X86PROCESSOR_ARCHITEW6432PROCESSOR_ARCHITECTUREAfter uninstall driver=%dD:\ActiveClean\src\user\RootkitScanner\source\TMRKScanWin.cpp(Needn't waiting)bStopped=%dWinAppDestructor()(After waiting)bStopped=%d+----------------------------------------------------+ vs AdobePremierPDF.exe
Source: AdobePremierPDF.exe	Binary or memory string: %sOriginalFileName vs AdobePremierPDF.exe
Source: AdobePremierPDF.exe	Binary or memory string: OD.H%sSpecialBuild%sPrivateBuild%sLegalTrademarks%sComments%sProductVersion%sProductName%sOriginalFileName%sLegalCopyright%sInternalName%sFileVersion%sFileDescription%sCompanyName\StringFileInfo\%04X%04X\\VarFileInfo\Translation\Leaving destruct CSICReportLogger objectD:\ActiveClean\src\user\RootkitScanner\source\SICReportLogger.cppCSICReportLogger::~CSICReportLogger()Entering destruct CSICReportLogger objectLog File Handle not Initialized.CSIC::LogString()No memory space can be allocated.CSIC::LogSingleString()leaving Initialize CSIC scan object ret=%d%s%s\%s\%sSICLOGCSICReportLogger::Initialize()Entering Initialize CSICReportLogger objectCSICReportLogger::LogBytes()CSICReportLogger::_CloseLogFileCloseLogFile\%%s%%.%dd.%%sCan't find next file, ErrNo=%d%s*.%sTXTCSICReportLogger::RotateFileName()X86PROCESSOR_ARCHITEW6432PROCESSOR_ARCHITECTUREAfter uninstall driver=%dD:\ActiveClean\src\user\RootkitScanner\source\TMRKScanWin.cpp(Needn't waiting)bStopped=%dWinAppDestructor()(After waiting)bStopped=%d+----------------------------------------------------+ vs AdobePremierPDF.exe
Source: AdobePremierPDF.exe	Binary or memory string: OriginalFilenameTmComm.sysN vs AdobePremierPDF.exe
Source: AdobePremierPDF.exe	Binary or memory string: OriginalFilenametmcomeng.dllN vs AdobePremierPDF.exe
Source: AdobePremierPDF.exe	Binary or memory string: OriginalFilenameTmEngDrv.dllN vs AdobePremierPDF.exe
Source: AdobePremierPDF.exe	Binary or memory string: OriginalFilenameRootkitBuster.exeN vs AdobePremierPDF.exe

Source: AdobePremierPDF.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: RemotePCPrinter.exe.0.dr	Binary string: \Device\LanmanRedirector\
Source: RemotePCPrinter.exe.0.dr	Binary string: \\\Device\Harddisk
Source: RemotePCPrinter.exe.0.dr	Binary string: \SystemRoot\TmComm.log\Device\TmComm>>> CFG-GetSDTProc(%d, %s)=%p
Source: RemotePCPrinter.exe.0.dr	Binary string: Utility\??\\??\UNC\\Device\HarddiskIoValidateDeviceIoControlAccessIoCreateDeviceSecureD:P
Source: RemotePCPrinter.exe.0.dr	Binary string: \Device\LanmanRedirector\;
Source: RemotePCPrinter.exe.0.dr	Binary string: \??\\??\UNC\\\?\\??\\Registry\Machine\\Registry\User\\Registry\Machine\Software\Classes\\Registry\Machine\System\CurrentControlSet\Hardware Profiles\Current\.*\Device\LanmanRedirector\;\Device\LanmanRedirector\\??\UNC\\SystemRoot\\??\\Device\LanmanRedirector\;\Device\LanmanRedirector\\??\UNC\\SystemRoot\\??\
Source: RemotePCPrinter.exe.0.dr	Binary string: aD\\\Device\Harddisk

Source: classification engine

Classification label: mal100.evad.winEXE@3/1@1/1

Source: C:\Users\user\Desktop\AdobePremierPDF.exe

Code function: 0_2_00407070 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,

0_2_00407070

Source: C:\Users\user\Desktop\AdobePremierPDF.exe

Code function: 0_2_004068B0 FindResourceW,LoadResource,SizeofResource,CreateFileW,WriteFile,CloseHandle,

0_2_004068B0

Source: C:\Users\user\Desktop\AdobePremierPDF.exe

File created: C:\Users\user\Documents\NordVPNnetworkTAP

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Mutant created: \Sessions\1\BaseNamedObjects\mono1234

Source: AdobePremierPDF.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\AdobePremierPDF.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: AdobePremierPDF.exe

Virustotal: Detection: 26%

Source: AdobePremierPDF.exe

String found in binary or memory: >>> CFG-AddEP(%03x, %03x)=%#x

Source: C:\Users\user\Desktop\AdobePremierPDF.exe

File read: C:\Users\user\Desktop\AdobePremierPDF.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\AdobePremierPDF.exe "C:\Users\user\Desktop\AdobePremierPDF.exe"
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"	Jump to behavior

Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Section loaded: a.dll	Jump to behavior
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: AdobePremierPDF.exe

Static file information: File size 2359377 > 1048576

Source: AdobePremierPDF.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x1e9000

Source: AdobePremierPDF.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\ActiveClean\src\user\TMCOMMENG\Release\tmcomeng.pdbPMZ source: AdobePremierPDF.exe, RemotePCPrinter.exe.0.dr
Source:	Binary string: D:\ActiveClean\src\user\tmavsetup\Release\TmEngDrv.pdbP source: AdobePremierPDF.exe, RemotePCPrinter.exe.0.dr
Source:	Binary string: D:\ActiveClean\src\user\tmavsetup\Release\TmEngDrv.pdb source: AdobePremierPDF.exe, RemotePCPrinter.exe.0.dr
Source:	Binary string: D:\ActiveClean\src\user\RootkitScanner\Release\RootkitBuster.pdb source: AdobePremierPDF.exe, RemotePCPrinter.exe.0.dr
Source:	Binary string: D:\ActiveClean\src\user\TMCOMMENG\Release\tmcomeng.pdb source: AdobePremierPDF.exe, RemotePCPrinter.exe.0.dr
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: csc.exe, 00000004.00000002.3412999631.0000000009730000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000004.00000003.2402257661.00000000082C1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000004.00000003.2402257661.00000000083FB000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: csc.exe, 00000004.00000002.3412999631.0000000009730000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000004.00000003.2402257661.00000000082C1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000004.00000003.2402257661.00000000083FB000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: d:\activeclean\src\sys\output\fre_wxp_x86\i386\tmcomm.pdb source: AdobePremierPDF.exe, RemotePCPrinter.exe.0.dr

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\AdobePremierPDF.exe

Unpacked PE file: 0.2.AdobePremierPDF.exe.400000.0.unpack

Yara detected Costura Assembly Loader

Source: Yara match	File source: 4.2.csc.exe.96d0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.csc.exe.80692a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3412543552.0000000007FE3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3412954894.00000000096D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3412038687.0000000006E41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: csc.exe PID: 2056, type: MEMORYSTR

Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"			Jump to behavior

Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_0042119A push 810000DCh; ret	0_2_004211A5
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_0040DC10 push eax; ret	0_2_0040DC3E
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_0040F688 push eax; ret	0_2_0040F6A6
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_007C7284 push C1810000h; retf 00FAh	0_2_007C82B4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4_2_04FC696D push ebx; retf	4_2_04FC6972
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4_2_06C02721 push es; retf	4_2_06C02784
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4_2_06C02541 push es; retf	4_2_06C02720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4_2_06C02541 push es; retf	4_2_06C02784
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4_2_06C08FC1 push es; iretd	4_2_06C08FC4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4_2_06C05CF9 push es; retf C05Eh	4_2_06C08B64
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4_2_06C05CF9 push es; retf C066h	4_2_06C08D08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4_2_06C03C81 push esp; retf	4_2_06C03C8D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4_2_06C08C93 push es; iretd	4_2_06C08C94
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4_2_06C08D87 push es; iretd	4_2_06C08D8C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4_2_06C0BD38 push es; ret	4_2_06C0BE10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 4_2_097AC250 pushad ; iretd	4_2_097AC251

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\AdobePremierPDF.exe

File created: C:\Users\user\Documents\NordVPNnetworkTAP\Lang\RemotePCPrinter.exe

Jump to dropped file

Source: C:\Users\user\Desktop\AdobePremierPDF.exe

File created: C:\Users\user\Documents\NordVPNnetworkTAP\Lang\RemotePCPrinter.exe

Jump to dropped file

Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run NordicVPN			Jump to behavior
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run NordicVPN			Jump to behavior

Hooking and other Techniques for Hiding and Protection

May modify the system service descriptor table (often done to hook functions)

Source: AdobePremierPDF.exe, 00000000.00000002.2407781667.0000000002924000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: KeServiceDescriptorTable
Source: AdobePremierPDF.exe, 00000000.00000000.2138958562.000000000045C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: KeServiceDescriptorTable
Source: AdobePremierPDF.exe	Binary or memory string: KeServiceDescriptorTable
Source: RemotePCPrinter.exe.0.dr	Binary or memory string: KeServiceDescriptorTable

Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_004080C0 IsIconic,SendMessageW,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,		0_2_004080C0
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_0040CB46 IsIconic,GetWindowPlacement,GetWindowRect,		0_2_0040CB46

Source: C:\Users\user\Desktop\AdobePremierPDF.exe

Code function: 0_2_00401970 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetModuleFileNameW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

0_2_00401970

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: csc.exe PID: 2056, type: MEMORYSTR

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 4FC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 6E40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 6A80000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Window / User API: threadDelayed 3526			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Window / User API: threadDelayed 6316			Jump to behavior

Source: C:\Users\user\Desktop\AdobePremierPDF.exe

Dropped PE file which has not been started: C:\Users\user\Documents\NordVPNnetworkTAP\Lang\RemotePCPrinter.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -34126476536362649s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 3300	Thread sleep count: 3526 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -59890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 3300	Thread sleep count: 6316 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -59777s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -59670s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -59562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -59453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -59324s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -59218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -59109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -59000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -58890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -58781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -58672s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -58562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -58453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -58343s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -58233s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -58124s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -57587s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -57483s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -57369s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -57265s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -57156s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -57047s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -56886s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -56774s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -56655s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -56547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -56437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -56328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -56219s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -56109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -55996s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -55890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -55781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -55666s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -55562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -55441s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -55109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -54734s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -54577s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -54468s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -54359s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -54242s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -54135s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -54030s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -53922s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -53797s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -53687s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -53578s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -53469s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 2244	Thread sleep time: -53344s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_00406A80 FindFirstFileW,FindClose,		0_2_00406A80
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Code function: 0_2_00405570 SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,GetLastError,GetLastError,GetLastError,FindClose,		0_2_00405570

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59777	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59670	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59324	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58233	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58124	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 57587	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 57483	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 57369	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 57265	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 57156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 57047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56886	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56774	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56655	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55996	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55666	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55441	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54577	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54468	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54242	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54135	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54030	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 53922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 53797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 53687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 53578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 53469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 53344	Jump to behavior

Source: csc.exe, 00000004.00000002.3413288189.0000000009A18000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllde

Source: C:\Users\user\Desktop\AdobePremierPDF.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\AdobePremierPDF.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\AdobePremierPDF.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 4900000 protect: page readonly

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\AdobePremierPDF.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 4900000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 4900000			Jump to behavior
Source: C:\Users\user\Desktop\AdobePremierPDF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 4BED008			Jump to behavior

Source: C:\Users\user\Desktop\AdobePremierPDF.exe

Code function: 0_2_007E8675 cpuid

0_2_007E8675

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\AdobePremierPDF.exe

Code function: 0_2_0040F112 GetLocalTime,GetSystemTime,GetTimeZoneInformation,SendMessageW,FindWindowExW,

0_2_0040F112

Source: C:\Users\user\Desktop\AdobePremierPDF.exe

Code function: 0_2_0040F112 GetLocalTime,GetSystemTime,GetTimeZoneInformation,SendMessageW,FindWindowExW,

0_2_0040F112

Source: C:\Users\user\Desktop\AdobePremierPDF.exe

Code function: 0_2_004058C0 GetVersionExA,

0_2_004058C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: csc.exe, 00000004.00000002.3411311825.0000000005046000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	131 Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	1 Masquerading	1 Credential API Hooking	2 System Time Discovery	Remote Services	1 Credential API Hooking	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	31 Process Injection	11 Disable or Modify Tools	LSASS Memory	131 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	141 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Access Token Manipulation	NTDS	141 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	31 Process Injection	LSA Secrets	11 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	3 Obfuscated Files or Information	DCSync	135 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
AdobePremierPDF.exe	3%	ReversingLabs
AdobePremierPDF.exe	26%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\Documents\NordVPNnetworkTAP\Lang\RemotePCPrinter.exe	8%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
newstaticfreepoint24.ddns-ip.net	181.71.216.203	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://github.com/mgravell/protobuf-net	csc.exe, 00000004.00000002.3412999631.0000000009730000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000004.00000003.2402257661.00000000082C1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000004.00000003.2402257661.00000000083FB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/mgravell/protobuf-neti	csc.exe, 00000004.00000002.3412999631.0000000009730000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000004.00000003.2402257661.00000000082C1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000004.00000003.2402257661.00000000083FB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://stackoverflow.com/q/14436606/23354	csc.exe, 00000004.00000002.3412999631.0000000009730000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000004.00000003.2402257661.00000000082C1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000004.00000002.3412038687.0000000006E41000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000004.00000003.2402257661.00000000083FB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/mgravell/protobuf-netJ	csc.exe, 00000004.00000002.3412999631.0000000009730000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000004.00000003.2402257661.00000000082C1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000004.00000003.2402257661.00000000083FB000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	csc.exe, 00000004.00000002.3412038687.00000000070C3000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000004.00000002.3412038687.0000000006E41000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000004.00000002.3412038687.0000000006ED6000.00000004.00000800.00020000.00000000.sdmp	false	high
https://stackoverflow.com/q/11564914/23354;	csc.exe, 00000004.00000002.3412999631.0000000009730000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000004.00000003.2402257661.00000000082C1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000004.00000003.2402257661.00000000083FB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://stackoverflow.com/q/2152978/23354	csc.exe, 00000004.00000002.3412999631.0000000009730000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000004.00000003.2402257661.00000000082C1000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000004.00000003.2402257661.00000000083FB000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
181.71.216.203	newstaticfreepoint24.ddns-ip.net	Colombia		27831	ColombiaMovilCO	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587431
Start date and time:	2025-01-10 11:32:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	AdobePremierPDF.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@3/1@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 87% Number of executed functions: 347 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 20.109.210.53
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtProtectVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:33:27	API Interceptor	897759x Sleep call for process: csc.exe modified
11:33:27	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run NordicVPN C:\Users\user\Documents\NordVPNnetworkTAP\Lang\RemotePCPrinter.exe
11:33:36	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run NordicVPN C:\Users\user\Documents\NordVPNnetworkTAP\Lang\RemotePCPrinter.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
181.71.216.203	2LDJIyMl2r.exe	Get hash	malicious	Remcos	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
newstaticfreepoint24.ddns-ip.net	2LDJIyMl2r.exe	Get hash	malicious	Remcos	Browse	181.71.216.203
	SHROsQyiAd.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	4JwhvqLe8n.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	fIPSLgT0lO.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	3XSXmrEOw7.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	ozfqy8Ms6t.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	pPLwX9wSrD.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	hCJ8gK9kNn.exe	Get hash	malicious	Remcos	Browse	181.131.217.244

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ColombiaMovilCO	1736491685b40eefbc9bdfbc98216071e6ff3a4c19c7e1ab8a144cde35036665da85346b6b949.dat-decoded.exe	Get hash	malicious	Remcos	Browse	179.15.136.6
	6.elf	Get hash	malicious	Unknown	Browse	181.70.170.80
	173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Get hash	malicious	Remcos	Browse	179.15.136.6
	1736348224ad77cf86e491faad27e4b5decf1eb0bb26f16b0527e5ef488389ba353aa3db79582.dat-decoded.exe	Get hash	malicious	Remcos	Browse	179.15.136.6
	17363482247f60133f013d62aae38c531ac95bb55a200a243b0e15fa7cf8e8923b2a10590f952.dat-decoded.exe	Get hash	malicious	Remcos	Browse	179.15.136.6
	1736348224f7603a5c535b2b2f6cc29730626d73a967c67551d2d14f73b547fe7b5fc10393994.dat-decoded.exe	Get hash	malicious	Remcos	Browse	179.15.136.6
	1736348224bd83df4c8d79407f8e7ac5cf8c08b59746ce37ff95772daa0a6283b50e2b0882115.dat-decoded.exe	Get hash	malicious	Remcos	Browse	179.15.136.6
	17363482249a873460757a9239193679567953c11d17b898ff9845034e34f5d2e7f4521342673.dat-decoded.exe	Get hash	malicious	Remcos	Browse	179.15.136.6
	sh4.elf	Get hash	malicious	Mirai	Browse	177.252.126.19
	armv5l.elf	Get hash	malicious	Unknown	Browse	191.93.155.250

Process:	C:\Users\user\Desktop\AdobePremierPDF.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	959667331
Entropy (8bit):	0.03730496671378165
Encrypted:	false
SSDEEP:
MD5:	A084C1B14EEFC00C8ADF95FABA838F71
SHA1:	2CC59B80E92D1E5FACEBBD3646B0EC2972E994D0
SHA-256:	B0154E35BD08A554B64F0EC61CB1C2FE766C96F2AD56124851FBB46A7A4D67BF
SHA-512:	68E4C0D09FA1FB18C6726CC1F51E37584A746543BB3498FBD6775A7E3505A6A36986C7CCFE212D40CCE10588DDF76E5B707181CE545DC5E17FC37728041E395C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............@..@..@..@..@...L..@......@..A.q.@......@...K..@...N..@...J.5.@...K..@..K..@.X.F..@.Rich..@..H.$..PE..L......E..........................................@..........................P$......................................................................................................................................................................text...~........................... ..`.rdata..............................@..@.data...H...........................@....rsrc................p..............@..@........................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.998941857887512
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	AdobePremierPDF.exe
File size:	2'359'377 bytes
MD5:	edd9264f6c649d84d19e31600d529c7d
SHA1:	471bdda3ce513b9309a5be2dc4de6a9609f341bf
SHA256:	675f89c9f4be1d34958ecb67bd7e8be731d76a3ce61b0379df79e8ad6426a9e3
SHA512:	df48401848484c142c462820ddb0f8f82db55a879a14c2be52dd57afde4e7f1452f5e07a8d05afa9307cf39d0130acd8fd55d95df1731d0f7fcad2ec5cd2f900
SSDEEP:	24576:2UX4dOOOjXBaykZ+1X80ikrNL2dOOONUu8T2GhOOPiE3OAHwnBqk38wAyBnaAqmI:vIdKRDXlrNadfTXPR31QnBz38wAkaAkj
TLSH:	10B5BF209A4191CBE5A63C741337A6B1F1366D7526218983F38A7F3F74B1AC08D2E767
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............@...@...@...@...@...L...@.......@...A.q.@.......@...K...@...N...@...J.5.@...K...@...K...@.X.F...@.Rich..@....H.$..PE..L..

File Icon


Icon Hash:	03032725047cfe60

Static PE Info

General

Entrypoint:	0x40d5c0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x45BF13D2 [Tue Jan 30 09:45:54 2007 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	5fb09959021d8f9c65e9a957b247adac

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 00444FB0h
push 004114D0h
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 58h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
call dword ptr [004413C8h]
xor edx, edx
mov dl, ah
mov dword ptr [00459274h], edx
mov ecx, eax
and ecx, 000000FFh
mov dword ptr [00459270h], ecx
shl ecx, 08h
add ecx, edx
mov dword ptr [0045926Ch], ecx
shr eax, 10h
mov dword ptr [00459268h], eax
push 00000001h
call 00007F1260580289h
pop ecx
test eax, eax
jne 00007F126057C4EAh
push 0000001Ch
call 00007F126057C5A7h
pop ecx
call 00007F126057FF6Ah
test eax, eax
jne 00007F126057C4EAh
push 00000010h
call 00007F126057C596h
pop ecx
xor esi, esi
mov dword ptr [ebp-04h], esi
call 00007F126057FD44h
call 00007F126057FC9Eh
mov dword ptr [0045AD14h], eax
call 00007F126057FB27h
mov dword ptr [0045925Ch], eax
call 00007F126057F8F4h
call 00007F126057F837h
call 00007F126057D54Ch
mov dword ptr [ebp-30h], esi
lea eax, dword ptr [ebp-5Ch]
push eax
call dword ptr [0044120Ch]
call 00007F126057F7DBh
mov dword ptr [ebp-64h], eax
test byte ptr [ebp-30h], 00000001h
je 00007F126057C4E8h
movzx eax, word ptr [ebp-2Ch]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4b498	0xc8	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5c000	0x1e82a4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x417e0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x41000	0x7dc	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3fa7e	0x40000	2620190312cce818dddf96a372e1d259	False	0.5420570373535156	data	6.483815068429939	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x41000	0xceba	0xd000	a4723db4edd9c9ea7344a58a64b1e60c	False	0.4619140625	data	5.745896503987959	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x4e000	0xd848	0x9000	00473552ce4b9e86c7a55926c18dc927	False	0.2333441840277778	data	3.330419442779499	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5c000	0x1e82a4	0x1e9000	4f1099726ca24a6f4beeb053efabd87f	False	0.6420813562436094	data	7.11413126623513	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
CATALOG	0x5cb40	0x2974	data	English	United States	0.534206558612891
DRIVER	0x5f4b4	0x19190	PE32 executable (native) Intel 80386, for MS Windows	Chinese	Taiwan	0.47299610894941635
INFINSTALL	0x78644	0x996	Windows setup INFormation	English	United States	0.40179299103504484
TMCOMMDLL	0x78fdc	0x2b047	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	Chinese	Taiwan	0.42348140454826644
TMENGDRV	0xa4024	0x1b047	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	Chinese	Taiwan	0.4508824087545069
RT_CURSOR	0xbf06c	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4805194805194805
RT_CURSOR	0xbf1a0	0xb4	Targa image data - Map 32 x 65536 x 1 +16 "\001"	English	United States	0.7
RT_BITMAP	0xbf254	0x72a24	Device independent bitmap graphic, 500 x 313 x 24, image size 469500, resolution 3780 x 3780 px/m			0.5924990416151978
RT_BITMAP	0x131c78	0x24833	PC bitmap, Windows 3.x format, 18938 x 2 x 34, image size 150155, cbSize 149555, bits offset 54			0.9972451606432416
RT_BITMAP	0x1564ac	0x17028	Device independent bitmap graphic, 736 x 32 x 32, image size 94208, resolution 3543 x 3543 px/m			0.4107248960190137
RT_BITMAP	0x16d4d4	0x23f28	Device independent bitmap graphic, 920 x 40 x 32, image size 147200, resolution 3503 x 3503 px/m			0.32856560717196415
RT_BITMAP	0x1913fc	0x192a	Device independent bitmap graphic, 40 x 40 x 32, image size 6402, resolution 2834 x 2834 px/m			0.4394597950946911
RT_BITMAP	0x192d28	0x65a6b	PC bitmap, Windows 3.x format, 52195 x 2 x 47, image size 416899, cbSize 416363, bits offset 54			0.999923143987338
RT_BITMAP	0x1f8794	0x5b78	Device independent bitmap graphic, 507 x 44 x 8, image size 22352	Chinese	Taiwan	0.3262726340963444
RT_BITMAP	0x1fe30c	0x5e4	Device independent bitmap graphic, 70 x 39 x 4, image size 1404	English	United States	0.34615384615384615
RT_BITMAP	0x1fe8f0	0xb8	Device independent bitmap graphic, 12 x 10 x 4, image size 80	English	United States	0.44565217391304346
RT_BITMAP	0x1fe9a8	0x16c	Device independent bitmap graphic, 39 x 13 x 4, image size 260	English	United States	0.28296703296703296
RT_BITMAP	0x1feb14	0x144	Device independent bitmap graphic, 33 x 11 x 4, image size 220	English	United States	0.37962962962962965
RT_ICON	0x1fec58	0xc5c0	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.7753239570164349
RT_ICON	0x20b218	0x13c3b	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.7638688160088938
RT_ICON	0x21ee54	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584			0.3600940494498994
RT_ICON	0x22f67c	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400			0.5614754098360656
RT_ICON	0x230004	0xca8	Device independent bitmap graphic, 32 x 64 x 24, image size 3200	Chinese	Taiwan	0.5231481481481481
RT_DIALOG	0x230cac	0x4d6	data	English	United States	0.4701130856219709
RT_DIALOG	0x231184	0xe4	data	Chinese	Taiwan	0.6622807017543859
RT_DIALOG	0x231268	0xe8	data	English	United States	0.6336206896551724
RT_STRING	0x231350	0x71a	data	Chinese	Taiwan	0.323982398239824
RT_STRING	0x231a6c	0x4e6	data	Chinese	Taiwan	0.38118022328548645
RT_STRING	0x231f54	0x2f6	data	Chinese	Taiwan	0.41688654353562005
RT_STRING	0x23224c	0x9a4	data	Chinese	Taiwan	0.27836304700162073
RT_STRING	0x232bf0	0x82	StarOffice Gallery theme p, 536899072 objects, 1st n	English	United States	0.7153846153846154
RT_STRING	0x232c74	0x2a	data	English	United States	0.5476190476190477
RT_STRING	0x232ca0	0x14a	data	English	United States	0.5060606060606061
RT_STRING	0x232dec	0x4e2	data	English	United States	0.376
RT_STRING	0x2332d0	0x2a2	data	English	United States	0.28338278931750743
RT_STRING	0x233574	0x2dc	data	English	United States	0.36885245901639346
RT_STRING	0x233850	0xac	data	English	United States	0.45348837209302323
RT_STRING	0x2338fc	0xde	data	English	United States	0.536036036036036
RT_STRING	0x2339dc	0x4c4	data	English	United States	0.3221311475409836
RT_STRING	0x233ea0	0x264	data	English	United States	0.3741830065359477
RT_STRING	0x234104	0x2c	data	English	United States	0.5227272727272727
RT_RCDATA	0x234130	0x3d45	data			0.39783232387631495
RT_RCDATA	0x237e78	0xbd22	PNG image data, 118 x 102, 8-bit/color RGBA, non-interlaced			0.44712710149118096
RT_GROUP_CURSOR	0x243b9c	0x22	Lotus unknown worksheet or configuration, revision 0x2	English	United States	1.0
RT_GROUP_ICON	0x243bc0	0x14	data	Chinese	Taiwan	1.15
RT_VERSION	0x243bd4	0x458	data	English	United States	0.427158273381295
RT_MANIFEST	0x24402c	0x277	XML 1.0 document, ASCII text, with CRLF line terminators	Chinese	Taiwan	0.5150554675118859

Imports

DLL	Import
VERSION.dll	GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA
COMCTL32.dll	_TrackMouseEvent, ImageList_Destroy, ImageList_Create, ImageList_LoadImageW, ImageList_Merge, ImageList_Read, ImageList_Write
KERNEL32.dll	DuplicateHandle, FlushFileBuffers, LockFile, UnlockFile, SetEndOfFile, MoveFileW, GetVolumeInformationW, GetFullPathNameW, GetStringTypeExW, GetThreadLocale, GetShortPathNameW, GetFileTime, LocalFileTimeToFileTime, SystemTimeToFileTime, SetFileTime, SetFileAttributesW, FileTimeToLocalFileTime, GetStartupInfoW, ExitProcess, RtlUnwind, GetLocalTime, RaiseException, HeapFree, HeapAlloc, SetConsoleCtrlHandler, CreateThread, ExitThread, GetTimeZoneInformation, GetSystemTime, HeapReAlloc, HeapSize, UnhandledExceptionFilter, FreeEnvironmentStringsA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetEnvironmentStrings, GetCommandLineA, SetHandleCount, GetFileType, SetErrorMode, GetModuleFileNameA, GetEnvironmentVariableA, HeapDestroy, HeapCreate, VirtualFree, FatalAppExitA, SetUnhandledExceptionFilter, VirtualAlloc, IsBadWritePtr, LCMapStringA, LCMapStringW, GetFileAttributesA, IsBadReadPtr, IsBadCodePtr, GetStringTypeA, GetStringTypeW, GetCPInfo, IsValidLocale, IsValidCodePage, GetLocaleInfoA, EnumSystemLocalesA, GetUserDefaultLCID, CompareStringA, CompareStringW, SetEnvironmentVariableW, GetExitCodeProcess, CreateProcessA, SetStdHandle, GetACP, GetOEMCP, SetEnvironmentVariableA, GetLocaleInfoW, GetCurrentProcessId, GetOverlappedResult, DeviceIoControl, CreateEventA, InterlockedExchange, QueryDosDeviceW, GetLogicalDriveStringsW, GetWindowsDirectoryW, QueryDosDeviceA, GetLogicalDriveStringsA, GetWindowsDirectoryA, OutputDebugStringW, CreateMailslotW, SleepEx, GetFullPathNameA, GetCurrentDirectoryA, FindResourceA, GlobalAddAtomA, GetProfileStringA, GlobalGetAtomNameW, WritePrivateProfileStringW, GetPrivateProfileStringW, GetPrivateProfileIntW, GetProcessVersion, TlsGetValue, LocalReAlloc, TlsSetValue, EnterCriticalSection, GlobalReAlloc, LeaveCriticalSection, TlsFree, GlobalHandle, DeleteCriticalSection, TlsAlloc, InitializeCriticalSection, LocalAlloc, GlobalFlags, lstrcmpiW, CreateEventW, SetThreadPriority, SetEvent, lstrcmpW, GlobalAlloc, lstrcmpA, lstrcmpiA, GetCurrentThread, lstrcpynW, MulDiv, SetLastError, FormatMessageW, LocalFree, GetDriveTypeA, InterlockedDecrement, InterlockedIncrement, LoadLibraryA, lstrlenA, GetVersion, lstrcatW, GetCurrentThreadId, GlobalAddAtomW, GlobalFindAtomW, GlobalDeleteAtom, lstrcpyW, GlobalLock, GlobalUnlock, GlobalFree, LockResource, TerminateProcess, MoveFileExW, SuspendThread, ResumeThread, CreateProcessW, GetVersionExW, WaitForSingleObject, GetCurrentProcess, Sleep, GetSystemDirectoryW, CopyFileW, FindResourceW, LoadResource, SizeofResource, GetTempPathW, CreateMutexW, GetCommandLineW, AllocConsole, SetConsoleTitleW, GetStdHandle, WriteConsoleW, ReadConsoleW, FreeConsole, GetCurrentDirectoryW, GetModuleHandleA, GetModuleHandleW, GetVersionExA, DeleteFileW, SetCurrentDirectoryW, FindFirstFileW, FindNextFileW, GetLastError, FindClose, GetFileAttributesW, CreateDirectoryW, lstrlenW, FileTimeToSystemTime, WideCharToMultiByte, GetUserDefaultLangID, MultiByteToWideChar, LoadLibraryW, GetProcAddress, FreeLibrary, GetTickCount, CreateFileW, ReadFile, SetFilePointer, GetFileSize, WriteFile, CloseHandle, GetModuleFileNameW, GetStartupInfoA
USER32.dll	IsDialogMessageW, SetWindowTextW, MoveWindow, ShowWindow, EnableMenuItem, CheckMenuItem, SetMenuItemBitmaps, ModifyMenuW, GetMenuState, LoadBitmapW, GetMenuCheckMarkDimensions, ClientToScreen, GetWindowDC, BeginPaint, EndPaint, TabbedTextOutW, DrawTextW, GrayStringW, ShowOwnedPopups, SetCursor, ValidateRect, TranslateMessage, GetMessageW, wvsprintfW, DestroyMenu, GetClassNameW, PtInRect, GetDesktopWindow, GetDialogBaseUnits, LoadCursorW, GetSysColorBrush, SetCapture, ReleaseCapture, WaitMessage, GetWindowThreadProcessId, WindowFromPoint, InsertMenuW, GetMenuStringW, SetRectEmpty, LoadAcceleratorsW, TranslateAcceleratorW, LoadMenuW, SetMenu, ReuseDDElParam, UnpackDDElParam, BringWindowToTop, CharUpperW, CheckRadioButton, CheckDlgButton, UpdateWindow, SendDlgItemMessageW, SendDlgItemMessageA, MapWindowPoints, PeekMessageW, DispatchMessageW, GetFocus, SetFocus, AdjustWindowRectEx, EqualRect, DeferWindowPos, BeginDeferWindowPos, EndDeferWindowPos, IsWindowVisible, ScrollWindow, GetScrollInfo, SetScrollInfo, ShowScrollBar, GetScrollRange, SetScrollRange, GetScrollPos, SetScrollPos, GetTopWindow, IsChild, GetCapture, ScrollWindowEx, GetClassInfoW, RegisterClassW, GetMenu, GetMenuItemCount, GetSubMenu, GetMenuItemID, TrackPopupMenu, SetWindowPlacement, GetWindowTextLengthW, GetWindowTextW, GetDlgCtrlID, GetKeyState, DefWindowProcW, CreateWindowExW, SetWindowsHookExW, CallNextHookEx, SetPropW, UnhookWindowsHookEx, GetPropW, CallWindowProcW, RemovePropW, GetMessageTime, GetMessagePos, GetLastActivePopup, GetForegroundWindow, SetForegroundWindow, GetWindow, SetWindowLongW, SetWindowPos, RegisterWindowMessageW, IntersectRect, SystemParametersInfoW, GetWindowPlacement, GetWindowRect, GetNextDlgTabItem, EndDialog, GetActiveWindow, SetActiveWindow, IsWindow, DestroyWindow, GetParent, GetWindowLongW, GetDlgItem, IsWindowEnabled, GetDC, GetSysColor, ReleaseDC, PostQuitMessage, PostMessageW, IsIconic, DrawIcon, UnregisterClassW, GetWindowTextLengthA, HideCaret, ShowCaret, ExcludeUpdateRgn, AppendMenuW, LoadIconW, ExitWindowsEx, wsprintfW, FindWindowExW, GetSystemMenu, DeleteMenu, LoadStringA, MessageBoxA, LoadStringW, MessageBoxW, GetClientRect, GetCursorPos, ScreenToClient, GetSystemMetrics, InvalidateRect, CopyRect, DrawEdge, DrawIconEx, InflateRect, IsDlgButtonChecked, SetDlgItemTextW, SetDlgItemInt, GetDlgItemTextW, WinHelpW, GetDlgItemInt, OffsetRect, FillRect, SendMessageW, RedrawWindow, EnableWindow, CreateDialogIndirectParamW, GetPropA, SetPropA, SetWindowLongA, GetClassNameA, IsWindowUnicode, SendMessageA, GetWindowLongA, SetWindowsHookExA, RemovePropA, CallWindowProcA, CharNextA, DefWindowProcA, DefDlgProcA, GetClassInfoA, DrawFocusRect, DrawTextA, GetWindowTextA
GDI32.dll	SetPolyFillMode, SetROP2, SetStretchBltMode, SetMapMode, SetViewportOrgEx, OffsetViewportOrgEx, SetViewportExtEx, ScaleViewportExtEx, SetWindowOrgEx, OffsetWindowOrgEx, SetWindowExtEx, ScaleWindowExtEx, SelectClipRgn, ExcludeClipRect, IntersectClipRect, OffsetClipRgn, MoveToEx, LineTo, SetTextAlign, SetTextJustification, SetTextCharacterExtra, SetMapperFlags, GetCurrentPositionEx, ArcTo, SetArcDirection, SetTextColor, PolylineTo, SetColorAdjustment, PolyBezierTo, DeleteObject, GetClipRgn, CreateRectRgn, SetBkMode, ExtSelectClipRgn, PlayMetaFileRecord, GetObjectType, EnumMetaFile, PlayMetaFile, GetDeviceCaps, GetViewportExtEx, GetWindowExtEx, CreatePen, ExtCreatePen, CreateSolidBrush, CreateHatchBrush, CreatePatternBrush, CreateDIBPatternBrushPt, PtVisible, RectVisible, TextOutW, ExtTextOutW, Escape, GetMapMode, PatBlt, SetRectRgn, CombineRgn, CreateRectRgnIndirect, CreateFontIndirectW, DPtoLP, GetTextMetricsW, ExtTextOutA, GetClipBox, GetDCOrgEx, CreateFontW, GetTextExtentPoint32W, SelectPalette, GetStockObject, SelectObject, RestoreDC, SaveDC, StartDocW, DeleteDC, CreateBitmap, GetObjectW, SelectClipPath, SetBkColor, GetTextExtentPointA, BitBlt, CreateCompatibleDC, PolyDraw, CreateDIBitmap, Rectangle
comdlg32.dll	GetFileTitleW
WINSPOOL.DRV	ClosePrinter, DocumentPropertiesW, OpenPrinterW
ADVAPI32.dll	ControlService, StartServiceW, OpenServiceW, DeleteService, CreateServiceW, OpenSCManagerW, CloseServiceHandle, RegDeleteKeyW, RegDeleteValueW, RegSetValueExW, RegOpenKeyExW, RegCreateKeyExW, OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, RegOpenKeyW, RegQueryValueExW, RegCloseKey, QueryServiceStatus
SHELL32.dll	DragQueryFileW, DragFinish, DragAcceptFiles, ShellExecuteW, SHGetFileInfoW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Chinese	Taiwan

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 11:33:28.587897062 CET	49817	30203	192.168.2.6	181.71.216.203
Jan 10, 2025 11:33:28.592784882 CET	30203	49817	181.71.216.203	192.168.2.6
Jan 10, 2025 11:33:28.592884064 CET	49817	30203	192.168.2.6	181.71.216.203
Jan 10, 2025 11:33:28.631722927 CET	49817	30203	192.168.2.6	181.71.216.203
Jan 10, 2025 11:33:28.637058020 CET	30203	49817	181.71.216.203	192.168.2.6
Jan 10, 2025 11:33:28.637134075 CET	49817	30203	192.168.2.6	181.71.216.203
Jan 10, 2025 11:33:28.641964912 CET	30203	49817	181.71.216.203	192.168.2.6
Jan 10, 2025 11:33:49.953682899 CET	30203	49817	181.71.216.203	192.168.2.6
Jan 10, 2025 11:33:49.953824043 CET	49817	30203	192.168.2.6	181.71.216.203
Jan 10, 2025 11:33:49.959404945 CET	49817	30203	192.168.2.6	181.71.216.203
Jan 10, 2025 11:33:49.964245081 CET	30203	49817	181.71.216.203	192.168.2.6
Jan 10, 2025 11:33:50.076699018 CET	49951	30203	192.168.2.6	181.71.216.203
Jan 10, 2025 11:33:50.081834078 CET	30203	49951	181.71.216.203	192.168.2.6
Jan 10, 2025 11:33:50.081979990 CET	49951	30203	192.168.2.6	181.71.216.203
Jan 10, 2025 11:33:50.082767010 CET	49951	30203	192.168.2.6	181.71.216.203
Jan 10, 2025 11:33:50.087538004 CET	30203	49951	181.71.216.203	192.168.2.6
Jan 10, 2025 11:33:50.087673903 CET	49951	30203	192.168.2.6	181.71.216.203
Jan 10, 2025 11:33:50.092606068 CET	30203	49951	181.71.216.203	192.168.2.6
Jan 10, 2025 11:34:11.453757048 CET	30203	49951	181.71.216.203	192.168.2.6
Jan 10, 2025 11:34:11.454071999 CET	49951	30203	192.168.2.6	181.71.216.203
Jan 10, 2025 11:34:11.454071999 CET	49951	30203	192.168.2.6	181.71.216.203
Jan 10, 2025 11:34:11.458904028 CET	30203	49951	181.71.216.203	192.168.2.6
Jan 10, 2025 11:34:11.562002897 CET	49987	30203	192.168.2.6	181.71.216.203
Jan 10, 2025 11:34:11.566914082 CET	30203	49987	181.71.216.203	192.168.2.6
Jan 10, 2025 11:34:11.567023039 CET	49987	30203	192.168.2.6	181.71.216.203
Jan 10, 2025 11:34:11.567692995 CET	49987	30203	192.168.2.6	181.71.216.203
Jan 10, 2025 11:34:11.572510004 CET	30203	49987	181.71.216.203	192.168.2.6
Jan 10, 2025 11:34:11.572568893 CET	49987	30203	192.168.2.6	181.71.216.203
Jan 10, 2025 11:34:11.577445984 CET	30203	49987	181.71.216.203	192.168.2.6
Jan 10, 2025 11:34:32.971894026 CET	30203	49987	181.71.216.203	192.168.2.6
Jan 10, 2025 11:34:32.972002983 CET	49987	30203	192.168.2.6	181.71.216.203
Jan 10, 2025 11:34:32.972198963 CET	49987	30203	192.168.2.6	181.71.216.203
Jan 10, 2025 11:34:32.977021933 CET	30203	49987	181.71.216.203	192.168.2.6
Jan 10, 2025 11:34:33.076603889 CET	49988	30203	192.168.2.6	181.71.216.203
Jan 10, 2025 11:34:33.081552029 CET	30203	49988	181.71.216.203	192.168.2.6
Jan 10, 2025 11:34:33.081667900 CET	49988	30203	192.168.2.6	181.71.216.203
Jan 10, 2025 11:34:33.082391977 CET	49988	30203	192.168.2.6	181.71.216.203
Jan 10, 2025 11:34:33.087193966 CET	30203	49988	181.71.216.203	192.168.2.6
Jan 10, 2025 11:34:33.087271929 CET	49988	30203	192.168.2.6	181.71.216.203
Jan 10, 2025 11:34:33.092147112 CET	30203	49988	181.71.216.203	192.168.2.6
Jan 10, 2025 11:34:54.435363054 CET	30203	49988	181.71.216.203	192.168.2.6
Jan 10, 2025 11:34:54.435445070 CET	49988	30203	192.168.2.6	181.71.216.203
Jan 10, 2025 11:34:54.435607910 CET	49988	30203	192.168.2.6	181.71.216.203
Jan 10, 2025 11:34:54.440437078 CET	30203	49988	181.71.216.203	192.168.2.6
Jan 10, 2025 11:34:54.545417070 CET	49990	30203	192.168.2.6	181.71.216.203
Jan 10, 2025 11:34:54.550421953 CET	30203	49990	181.71.216.203	192.168.2.6
Jan 10, 2025 11:34:54.550529957 CET	49990	30203	192.168.2.6	181.71.216.203
Jan 10, 2025 11:34:54.551207066 CET	49990	30203	192.168.2.6	181.71.216.203
Jan 10, 2025 11:34:54.555988073 CET	30203	49990	181.71.216.203	192.168.2.6
Jan 10, 2025 11:34:54.556051016 CET	49990	30203	192.168.2.6	181.71.216.203
Jan 10, 2025 11:34:54.560838938 CET	30203	49990	181.71.216.203	192.168.2.6
Jan 10, 2025 11:35:11.967017889 CET	49990	30203	192.168.2.6	181.71.216.203
Jan 10, 2025 11:35:11.971827984 CET	30203	49990	181.71.216.203	192.168.2.6
Jan 10, 2025 11:35:11.971883059 CET	49990	30203	192.168.2.6	181.71.216.203
Jan 10, 2025 11:35:11.976613998 CET	30203	49990	181.71.216.203	192.168.2.6
Jan 10, 2025 11:35:15.941442013 CET	30203	49990	181.71.216.203	192.168.2.6
Jan 10, 2025 11:35:15.942500114 CET	49990	30203	192.168.2.6	181.71.216.203

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 11:33:28.570249081 CET	60954	53	192.168.2.6	1.1.1.1
Jan 10, 2025 11:33:28.585185051 CET	53	60954	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 11:33:28.570249081 CET	192.168.2.6	1.1.1.1	0x2faa	Standard query (0)	newstaticfreepoint24.ddns-ip.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 11:33:28.585185051 CET	1.1.1.1	192.168.2.6	0x2faa	No error (0)	newstaticfreepoint24.ddns-ip.net		181.71.216.203	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	05:33:03
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\AdobePremierPDF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\AdobePremierPDF.exe"
Imagebase:	0x400000
File size:	2'359'377 bytes
MD5 hash:	EDD9264F6C649D84D19E31600D529C7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:33:24
Start date:	10/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Imagebase:	0x640000
File size:	2'141'552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000004.00000002.3412543552.0000000007FE3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000004.00000002.3412954894.00000000096D0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000004.00000002.3412038687.0000000006E41000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	19.4%
Dynamic/Decrypted Code Coverage:	98.9%
Signature Coverage:	33.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	290

Executed Functions

Function 007CE4CD Relevance: 37.3, APIs: 2, Strings: 19, Instructions: 557
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

S, xrefs: 007D79F6
[P, xrefs: 007D9B97
a, xrefs: 007D9475
c, xrefs: 007D94A6
r, xrefs: 007D9460
e, xrefs: 007D949F
l, xrefs: 007D947C
t, xrefs: 007D94AD
t, xrefs: 007D9467
o, xrefs: 007D9491
V, xrefs: 007D9452
t, xrefs: 007D9498
u, xrefs: 007D946E
i, xrefs: 007D9459
uAS, xrefs: 007D7FBD
x, xrefs: 007D94BB
E, xrefs: 007D94B4
r, xrefs: 007D948A
P, xrefs: 007D9483

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID: E$P$S$V$[P$a$c$e$i$l$o$r$r$t$t$t$u$uAS$x
API String ID: 0-2291926689
Opcode ID: 5f4ed30d627f8b0d2f52b33933b1d6bb3654d89f3157e3b42f069cbb76288cb0
Instruction ID: a046ea38986020398e8f05add9d8e1127dd7c6efa5c4844d9daff6eac72eae27
Opcode Fuzzy Hash: 5f4ed30d627f8b0d2f52b33933b1d6bb3654d89f3157e3b42f069cbb76288cb0
Instruction Fuzzy Hash: 521244B2C081A49AF7208A24DC55BEB7778EF50310F1441FBD94DA7281E67E5EC5CBA2

Function 022F2D00 Relevance: 12.7, APIs: 1, Strings: 7, Instructions: 748
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Q, xrefs: 022F4A96
S, xrefs: 022F4AD7
DOC5, xrefs: 022F4A9F
CI3K, xrefs: 022F2B90
ZQ, xrefs: 022F4A69
XP, xrefs: 022F2F8D
E5C2, xrefs: 022F3EA2

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID: CI3K$DOC5$E5C2$Q$S$XP$ZQ
API String ID: 0-208818573
Opcode ID: 6be1a287c9a9694caaec2805c1d29dc9a07228e9ed3c7f8c4fd2d4586ede5f37
Instruction ID: a3362b5267aa2264e3327bd938e7e38ddc8f7dccf73ca40cb80ff8cf9898eb3f
Opcode Fuzzy Hash: 6be1a287c9a9694caaec2805c1d29dc9a07228e9ed3c7f8c4fd2d4586ede5f37
Instruction Fuzzy Hash: 604235B2D242649BF7608A64DC45BEBB779EF80310F0441FAD90E97284E6795EC2CF52

Function 022F3250 Relevance: 11.2, APIs: 1, Strings: 6, Instructions: 708memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,39335C83,00003000,00000004), ref: 022F47C6

Strings

Q, xrefs: 022F4A96
S, xrefs: 022F4AD7
XR, xrefs: 022F3C75
DOC5, xrefs: 022F4A9F
^P, xrefs: 022F37F8
ZQ, xrefs: 022F4A69

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID: DOC5$Q$S$XR$ZQ$^P
API String ID: 4275171209-3485048140
Opcode ID: 5f9536722340e82e03e60f79ee2e0d8d02e31f3ddb50c26fbe815f8708e70499
Instruction ID: a5dd76a3929134c70c42e3d3c4267f166db61df3d99550aeb354d9603862e258
Opcode Fuzzy Hash: 5f9536722340e82e03e60f79ee2e0d8d02e31f3ddb50c26fbe815f8708e70499
Instruction Fuzzy Hash: 0E52ECB1D146689BEB64CB64DC44AEAB7B5EF84300F0481FAD90EA6284E7794EC1CF51

Function 022F410D Relevance: 9.4, APIs: 1, Strings: 5, Instructions: 399
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,39335C83,00003000,00000004), ref: 022F47C6

Strings

Q, xrefs: 022F4A96
S, xrefs: 022F4AD7
DOC5, xrefs: 022F4A9F
ZQ, xrefs: 022F4A69
E5C2, xrefs: 022F3EA2

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID: DOC5$E5C2$Q$S$ZQ
API String ID: 4275171209-299410507
Opcode ID: c2a7967cbd3cbf25a21e19c3be21ea8ca70e3bc63fe32de5436ffcd89e107ca1
Instruction ID: 964591f8e1eeb38a4d40d44a12f42e3378c59d3e5f5616bcf676312dd975d6de
Opcode Fuzzy Hash: c2a7967cbd3cbf25a21e19c3be21ea8ca70e3bc63fe32de5436ffcd89e107ca1
Instruction Fuzzy Hash: B8E1E2B1D146689BE7208A65DC40BEBB775EF90310F0481FAD90EA7244E6B95FC2CF52

Function 022F313F Relevance: 9.4, APIs: 1, Strings: 5, Instructions: 370
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Q, xrefs: 022F4A96
S, xrefs: 022F4AD7
DOC5, xrefs: 022F4A9F
ZQ, xrefs: 022F4A69
LXSV, xrefs: 022F3143

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID: DOC5$LXSV$Q$S$ZQ
API String ID: 4275171209-268723413
Opcode ID: a262bab881dd2495829f08a9716f42720456510e6bb6df119fe65e743a6d87a9
Instruction ID: db7becc7071e683c4f385b8a00631334ddef20ce14383fcf161a918332d40003
Opcode Fuzzy Hash: a262bab881dd2495829f08a9716f42720456510e6bb6df119fe65e743a6d87a9
Instruction Fuzzy Hash: 53E1F2B1D146A88AEB64CB64DC40BEAB7B5EF94310F0081FAD90EA7244E6795FC1CF51

Function 022F3225 Relevance: 9.3, APIs: 1, Strings: 5, Instructions: 312
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Q, xrefs: 022F4A96
2;CL, xrefs: 022F3225
S, xrefs: 022F4AD7
DOC5, xrefs: 022F4A9F
ZQ, xrefs: 022F4A69

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID: 2;CL$DOC5$Q$S$ZQ
API String ID: 4275171209-2836532202
Opcode ID: ef8c837b10b3c647b76dab32423cac29cec1c705170eef33f5cc6495fb604346
Instruction ID: 31486c6781c4a526c82d46e3849e615228f9fb06aad09cc5f756e74b498a7fc9
Opcode Fuzzy Hash: ef8c837b10b3c647b76dab32423cac29cec1c705170eef33f5cc6495fb604346
Instruction Fuzzy Hash: 57C1E2B1D146698AEB24CB64DC407EAB7B1EF90311F0081FAD90EAB244E6795EC2CF11

Function 004124FE Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 349
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(00000041,00412EA5,00412DEF,?,?,?,00412DEF,00000000,?,?,?,00412DD9,?,?), ref: 00413418

Strings

395H, xrefs: 0041296F
[S, xrefs: 00412E9E
ZS, xrefs: 0041343B
V, xrefs: 004129E0

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: LibraryLoad
String ID: 395H$V$ZS$[S
API String ID: 1029625771-4065051033
Opcode ID: 94e18b31f9deb449820ce286e50ff369828215d5aa2f3491a19e802d3cf54644
Instruction ID: e15d402f056ee2d8dd4aea31979c365d172ede672f1c4593d73aa794aac2e45b
Opcode Fuzzy Hash: 94e18b31f9deb449820ce286e50ff369828215d5aa2f3491a19e802d3cf54644
Instruction Fuzzy Hash: 34B198F2D042545FF3108A24ED95BFB7B78EB81314F0441BBE84E96282D27D9AD6CA53

Function 00412946 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 254
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

395H, xrefs: 0041296F
[S, xrefs: 00412E9E
ZS, xrefs: 0041343B
V, xrefs: 004129E0

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID: 395H$V$ZS$[S
API String ID: 0-4065051033
Opcode ID: 50db38b1c724621f21e7b561f2bd7e655ba0421fc665546c8c95d0fcabd62055
Instruction ID: 050e64e0c28e7d4db0871313c19d9f9a556a401e1906b78e9d4c0e5764840dab
Opcode Fuzzy Hash: 50db38b1c724621f21e7b561f2bd7e655ba0421fc665546c8c95d0fcabd62055
Instruction Fuzzy Hash: 9481CBF3D082845FF3218A25ED95AEB3B68EBC1314F0501BBE84D86582D27D5AD7CA53

Function 022F3CB6 Relevance: 7.9, APIs: 1, Strings: 4, Instructions: 406
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Q, xrefs: 022F4A96
S, xrefs: 022F4AD7
DOC5, xrefs: 022F4A9F
ZQ, xrefs: 022F4A69

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID: DOC5$Q$S$ZQ
API String ID: 0-721714928
Opcode ID: 741807f277feaa8296a96419fd0d117cf38e42d78601fe18ed763946722a990a
Instruction ID: 972f4337f53ed248786504288ea6d99b77cc059f1ae476b9869883b56a970b98
Opcode Fuzzy Hash: 741807f277feaa8296a96419fd0d117cf38e42d78601fe18ed763946722a990a
Instruction Fuzzy Hash: B4E123B2D146689BE7208A65DC44BEBB775EF90310F0481FAD90E97244E6B85FC2CF52

Function 022F3CC4 Relevance: 7.9, APIs: 1, Strings: 4, Instructions: 404
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Q, xrefs: 022F4A96
S, xrefs: 022F4AD7
DOC5, xrefs: 022F4A9F
ZQ, xrefs: 022F4A69

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID: DOC5$Q$S$ZQ
API String ID: 0-721714928
Opcode ID: 0da33ee1645e8d27fc2401df9bdc3a2620ff4ec00a2d6c8eb35373802b9db91f
Instruction ID: 8831c5eaedade85b2ac7491c271e4065905ea38026eca9c79aa8c79e85a90fa3
Opcode Fuzzy Hash: 0da33ee1645e8d27fc2401df9bdc3a2620ff4ec00a2d6c8eb35373802b9db91f
Instruction Fuzzy Hash: B7E124B2D146689BE7208A65DC44BEBB775EF90310F0481FAD90E97244E6B85FC2CF52

Function 022F30F4 Relevance: 7.9, APIs: 1, Strings: 4, Instructions: 388
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Q, xrefs: 022F4A96
S, xrefs: 022F4AD7
DOC5, xrefs: 022F4A9F
ZQ, xrefs: 022F4A69

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID: DOC5$Q$S$ZQ
API String ID: 4275171209-721714928
Opcode ID: 36e1f6a5db9b950ea524ff1148b9f9b5ad88f1944270a0c66db12b2127a5bfa9
Instruction ID: 7e42efafc2abf7064553141f2a3d71970b9312d2129795de64d17a84bd7fec37
Opcode Fuzzy Hash: 36e1f6a5db9b950ea524ff1148b9f9b5ad88f1944270a0c66db12b2127a5bfa9
Instruction Fuzzy Hash: 94E1E0B1D146688AEB64CB64DC40BEAB7B5FF94300F0481FAD90EA6244E6795FC2CF51

Function 022F4027 Relevance: 7.9, APIs: 1, Strings: 4, Instructions: 364
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,39335C83,00003000,00000004), ref: 022F47C6

Strings

Q, xrefs: 022F4A96
S, xrefs: 022F4AD7
DOC5, xrefs: 022F4A9F
ZQ, xrefs: 022F4A69

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID: DOC5$Q$S$ZQ
API String ID: 4275171209-721714928
Opcode ID: 8305eb1cebfdf755d67b5b201424b0d00101f700a45984a335fb4fe9003d2cbe
Instruction ID: a67bcb35c57bd0f1a6e323ea4817604c8822f3199dec50e8358224b5e6bcf31f
Opcode Fuzzy Hash: 8305eb1cebfdf755d67b5b201424b0d00101f700a45984a335fb4fe9003d2cbe
Instruction Fuzzy Hash: F6E1E3B1D146688BE7209B55DC40BEBB7B5EF94314F0081FADA0EA7244E6B95EC2CF11

Function 022F404A Relevance: 7.9, APIs: 1, Strings: 4, Instructions: 355
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,39335C83,00003000,00000004), ref: 022F47C6

Strings

Q, xrefs: 022F4A96
S, xrefs: 022F4AD7
DOC5, xrefs: 022F4A9F
ZQ, xrefs: 022F4A69

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID: DOC5$Q$S$ZQ
API String ID: 4275171209-721714928
Opcode ID: ee76ab8bae80579f799c1025813b631eda07c8fd2c62fdf94f136dbdfb302c4e
Instruction ID: 2e44699b9def3b3903b7acb39fd4bff40b6dc3d53aaf073d81a4e03df945d294
Opcode Fuzzy Hash: ee76ab8bae80579f799c1025813b631eda07c8fd2c62fdf94f136dbdfb302c4e
Instruction Fuzzy Hash: 16D1E3B1D146689BE7209B55DC40BEAB775EF90310F0081FADA0EA7244E6B95FC2CF11

Function 022F3D84 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 349
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Q, xrefs: 022F4A96
S, xrefs: 022F4AD7
DOC5, xrefs: 022F4A9F
ZQ, xrefs: 022F4A69

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID: DOC5$Q$S$ZQ
API String ID: 0-721714928
Opcode ID: cea7de2d97bd001fad8b5ee93a98fb246737132336ed7677c2db23edfc5c96b1
Instruction ID: a23392bad15cbb89280dc12dfc863ea46cbe8727e83298dc69a75b1c26e35b5b
Opcode Fuzzy Hash: cea7de2d97bd001fad8b5ee93a98fb246737132336ed7677c2db23edfc5c96b1
Instruction Fuzzy Hash: 18D1E2B1D146689BE7208A65DC44BEBB775EF90310F0481FAD90EA7244E6B95FC2CF12

Function 022F3DA5 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 342
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Q, xrefs: 022F4A96
S, xrefs: 022F4AD7
DOC5, xrefs: 022F4A9F
ZQ, xrefs: 022F4A69

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID: DOC5$Q$S$ZQ
API String ID: 4275171209-721714928
Opcode ID: df96c4e1c845c97dfae5ae970713da3cf8b02ffd9c3a39c2eb8835bab3da72fb
Instruction ID: 1d0ba4851271e7c60fc14964aa3697537b20a1f731e9c19f9fe7bb1fcf53062f
Opcode Fuzzy Hash: df96c4e1c845c97dfae5ae970713da3cf8b02ffd9c3a39c2eb8835bab3da72fb
Instruction Fuzzy Hash: 11D102B1D146689BE7209A65DC44BEBB775EF90310F0080FAD90EA7244E6B95FC2CF12

Function 022F40AC Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 338
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Q, xrefs: 022F4A96
S, xrefs: 022F4AD7
DOC5, xrefs: 022F4A9F
ZQ, xrefs: 022F4A69

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID: DOC5$Q$S$ZQ
API String ID: 4275171209-721714928
Opcode ID: 1a4f863880cd916a8d79adf2df8511c11e2d6ddd6260fa3e4a80d265cc92d07d
Instruction ID: 2be76c00ed039e574509e89ac71afb6dc93062dc2bc03843c12def2126440f40
Opcode Fuzzy Hash: 1a4f863880cd916a8d79adf2df8511c11e2d6ddd6260fa3e4a80d265cc92d07d
Instruction Fuzzy Hash: A4D1F2B1D146688BE7209A55DC40BEBB775EF90310F0480FADA0EA7244E6B95FC2CF52

Function 022F31CD Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 337COMMON

Download Yara Rule

Strings

Q, xrefs: 022F4A96
S, xrefs: 022F4AD7
DOC5, xrefs: 022F4A9F
ZQ, xrefs: 022F4A69

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID: DOC5$Q$S$ZQ
API String ID: 4275171209-721714928
Opcode ID: 7f28eb49d9a35a6842d09c969c762bb66900bd3be3038f2adc3fa9bfd2cac400
Instruction ID: 3a3a91bc39fbe7ceaf7eaada28ed4db34dc7863f4a608f71a7fc7e67cd9acaf8
Opcode Fuzzy Hash: 7f28eb49d9a35a6842d09c969c762bb66900bd3be3038f2adc3fa9bfd2cac400
Instruction Fuzzy Hash: BAD1F2B1D146A98AEB20CB64DC40BEAB7B1EF94310F0081FAD90EA7244E6795EC1CF51

Function 022F3DB5 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 335COMMON

Download Yara Rule

Strings

Q, xrefs: 022F4A96
S, xrefs: 022F4AD7
DOC5, xrefs: 022F4A9F
ZQ, xrefs: 022F4A69

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID: DOC5$Q$S$ZQ
API String ID: 4275171209-721714928
Opcode ID: 797e46ac8687c3dcd47db9d65b56fcc32df80ef770b3f325dd453cbb5e5054d1
Instruction ID: 42c174bf0fa4aa1bda40eb11cc333207c5d66003eed236608e6de7cfabc6e527
Opcode Fuzzy Hash: 797e46ac8687c3dcd47db9d65b56fcc32df80ef770b3f325dd453cbb5e5054d1
Instruction Fuzzy Hash: 46D1F2B1D146689BE7209A65DC40BEBB775EF90310F0081FAD90EA7244E6B95FC2CF12

Function 022F40BB Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 333COMMON

Download Yara Rule

Strings

Q, xrefs: 022F4A96
S, xrefs: 022F4AD7
DOC5, xrefs: 022F4A9F
ZQ, xrefs: 022F4A69

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID: DOC5$Q$S$ZQ
API String ID: 4275171209-721714928
Opcode ID: 0e3499365d8d5a5d6dfb3150d38ab295b63f353bbece45975eef6366f11051a3
Instruction ID: 77bc6ac19a059a08f4ae510658c75e373464cce465ec3d3684d52067a850a9df
Opcode Fuzzy Hash: 0e3499365d8d5a5d6dfb3150d38ab295b63f353bbece45975eef6366f11051a3
Instruction Fuzzy Hash: 75D1E2B1D146689BE7209B65DC40BEAB775EF90310F0480FAD90EA7244E6B95FC2CF51

Function 022F40D6 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 328COMMON

Download Yara Rule

Strings

Q, xrefs: 022F4A96
S, xrefs: 022F4AD7
DOC5, xrefs: 022F4A9F
ZQ, xrefs: 022F4A69

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID: DOC5$Q$S$ZQ
API String ID: 4275171209-721714928
Opcode ID: 41accec367539d0ddc904c1573c22b8b3d54bf6971bdd456ed8505ae0eb49651
Instruction ID: 55b31771527de6175d082e4bdfc835998566718e210a9907a273b2ba0c82ef3b
Opcode Fuzzy Hash: 41accec367539d0ddc904c1573c22b8b3d54bf6971bdd456ed8505ae0eb49651
Instruction Fuzzy Hash: 85C1E2B1D146689BE7209B65DC40BEAB7B5EF90310F0481FAD90EA7244E6B95FC2CF11

Function 022F41A6 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 311COMMON

Download Yara Rule

Strings

Q, xrefs: 022F4A96
S, xrefs: 022F4AD7
DOC5, xrefs: 022F4A9F
ZQ, xrefs: 022F4A69

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID: DOC5$Q$S$ZQ
API String ID: 4275171209-721714928
Opcode ID: a21c701485673481db78de396f3742ee786ec5e03f26e9bc121687c4d0c617ba
Instruction ID: 62a776b93e1b9be761f393b332fd22f829efe8e09a90c5c4be9f83fb9b05f954
Opcode Fuzzy Hash: a21c701485673481db78de396f3742ee786ec5e03f26e9bc121687c4d0c617ba
Instruction Fuzzy Hash: A0C1C2B5D146688BE7209B65DC40BEAB7B5EF94310F0081FAD90EA7244E6B95EC2CF11

Function 022F305A Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 301COMMON

Download Yara Rule

Strings

Q, xrefs: 022F4A96
S, xrefs: 022F4AD7
DOC5, xrefs: 022F4A9F
ZQ, xrefs: 022F4A69

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID: DOC5$Q$S$ZQ
API String ID: 4275171209-721714928
Opcode ID: 1563f6bbbaa0f0b66abe210a2e862a76367c3acea211b9f426b73d29dbf079a1
Instruction ID: c7be70fb9b2754a233d1e7618e37ed63f432b2eb662ec1825b847fe152e308e8
Opcode Fuzzy Hash: 1563f6bbbaa0f0b66abe210a2e862a76367c3acea211b9f426b73d29dbf079a1
Instruction Fuzzy Hash: 42C1E2B1D146698BEB20CB64DC40BEAB7B5EF90311F0481FAD90EA7244E6795EC2CF11

Function 022F323B Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 300COMMON

Download Yara Rule

Strings

Q, xrefs: 022F4A96
S, xrefs: 022F4AD7
DOC5, xrefs: 022F4A9F
ZQ, xrefs: 022F4A69

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID: DOC5$Q$S$ZQ
API String ID: 4275171209-721714928
Opcode ID: 5bfea6dd71aceb26128aa9cfdae0e76fd567ae5252fab8269cf4e1680d67f7c5
Instruction ID: 5c8c80ea34614fcb9f4cd899c51f3d65cd6a333935f804e62a88ce9bcacece0b
Opcode Fuzzy Hash: 5bfea6dd71aceb26128aa9cfdae0e76fd567ae5252fab8269cf4e1680d67f7c5
Instruction Fuzzy Hash: 10C1D1B1D146698AEB24CB64DC407EAB7B1EF94311F0481FAD90EAB244E6795FC2CF11

Function 022F41DA Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 298COMMON

Download Yara Rule

Strings

Q, xrefs: 022F4A96
S, xrefs: 022F4AD7
DOC5, xrefs: 022F4A9F
ZQ, xrefs: 022F4A69

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID: DOC5$Q$S$ZQ
API String ID: 4275171209-721714928
Opcode ID: d5d9a1f7ca4d0ded883ca917d43ba7c6bccecf74b63612d0e150eda2ae2d0ba9
Instruction ID: f4f77b32d20568600133f87cdef1ce88734750fbfaf22bd7ca7e705927112c88
Opcode Fuzzy Hash: d5d9a1f7ca4d0ded883ca917d43ba7c6bccecf74b63612d0e150eda2ae2d0ba9
Instruction Fuzzy Hash: 22C1D2B5D146688BEB20DB65DC407EAB7B5EF94310F0081FAD90EA7244E6B95EC2CF11

Function 022F337C Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 289memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,39335C83,00003000,00000004), ref: 022F47C6

Strings

Q, xrefs: 022F4A96
S, xrefs: 022F4AD7
DOC5, xrefs: 022F4A9F
ZQ, xrefs: 022F4A69

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID: DOC5$Q$S$ZQ
API String ID: 4275171209-721714928
Opcode ID: df5af348fde14423ff23eae476af85f491ec3ac9c08361a2cff1cf38622c26ef
Instruction ID: 7601865ae22211a364ea88c9bfac261f11836b2fceabb590f23db9c5455a298d
Opcode Fuzzy Hash: df5af348fde14423ff23eae476af85f491ec3ac9c08361a2cff1cf38622c26ef
Instruction Fuzzy Hash: 3AC1D2B1D146698BEB24CB64DC407EAB6B1EF90300F0481FAD90EA7285E7795AC6CF11

Function 022F3375 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 288memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,39335C83,00003000,00000004), ref: 022F47C6

Strings

Q, xrefs: 022F4A96
S, xrefs: 022F4AD7
DOC5, xrefs: 022F4A9F
ZQ, xrefs: 022F4A69

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID: DOC5$Q$S$ZQ
API String ID: 4275171209-721714928
Opcode ID: 072ae9843478f2cdbc103d1655572b5d45c4f9b6dbb44fef28bb782dec9ee961
Instruction ID: 23debcc9b069ae71350bfaa819365667b83285504fa1206181b65f336e7b766e
Opcode Fuzzy Hash: 072ae9843478f2cdbc103d1655572b5d45c4f9b6dbb44fef28bb782dec9ee961
Instruction Fuzzy Hash: F2B1DFB1D146698AEB24CB64DC40BEAB6B1EF90311F0481FAD90EA7284E6795FC1CF51

Function 022F3312 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 283memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,39335C83,00003000,00000004), ref: 022F47C6

Strings

Q, xrefs: 022F4A96
S, xrefs: 022F4AD7
DOC5, xrefs: 022F4A9F
ZQ, xrefs: 022F4A69

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID: DOC5$Q$S$ZQ
API String ID: 4275171209-721714928
Opcode ID: 9dced1328c8133919b9f9282a44231f4348c321ac7e25c8bcf59a931753f4e6f
Instruction ID: a8a6305f2c14b34f8717f74a8d3d0b9489154e71495245612248833adfc56205
Opcode Fuzzy Hash: 9dced1328c8133919b9f9282a44231f4348c321ac7e25c8bcf59a931753f4e6f
Instruction Fuzzy Hash: 21B1E2B1D146698BEB20CB64DC40BEAB6B5EF94311F0481FAD90EA7244E6795FC2CF11

Function 022F4226 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 277memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,39335C83,00003000,00000004), ref: 022F47C6

Strings

Q, xrefs: 022F4A96
S, xrefs: 022F4AD7
DOC5, xrefs: 022F4A9F
ZQ, xrefs: 022F4A69

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID: DOC5$Q$S$ZQ
API String ID: 4275171209-721714928
Opcode ID: a476c80519ef0c3a47c5d57cb05a3f9bc49de83bca8f020f7c79c02e1eff65e3
Instruction ID: 23dfa4357fff0b6ee9648a810cdae2ee1ed0d0b725933e4a794ef2f01eb60ddd
Opcode Fuzzy Hash: a476c80519ef0c3a47c5d57cb05a3f9bc49de83bca8f020f7c79c02e1eff65e3
Instruction Fuzzy Hash: A0B1C0B1D146688BEB24DB64DC40BEAB7B5EF94310F0481FAD90EA7244E6B95EC1CF11

Function 022F436D Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 276memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,39335C83,00003000,00000004), ref: 022F47C6

Strings

Q, xrefs: 022F4A96
S, xrefs: 022F4AD7
DOC5, xrefs: 022F4A9F
ZQ, xrefs: 022F4A69

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID: DOC5$Q$S$ZQ
API String ID: 4275171209-721714928
Opcode ID: 4e384bb2e88aa6ccc65cc83a68bae764b6a08b34be711c85ac83f5d420281a41
Instruction ID: a0ebb2ee656d1763f4b4a770fc8a2884e10a1b07d61004db76485963fb4697a8
Opcode Fuzzy Hash: 4e384bb2e88aa6ccc65cc83a68bae764b6a08b34be711c85ac83f5d420281a41
Instruction Fuzzy Hash: DFB1C0B5D146688BEB24DB64DC407EAB6B1EF94300F0481FAD90EAB344E6795EC2CF11

Function 022F4231 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 272memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,39335C83,00003000,00000004), ref: 022F47C6

Strings

Q, xrefs: 022F4A96
S, xrefs: 022F4AD7
DOC5, xrefs: 022F4A9F
ZQ, xrefs: 022F4A69

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID: DOC5$Q$S$ZQ
API String ID: 4275171209-721714928
Opcode ID: ee485f10c7da7ee8e473fd3ad41741923ccd611c09e3f6ad8fc27c862e800402
Instruction ID: 63e522c9839f7dd87d99e14b3a12a1f4689d3868112c9dda258d2eaf5f3becd7
Opcode Fuzzy Hash: ee485f10c7da7ee8e473fd3ad41741923ccd611c09e3f6ad8fc27c862e800402
Instruction Fuzzy Hash: 67B1C1B1D146688BEB24DB64DC407EAB6B1EF94311F0481FAD90EA7244E6795FC2CF11

Function 022F3334 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 272memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,39335C83,00003000,00000004), ref: 022F47C6

Strings

Q, xrefs: 022F4A96
S, xrefs: 022F4AD7
DOC5, xrefs: 022F4A9F
ZQ, xrefs: 022F4A69

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID: DOC5$Q$S$ZQ
API String ID: 4275171209-721714928
Opcode ID: dd0853e64b4bed4ee2a8f3b2531539f6b8a71d8c8b0f6890f199fce67583c7eb
Instruction ID: 18f8a1e836982e52cccc92a9ccefa9729a31c54c1eadf6c31859d6086c649d3c
Opcode Fuzzy Hash: dd0853e64b4bed4ee2a8f3b2531539f6b8a71d8c8b0f6890f199fce67583c7eb
Instruction Fuzzy Hash: A7B1D0B5D146698BEB24CB64DC407EAB6B1EF94301F0481FAD90EA7244E6795FC2CF11

Function 022F439E Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 267memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,39335C83,00003000,00000004), ref: 022F47C6

Strings

Q, xrefs: 022F4A96
S, xrefs: 022F4AD7
DOC5, xrefs: 022F4A9F
ZQ, xrefs: 022F4A69

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID: DOC5$Q$S$ZQ
API String ID: 4275171209-721714928
Opcode ID: bd90994871edbc19d8de1da97c03b65385c4a627826e8b1a75e32eb0f8d28e1a
Instruction ID: 6f391647bfbee4642d6ea9c325fb945399db585884dbb693487703799e65c431
Opcode Fuzzy Hash: bd90994871edbc19d8de1da97c03b65385c4a627826e8b1a75e32eb0f8d28e1a
Instruction Fuzzy Hash: 85B1CEB5D146698BEB24CB64DC407EAB7B1EF94310F0481FAD90EAB244E6795EC2CF11

Function 022F425C Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 261memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,39335C83,00003000,00000004), ref: 022F47C6

Strings

Q, xrefs: 022F4A96
S, xrefs: 022F4AD7
DOC5, xrefs: 022F4A9F
ZQ, xrefs: 022F4A69

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID: DOC5$Q$S$ZQ
API String ID: 4275171209-721714928
Opcode ID: b81f2450e3c9dde1c7fc7d12f17fc3ec9323a119f1eb9ad6b92341fc4c9a14d1
Instruction ID: f505fbb65b82ef5b418696d22a718b62500e7f8d3eb9a0306b2a5295a0a50fb2
Opcode Fuzzy Hash: b81f2450e3c9dde1c7fc7d12f17fc3ec9323a119f1eb9ad6b92341fc4c9a14d1
Instruction Fuzzy Hash: B5B1BDB5D146688BEB24CB64DC507EAB7B1EF94301F0481FAD90EAB244E6795AC2CF11

Function 022F4270 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 257memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,39335C83,00003000,00000004), ref: 022F47C6

Strings

Q, xrefs: 022F4A96
S, xrefs: 022F4AD7
DOC5, xrefs: 022F4A9F
ZQ, xrefs: 022F4A69

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID: DOC5$Q$S$ZQ
API String ID: 4275171209-721714928
Opcode ID: 30f96ff4cd74388b5a6cfa5e6f10c21a282fddcfca67c2149262541d11c17cb0
Instruction ID: 724901a428823bd7a4594a465753067da398dc214475cbe4826c6588cfe00299
Opcode Fuzzy Hash: 30f96ff4cd74388b5a6cfa5e6f10c21a282fddcfca67c2149262541d11c17cb0
Instruction Fuzzy Hash: 73B1CEB5D146688BEB24CB65DC407EAB7B1EF94301F0481FAD90EAB244E6795BC2CF11

Function 022F42A4 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,39335C83,00003000,00000004), ref: 022F47C6

Strings

Q, xrefs: 022F4A96
S, xrefs: 022F4AD7
DOC5, xrefs: 022F4A9F
ZQ, xrefs: 022F4A69

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID: DOC5$Q$S$ZQ
API String ID: 4275171209-721714928
Opcode ID: c5d2d7ab0dc7c4d54111e8b73306f59bd46320227cd163721429401e3f7cdee0
Instruction ID: 690dce4fdd1b7b6ac753c15f7cb37a1a6efeaa78b463010dc30da3631729cd37
Opcode Fuzzy Hash: c5d2d7ab0dc7c4d54111e8b73306f59bd46320227cd163721429401e3f7cdee0
Instruction Fuzzy Hash: A0A1BEB5D146688BEB24CB64DC507EAB6B1EF94301F0481FAD90EAB244E6795FC2CF11

Function 00412DA2 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 337libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00000041,00412EA5,00412DEF,?,?,?,00412DEF,00000000,?,?,?,00412DD9,?,?), ref: 00413418

Strings

[S, xrefs: 00412E9E
ZS, xrefs: 0041343B

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: LibraryLoad
String ID: ZS$[S
API String ID: 1029625771-3728667468
Opcode ID: 0ff999ff379c62a9315e57b2e4da1e7d3ccdf2dff4b8dcf91ad7c540a4179984
Instruction ID: 1a67b1381c0d8b818bfb78afe5878684802021d90029251ab056094389cb617c
Opcode Fuzzy Hash: 0ff999ff379c62a9315e57b2e4da1e7d3ccdf2dff4b8dcf91ad7c540a4179984
Instruction Fuzzy Hash: CDB172F2D042545BE3158B25EC91AEB7B78EF81314F1401BBE84DA2241E67D5BD2CAA2

Function 00412CB0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 293COMMON

Download Yara Rule

Strings

[S, xrefs: 00412E9E
ZS, xrefs: 0041343B

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID: ZS$[S
API String ID: 0-3728667468
Opcode ID: 6c14daa978ac3c20a3230d04ed2392a3a779caab258f9ea5dbea0846a0fc900b
Instruction ID: 894d721c423c2db384ecc73062bc4f84635b55c1d91d3743b3e6680cfef68fee
Opcode Fuzzy Hash: 6c14daa978ac3c20a3230d04ed2392a3a779caab258f9ea5dbea0846a0fc900b
Instruction Fuzzy Hash: A19174F2C082545BF3158B61ED91AFB7B78EB81314F0401BBE84E95281E67D5BD2CB62

Function 022EF6C7 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 287fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 022F0631

Strings

R, xrefs: 022F0027
;84J, xrefs: 022EF780

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateFile
String ID: ;84J$R
API String ID: 823142352-683806432
Opcode ID: 10c18ef616e025b61c3eecce38052483c150ffd87a668fb88bed0960d3671f1b
Instruction ID: d6d7b827256292506e75315915add3bde8a5d458200dae199ea12f985e3d1cb7
Opcode Fuzzy Hash: 10c18ef616e025b61c3eecce38052483c150ffd87a668fb88bed0960d3671f1b
Instruction Fuzzy Hash: 5FA174F2D202545FFB148A64DDA8BEB7779EB80310F0441FED90A16685E6786BC1CE52

Function 007CBE11 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 177processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 007CD695

Strings

jjjj, xrefs: 007CD686
79EB, xrefs: 007CBE99

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateProcess
String ID: 79EB$jjjj
API String ID: 963392458-1972886372
Opcode ID: e9061a336dee9376ac3dbdd736e041ef63ca3e89f46076c423bfc82a8ce296a2
Instruction ID: 332098e2d361c32b620431ac54079fbaf0438f71f5a980928ff7f187e6f2a21f
Opcode Fuzzy Hash: e9061a336dee9376ac3dbdd736e041ef63ca3e89f46076c423bfc82a8ce296a2
Instruction Fuzzy Hash: D351E5B2D05114ABF7348A51DC95FEB7B79EBC0320F1481BEEC0D66280D67D5EC68A92

Function 004125B9 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 317libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00000041,00412EA5,00412DEF,?,?,?,00412DEF,00000000,?,?,?,00412DD9,?,?), ref: 00413418

Strings

ZS, xrefs: 0041343B

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: LibraryLoad
String ID: ZS
API String ID: 1029625771-2462379649
Opcode ID: f72ba7d830ac0fc42c42711376031837642fb1940f8f20208209d219d4a6d8df
Instruction ID: 930febdc20d4628421d8fad957bcef895668407d9ad3b827301eb6736f3fc7bf
Opcode Fuzzy Hash: f72ba7d830ac0fc42c42711376031837642fb1940f8f20208209d219d4a6d8df
Instruction Fuzzy Hash: 44B154B2D041549BF720CB14DD90AFF7BB9EB82315F1441BBD84996281D27C5FD2CA92

Function 007DAB04 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 313COMMON

Download Yara Rule

Strings

_S, xrefs: 007DAE07

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID: _S
API String ID: 0-3255402290
Opcode ID: 098145fc3f86fc2e3c93b7b6876a70424eb20d6554ea2ba5eea6377c02a4f5c4
Instruction ID: eb599dde7b65bedd2dedf38855ee707f43c2b682d9975430301b65fe6859a6dd
Opcode Fuzzy Hash: 098145fc3f86fc2e3c93b7b6876a70424eb20d6554ea2ba5eea6377c02a4f5c4
Instruction Fuzzy Hash: 5DB122E2D15224ABE7248B21DC45BEB7779FB85310F1481FBE94D56341E23C5EC2CA62

Function 007D448F Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 309COMMON

Download Yara Rule

Strings

8CJL, xrefs: 007D45E5

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: MemoryProcessRead
String ID: 8CJL
API String ID: 1726664587-335255295
Opcode ID: 813852895ce45538ec5298f64dd4283f4767939c637ef4c76de593ec099eee6c
Instruction ID: be3eb2b92fb4162a13da3db5eac9a9f82f992298260d29611f6e2bc3d244cc4a
Opcode Fuzzy Hash: 813852895ce45538ec5298f64dd4283f4767939c637ef4c76de593ec099eee6c
Instruction Fuzzy Hash: 41B157B2E050549BE720CA14DC54AFBBB79EBC1310F1881FBD84D96341D23DAED2CA92

Function 022E9D6E Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 294registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,FFFFEADA,00000000,000F003F,FFFFF5C2), ref: 022EA26A

Strings

CO:<, xrefs: 022EA5CA

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: Open
String ID: CO:<
API String ID: 71445658-3655680204
Opcode ID: 0a5fb653642ff8ac23cb6607c1279f1511c95bf75517975e2db71eaee2fd0b20
Instruction ID: 0306c8b5e72e738f354753859f1495ce5a6daf0244cca984a036dfe12464bbd8
Opcode Fuzzy Hash: 0a5fb653642ff8ac23cb6607c1279f1511c95bf75517975e2db71eaee2fd0b20
Instruction Fuzzy Hash: FFC19BB1E156688BEB24CB18DD40AEAB7B5EF84300F0081FAD90EA7644E6795FC5CF51

Function 007DA473 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

VirtualProtectEx.KERNELBASE(?,?,00001000,00000040,?), ref: 007DB3C8

Strings

_S, xrefs: 007DAE07

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: ProtectVirtual
String ID: _S
API String ID: 544645111-3255402290
Opcode ID: ccf9a34896562cf28627ddd4134ded77b778b1023211f05ceb62876de04236a7
Instruction ID: 35c87da6bbc7c81a6dd22c5922721abc8018c9ec8b8c3a449a67baf56373f37b
Opcode Fuzzy Hash: ccf9a34896562cf28627ddd4134ded77b778b1023211f05ceb62876de04236a7
Instruction Fuzzy Hash: 1CA129F2D04164ABE7248A14DC85AE77B78EB85310F1540BBDD0E27781E67D5EC2CA92

Function 0041314A Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 250libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00000041,00412EA5,00412DEF,?,?,?,00412DEF,00000000,?,?,?,00412DD9,?,?), ref: 00413418

Strings

ZS, xrefs: 0041343B

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: LibraryLoad
String ID: ZS
API String ID: 1029625771-2462379649
Opcode ID: da4e263827d4c4ab8877d6c4b65f11561e2ad4b349b2fa9cc2a803954957e593
Instruction ID: 9acc98b3991b88dc911b26a6e98e371d99f2783cc9d92d26f30df55abd1a07df
Opcode Fuzzy Hash: da4e263827d4c4ab8877d6c4b65f11561e2ad4b349b2fa9cc2a803954957e593
Instruction Fuzzy Hash: 4A818AF2D082985FF7118E64DC99AEB7B78EB42315F0402BBDC4956182D63C5FC2CA92

Function 00412259 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 242libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00000041,00412EA5,00412DEF,?,?,?,00412DEF,00000000,?,?,?,00412DD9,?,?), ref: 00413418

Strings

ZS, xrefs: 0041343B

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: LibraryLoad
String ID: ZS
API String ID: 1029625771-2462379649
Opcode ID: 2aca9fb6c078d8e8bcb1ce2df435488cca9506f66fdf29bc86340944514d6cae
Instruction ID: 3605b474663da60d2d7971cdac07dbe9a32189f573c3088f1042dda0cc95b7a4
Opcode Fuzzy Hash: 2aca9fb6c078d8e8bcb1ce2df435488cca9506f66fdf29bc86340944514d6cae
Instruction Fuzzy Hash: 1A8135F2D041689BF7218B25DC45BEBBB78EF81314F0482BBD84D62141E27D5AD6CE92

Function 007CC1FC Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 220processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 007CD695

Strings

jjjj, xrefs: 007CD686

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 0a7432806d87cc796922ebd12b5a6a558c8c83061283222304a62d45e76d74fe
Instruction ID: 76d959ab72e32a199c9a2b169ce4c0aa9102ea4ac83846601b0f5090c9212f52
Opcode Fuzzy Hash: 0a7432806d87cc796922ebd12b5a6a558c8c83061283222304a62d45e76d74fe
Instruction Fuzzy Hash: 8C7144B2D092289AF7248B24DC95FEB7774FB84310F1482FEE80D66680DA7C4EC18B51

Function 022EFB3A Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 190COMMON

Download Yara Rule

Strings

R, xrefs: 022F0027

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID: R
API String ID: 0-1968290334
Opcode ID: c0a99d33a43e7b9106bb092949b11762b8ce119fd64ca80f0af7684b16ccf359
Instruction ID: 8dd28ac97c9186aee4ff8602fae09c62a371645838d5d4779bd5dd5f667049eb
Opcode Fuzzy Hash: c0a99d33a43e7b9106bb092949b11762b8ce119fd64ca80f0af7684b16ccf359
Instruction Fuzzy Hash: 0C51A7F2D242445FF7208A24DCA5BFB7729EB81320F1441FED90A066C5E6796FC6CA52

Function 0041229F Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 189libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00000041,00412EA5,00412DEF,?,?,?,00412DEF,00000000,?,?,?,00412DD9,?,?), ref: 00413418

Strings

ZS, xrefs: 0041343B

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: LibraryLoad
String ID: ZS
API String ID: 1029625771-2462379649
Opcode ID: 8d0d61ddda106a0f9bb6ba0f413e8e6649e7720e269b4aff83a2752993908bd7
Instruction ID: ce3bf9b94ed2c2d906cb431102a838807562259f94e1413edb41652e43a1cd6a
Opcode Fuzzy Hash: 8d0d61ddda106a0f9bb6ba0f413e8e6649e7720e269b4aff83a2752993908bd7
Instruction Fuzzy Hash: 596147F2D041989AF7118B65DC45BEBBB78EF81314F0542B7D84D62181E27C5BC2CE52

Function 007C521B Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 180COMMON

Download Yara Rule

Strings

_S, xrefs: 007DAE07

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID: _S
API String ID: 0-3255402290
Opcode ID: aa88d3d375564f4d5e2ca2bfad548734943e8e58271de4ce2062d3fd78d5f0f5
Instruction ID: 561905b43a81b8f9d57ad2e8dad1e5cbb3e5f692ef2a1f933ac97cba7fb887cc
Opcode Fuzzy Hash: aa88d3d375564f4d5e2ca2bfad548734943e8e58271de4ce2062d3fd78d5f0f5
Instruction Fuzzy Hash: 485125F2D05264AAE7208B65DC44BEB7B79EBC5320F1441FBE50D66741D23D4EC2CA62

Function 0041245D Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 170libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00000041,00412EA5,00412DEF,?,?,?,00412DEF,00000000,?,?,?,00412DD9,?,?), ref: 00413418

Strings

ZS, xrefs: 0041343B

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: LibraryLoad
String ID: ZS
API String ID: 1029625771-2462379649
Opcode ID: cb3fc4e265209cc2ab918ead02399f5010bfe0d43a0df028025c0487536e104e
Instruction ID: 093ef08442397ced4454500d539f34d291f623ef1937924541bfa5ffac49279b
Opcode Fuzzy Hash: cb3fc4e265209cc2ab918ead02399f5010bfe0d43a0df028025c0487536e104e
Instruction Fuzzy Hash: 525178F3C581545BF7114A65EC95BEB7F3CEB81314F0441BBE84D92181D27C5AD2CAA2

Function 022EFB86 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 167COMMON

Download Yara Rule

Strings

R, xrefs: 022F0027

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID: R
API String ID: 0-1968290334
Opcode ID: 4e9cc071c9754cfc8a1dbdc9c0981916d04dea16ac9ddd717e81913cf7a2dbb3
Instruction ID: 3027917a20d11f9f290d9a79951fa841bcb0d62de74785b50aec0aa2bb3a5b50
Opcode Fuzzy Hash: 4e9cc071c9754cfc8a1dbdc9c0981916d04dea16ac9ddd717e81913cf7a2dbb3
Instruction Fuzzy Hash: FD51A7F2D152045FF7208A24EC91BFB7738EB80320F1440FED90A166C5E6796FC68A52

Function 00412499 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 155libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00000041,00412EA5,00412DEF,?,?,?,00412DEF,00000000,?,?,?,00412DD9,?,?), ref: 00413418

Strings

ZS, xrefs: 0041343B

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: LibraryLoad
String ID: ZS
API String ID: 1029625771-2462379649
Opcode ID: 71d0641d22a563bf224493ddb05e55455d5e35c1c2d7f3aa648ba3c431dfff18
Instruction ID: 82a92fcae1ef3e056ed68f7b9dac6ff6a3e9825949dba75a34e9ead50232497e
Opcode Fuzzy Hash: 71d0641d22a563bf224493ddb05e55455d5e35c1c2d7f3aa648ba3c431dfff18
Instruction Fuzzy Hash: D24166F3C541545FF3114A65ECA5AFB7B3CEB81318F0441BBE84E91181D27C9AD2CAA2

Function 022ED179 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 472COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 022EE56B

Strings

ZW, xrefs: 022ED593

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CloseHandle
String ID: ZW
API String ID: 2962429428-1732528193
Opcode ID: 3fd985c21dfba13ca52be6e8e115a5eefddfae48e974ef1468d63d5eab9c0e7f
Instruction ID: e6f637018fd33b334f9a2a5d9766817f547c60cdca1a1693cc06863f6e78ab0a
Opcode Fuzzy Hash: 3fd985c21dfba13ca52be6e8e115a5eefddfae48e974ef1468d63d5eab9c0e7f
Instruction Fuzzy Hash: BF12BFB1D182689AEB25CB18DC41AEAB7B9EF85314F0481FAD80EA3245D7345FC5CF52

Function 022EDE73 Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 274COMMON

Download Yara Rule

Strings

J<NO, xrefs: 022EDE74

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CloseHandle
String ID: J<NO
API String ID: 2962429428-1879393595
Opcode ID: d692c0e58ce0da0336ddc3c2154e87ce0ce1af88d030352b25f8fbcceb1f12ba
Instruction ID: b43027f08f6d5e01f9c45bbc49d402e4bbc89b4cd2eab8eab93d83a40c9126a3
Opcode Fuzzy Hash: d692c0e58ce0da0336ddc3c2154e87ce0ce1af88d030352b25f8fbcceb1f12ba
Instruction Fuzzy Hash: E0B1D4B2D152689BEB24CB24DC45AEAB7B9EF84320F0480FAD84DA2344D6385FC5CF51

Function 022EDFED Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 219COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 022EE56B

Strings

5L:, xrefs: 022EDFEE

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CloseHandle
String ID: 5L:
API String ID: 2962429428-2480107755
Opcode ID: 01903f2c3dfd6e030bceda2429e30b5d1dcb19486426f54940baa88b74a903a7
Instruction ID: 960a12c14ee11467ae9f5b1a5d8c63f12371a2db5d3f4a4e75976e5053954471
Opcode Fuzzy Hash: 01903f2c3dfd6e030bceda2429e30b5d1dcb19486426f54940baa88b74a903a7
Instruction Fuzzy Hash: 8691CEB5D152689BEB25CB28DC41AEABBB5EF48310F0481FAD84DA2241D6385FC6CF51

Function 022EE526 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 205COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 022EE56B

Strings

IFH7, xrefs: 022EE527

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CloseHandle
String ID: IFH7
API String ID: 2962429428-861034971
Opcode ID: 3bd985812c3ffaf5c2b158197a9ee9223a79bc28af4e80d9d6a2302cfb6cb797
Instruction ID: 9700280d29d511d3961786f0f9bc3da1c1965c716cb2b7b6fa098666c3d3531e
Opcode Fuzzy Hash: 3bd985812c3ffaf5c2b158197a9ee9223a79bc28af4e80d9d6a2302cfb6cb797
Instruction Fuzzy Hash: 3481ACB1D142689BEB25CF28DC81AEAB7B5EF48314F1481EAD84DA2241E7345FC6CF51

Function 022E41D9 Relevance: 2.0, Strings: 1, Instructions: 796COMMON

Download Yara Rule

Strings

XS, xrefs: 022E4214

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID: XS
API String ID: 0-3742125962
Opcode ID: a4bb5b0e2d467f3fdb037862171cc72deeff02543096f6870e4f0e48d7c63cc2
Instruction ID: 56d5ed4a8cf9e80ad59a60e2cc76f2391806b3c37458e07b8f72035c1513cce6
Opcode Fuzzy Hash: a4bb5b0e2d467f3fdb037862171cc72deeff02543096f6870e4f0e48d7c63cc2
Instruction Fuzzy Hash: 3E721352E2426987DB78DB79DC416ABA2B3EF48300F04D4FDD40DE7664F6704AC99B0A

Function 022EF12B Relevance: 1.9, APIs: 1, Instructions: 375COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07510934c154e63fe8af4716b01e2042ea3f73c571d7a04943ffa083b21cfdd
Instruction ID: a92b538fce802d0f9d18f134139bd89bc89663e96a8250ac7ea0acf6f176e808
Opcode Fuzzy Hash: b07510934c154e63fe8af4716b01e2042ea3f73c571d7a04943ffa083b21cfdd
Instruction Fuzzy Hash: 02E1E2B1D152698BEB248B28DD44BEABBB1EF85310F0481FAD80E67684DB745BC1CF41

Function 022EC458 Relevance: 1.8, APIs: 1, Instructions: 322registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNELBASE(?,?,00000000,00000001,?,?), ref: 022EC4DE

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 0a67dba4e3d7d35df2f6e19a41e4052120f882cf742043d0c768a38a4168c2cd
Instruction ID: ef63de89c3f6774247643fb910c5e7ab2b0464bf21fb1443248727c6d5e5b63f
Opcode Fuzzy Hash: 0a67dba4e3d7d35df2f6e19a41e4052120f882cf742043d0c768a38a4168c2cd
Instruction Fuzzy Hash: 8AC1E2B1D186688BEB24CB68DC516EAB7B5EF84310F0091FAD84EA6240E7755FC1CF52

Function 022E8E63 Relevance: 1.8, APIs: 1, Instructions: 280registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,FFFFEADA,00000000,000F003F,FFFFF5C2), ref: 022EA26A

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 85ff004d524bae9cee9e644c23e38423d5597f4dcfba168dfa17a5ef658ef67f
Instruction ID: 4fc921234188950b458cab1b91c3a79b38a39dd0ba915ff6c811f868b327bba5
Opcode Fuzzy Hash: 85ff004d524bae9cee9e644c23e38423d5597f4dcfba168dfa17a5ef658ef67f
Instruction Fuzzy Hash: 74B1C0B1D292689BEB248B18DC44BEAB7B5FF58304F0441EAD90EA6240E7755FC1CF51

Function 0041B558 Relevance: 1.8, APIs: 1, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 9af86bb899a6c3db214020654897c5d2d38340fe3535c8ea2a82fa0f98d287a2
Instruction ID: 3fd4a4759dbecb1ecde40beb72a2735720ce647061b8efcfaac8b9e7694ecc65
Opcode Fuzzy Hash: 9af86bb899a6c3db214020654897c5d2d38340fe3535c8ea2a82fa0f98d287a2
Instruction Fuzzy Hash: D6B1AFB1D046698BEB248B28CD40BEABBB5EF45314F1441FBD84DA2640D7385EC6CF96

Function 007D9DC0 Relevance: 1.8, APIs: 1, Instructions: 252COMMON

Download Yara Rule

APIs

VirtualProtectEx.KERNELBASE(?,?,00001000,00000040,?), ref: 007DB3C8

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8128754b0aa2c762ce8308f092bedb618a2a0bba0f4b4204cd266c8595b3d277
Instruction ID: 2d68013b876dc8a400aeb43f3078b0f5fba65903bd4d9f8c5e5403769e777bc6
Opcode Fuzzy Hash: 8128754b0aa2c762ce8308f092bedb618a2a0bba0f4b4204cd266c8595b3d277
Instruction Fuzzy Hash: E29113B2E142249AE7248B15DC84BFB7775EF81310F1541FBEA0DA7280E67D5EC1CA62

Function 0041D52E Relevance: 1.7, APIs: 1, Instructions: 220COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(D7402EF8), ref: 0041EB1A

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: d4f129c2d0ed7f06a25b59001db7c40c0ab52e314e3232e0d1ce5f6ebbbfac87
Instruction ID: 6a4e58700e2079595a3ecd094f3b09039d440f310a497b59414c505ebaa46c05
Opcode Fuzzy Hash: d4f129c2d0ed7f06a25b59001db7c40c0ab52e314e3232e0d1ce5f6ebbbfac87
Instruction Fuzzy Hash: AB7101F2D04124AEE7148B10EC41BFB7779EF81314F1481BBD94E9A281E77C5EC28A66

Function 022E8C91 Relevance: 1.7, APIs: 1, Instructions: 203registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,FFFFEADA,00000000,000F003F,FFFFF5C2), ref: 022EA26A

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 9a6b2055f7a7166c498daf97d3bc31894cdd7ec8ad992d6eecfa2975c79d3d97
Instruction ID: e4c8b3e2d13de7c5c504af8e1fb70c041a97696567b93060f8d5507a59c577f0
Opcode Fuzzy Hash: 9a6b2055f7a7166c498daf97d3bc31894cdd7ec8ad992d6eecfa2975c79d3d97
Instruction Fuzzy Hash: A67137B2D252289AEB248B64DC80BFF7775EF50304F1440FAE84E56294E6795EC1CE62

Function 007E45C0 Relevance: 1.7, APIs: 1, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: ce295248691ea936a9d4f28fe1df8baab354cae4a212f8dbec52cb9c309769fe
Instruction ID: 419712d9829d026973b7f0744469797b709fefe406df363faa92b2e7f0db594a
Opcode Fuzzy Hash: ce295248691ea936a9d4f28fe1df8baab354cae4a212f8dbec52cb9c309769fe
Instruction Fuzzy Hash: 16613AE3D042949EF7108A25EC88BE77779EFC8320F1581BAD90CA7641E27D5EC58B52

Function 022EDEAB Relevance: 1.7, APIs: 1, Instructions: 442COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 022EE56B

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 3ba35d19b94869eed50d283d22cfee624103898bc92fa553ef79f1eccc7f0344
Instruction ID: 801eb7939c2bb1a9bd0548c9f3de833c6836b8468bcac35b2fa7218458d5852d
Opcode Fuzzy Hash: 3ba35d19b94869eed50d283d22cfee624103898bc92fa553ef79f1eccc7f0344
Instruction Fuzzy Hash: 7EF108B2D152689BEB24CB24DC45AEBB7B9EF84310F1481FAD84E66244E6385FC1CF51

Function 00415599 Relevance: 1.7, APIs: 1, Instructions: 192COMMON

Download Yara Rule

APIs

K32GetPerformanceInfo.KERNEL32(?,00000038), ref: 004158CC

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: InfoPerformance
String ID:
API String ID: 3070290716-0
Opcode ID: 393f57611d5861c560bf5c3fa372c0c868998c68476733561cb623a793fa633f
Instruction ID: 86292fecc9d5042a6be5fd7f4f51ef3367a2f98a81f8e1fadb11e6d231732389
Opcode Fuzzy Hash: 393f57611d5861c560bf5c3fa372c0c868998c68476733561cb623a793fa633f
Instruction Fuzzy Hash: 3E817DB1D046589FEB24CB18CD90AEABBB5FB89305F1481EAD409A7284C3796FC5CE45

Function 022E8A2E Relevance: 1.7, APIs: 1, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 89956e6c80a6bee4c40189960a504376e448b117002c4bfa9e43953935c326e1
Instruction ID: fbc5959e7abb43cfd79f47ab6e69b56127272762788cc70efa1933717f2180bf
Opcode Fuzzy Hash: 89956e6c80a6bee4c40189960a504376e448b117002c4bfa9e43953935c326e1
Instruction Fuzzy Hash: 175124B2D25164AEEB24CA64CC50AFB7775EB80300F0881FEE44E56691D6789AC5CE52

Function 022EDC20 Relevance: 1.7, APIs: 1, Instructions: 403COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac29e8a84df3a43cd33e39c15b9e1a348cd6e9c280ba62e3f107893669519711
Instruction ID: 7a7a6b12705313791bd46caedb6071e3b622c6f832b49c31b5329122d06f05a4
Opcode Fuzzy Hash: ac29e8a84df3a43cd33e39c15b9e1a348cd6e9c280ba62e3f107893669519711
Instruction Fuzzy Hash: E5E1F7B2D152689BEB24CB64DC45AEAB7B9EF84310F0481FAD84DA2344E6385FC5CF51

Function 022E9FBF Relevance: 1.7, APIs: 1, Instructions: 152registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,FFFFEADA,00000000,000F003F,FFFFF5C2), ref: 022EA26A

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 05fe800cf6d4cc6e0ad8c624817ec26cf7a5d6f70c41252c91df5ce8534c4eb0
Instruction ID: 668e340d4e6c3a8315fb31e5b38fb9b32263c56633fad53533ba55af0e248206
Opcode Fuzzy Hash: 05fe800cf6d4cc6e0ad8c624817ec26cf7a5d6f70c41252c91df5ce8534c4eb0
Instruction Fuzzy Hash: 7551EF72D242A49BEB20CA64CC80BEF7B75BF41345F4980FAD80EA7245C6B95EC0CE50

Function 022EDDC7 Relevance: 1.6, APIs: 1, Instructions: 386COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28744cac1dd66621ed4d09d02592234d8772efb24032d1e955db97a79000f3e1
Instruction ID: 17e7c6cbe87502df2ff66814c0e8ce953251157914ac0eb11caa6ddea2b6cb02
Opcode Fuzzy Hash: 28744cac1dd66621ed4d09d02592234d8772efb24032d1e955db97a79000f3e1
Instruction Fuzzy Hash: 6DE1F6B1D152689BEB248F64DC45AEABBB9FF45310F0481FAD84EA2244E6385FC1CF51

Function 022EDC77 Relevance: 1.6, APIs: 1, Instructions: 376COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 680f09bd1939347fca37a13ddcb661977171ac0672c588253ba180971271e269
Instruction ID: 9932ef2a5edad355ad008bc15d8933d38251ee23afa32930db5610f037ee6e16
Opcode Fuzzy Hash: 680f09bd1939347fca37a13ddcb661977171ac0672c588253ba180971271e269
Instruction Fuzzy Hash: 2BE1F5B2D152689BEB248B64DC45AEAB7B9EF85310F0480FAD84DA2344E6385FC5CF51

Function 022EDC8E Relevance: 1.6, APIs: 1, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0abed8b9d1cd5a6252bbcbe45e0360962ff6d6888059c562acb8ca50b7697d88
Instruction ID: ff6e1e34bad4a9a5e1c78c361cfa626471727dac9a0a9089de8780c20f28fffc
Opcode Fuzzy Hash: 0abed8b9d1cd5a6252bbcbe45e0360962ff6d6888059c562acb8ca50b7697d88
Instruction Fuzzy Hash: 37E1E6B2D152689BEB24CF64DC45AEABBB9EF45310F0480FAD84DA2244E6385FC5CF51

Function 022EDD27 Relevance: 1.6, APIs: 1, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 1c7c06aeeea3efe724652a8082e6f5a8ad627795e14e3981b2bdfa7030e223b7
Instruction ID: a794265640a8f89711bc5b3f489bb3e3a0af539715943391cddaa697a0ecdb46
Opcode Fuzzy Hash: 1c7c06aeeea3efe724652a8082e6f5a8ad627795e14e3981b2bdfa7030e223b7
Instruction Fuzzy Hash: 34D1E4B1D152689BEB24CF64DC45AEABBB9EF45310F0480FAD84EA2244E6385FC5CF51

Function 022EDDEE Relevance: 1.6, APIs: 1, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc124fb6b69ea6e618a3d954d79061841731986388a28cd86b2574f68f11d387
Instruction ID: c509d095c34561de03761842196bbc8760265a9deea61c4cef24571ba232f234
Opcode Fuzzy Hash: dc124fb6b69ea6e618a3d954d79061841731986388a28cd86b2574f68f11d387
Instruction Fuzzy Hash: C1C1F6B1D152689BEB24CB24DC45AEABBB9EF45320F0581FAD80EA2244D6385FC5CF51

Function 022EDDF5 Relevance: 1.6, APIs: 1, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff1030e1496a6108b2cf408e809d439db7750e112a03d6adbac05e82bcc901f7
Instruction ID: cef41dac9b88299ac3a10a4e6210f4f58a0bad0b1c366e54b2f8e371ca78a5a5
Opcode Fuzzy Hash: ff1030e1496a6108b2cf408e809d439db7750e112a03d6adbac05e82bcc901f7
Instruction Fuzzy Hash: CEC1F5B1D152689BEB24CB24DC45AEABBB9EF45320F0581FAD80DA3244D6385FC5CF51

Function 022EDD8F Relevance: 1.6, APIs: 1, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 3ed0ebad3a99fd26e22e0ce0f8895317bc6de93f3282ff7754b28ccb52503ecf
Instruction ID: 02bed7fb7d15f69f377ef3c989c2163b38194342ac5e67a6e871125f10b8db3a
Opcode Fuzzy Hash: 3ed0ebad3a99fd26e22e0ce0f8895317bc6de93f3282ff7754b28ccb52503ecf
Instruction Fuzzy Hash: C0C1F5B1D152689BEB24CB24DC45AEABBB9EF85320F0580FAD84DA2244D6385FC5CF51

Function 022EDEB8 Relevance: 1.6, APIs: 1, Instructions: 300COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 022EE56B

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 92663554a888ba316bce8be7e831ce07dc57236b69e179fc140e928961abe560
Instruction ID: 6413165f07d93fe3c31de85de7bb17c45f1dc374c212cfa6c2e5eea4cb6a22fa
Opcode Fuzzy Hash: 92663554a888ba316bce8be7e831ce07dc57236b69e179fc140e928961abe560
Instruction Fuzzy Hash: 49C1E6B2D152689BEB24CB14DC45AEAB7B9EF84324F1481FAD80DA2244D7385FC5CF51

Function 022EDEBD Relevance: 1.5, APIs: 1, Instructions: 299COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 022EE56B

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 89065305ab2b51b61484494e9b8e4f4a84902ec564af66e0c97eb06de7c6c4d0
Instruction ID: e0e8eb6585384a57ed7bb3304a77db625c5cc9bc771865a54fb5d7490f8c5669
Opcode Fuzzy Hash: 89065305ab2b51b61484494e9b8e4f4a84902ec564af66e0c97eb06de7c6c4d0
Instruction Fuzzy Hash: 93C1D5B2D152689BEB24CB14DC85AEAB7B9EF84324F1481FAD80DA2244D7385FC5CF51

Function 022EDBCC Relevance: 1.5, APIs: 1, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: dd6efa7c28812f2bca156c39ce6b119edb2fa22bca4494d0f753da23f3a19c86
Instruction ID: 47a2f0c5deb12966e5f5a6990f25fdab1853fcbf62333bec904dc05444e2cb42
Opcode Fuzzy Hash: dd6efa7c28812f2bca156c39ce6b119edb2fa22bca4494d0f753da23f3a19c86
Instruction Fuzzy Hash: 14B1D6B2D152689BEB20CB24DC45AEAB7B5EF84320F0581FAD84DA2644D6385FC6CF51

Function 022ECD80 Relevance: 1.5, APIs: 1, Instructions: 279COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 022EE56B

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 3b1e5f28524f7dababf5dfca6073d221517c37afab3286aaf028728e2871254d
Instruction ID: de8aefca9099a9656d5899b86b3e4fd87a5dc603d2a53a0888f993ca00c134f0
Opcode Fuzzy Hash: 3b1e5f28524f7dababf5dfca6073d221517c37afab3286aaf028728e2871254d
Instruction Fuzzy Hash: BFB1C0B1D142289BEB24CB68DC41AEAB7B5EF49310F1481FAD80EA2244D7785FC6CF51

Function 022EDE68 Relevance: 1.5, APIs: 1, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 3818fd4ef074666eb517bf12cf8412bd9cb0b2ac577e49d207b6e9e213443eda
Instruction ID: f4acf123e685683f3ff772f8bc5808cfddf23184a4d314745aded2dc990af744
Opcode Fuzzy Hash: 3818fd4ef074666eb517bf12cf8412bd9cb0b2ac577e49d207b6e9e213443eda
Instruction Fuzzy Hash: 99B1C4B2D152689BEB24CB24DC45AEAB7B9EF84320F0580FAD84DA2344D6385FC5CF51

Function 022ECE00 Relevance: 1.5, APIs: 1, Instructions: 272COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 022EE56B

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 695663480ac59ea8116007efdbf0053f736afd86d12021fef448cd2fff0a12cb
Instruction ID: cf34903f30138130dd6960382b69246083901724049662e112ffe30470a0cfce
Opcode Fuzzy Hash: 695663480ac59ea8116007efdbf0053f736afd86d12021fef448cd2fff0a12cb
Instruction Fuzzy Hash: 30B1C1B1D142699BEB24CB14DC85AEAB7B5EF44314F0481FAD84EA2244D7385FC6CF51

Function 022EDF4F Relevance: 1.5, APIs: 1, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 640e9f9bb6ed7860e176070a4287edba265f58aa99a0b3f7a8247950535664db
Instruction ID: 8a81e040df3d7617a9c43656a9a9980dc9028bc6ce8cc0749e7c56f7714580f2
Opcode Fuzzy Hash: 640e9f9bb6ed7860e176070a4287edba265f58aa99a0b3f7a8247950535664db
Instruction Fuzzy Hash: F3A1C3B1D152699BEB24CB28DC45AEAB7B5EF84320F0480FAD84DA3244D6385FC5CF51

Function 022ECDE3 Relevance: 1.5, APIs: 1, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 89ca0ecc7412252816ee72a3d5460ab210e8249ed44b1a74b0963d6dce541f60
Instruction ID: 3469811d5a54f422244b4350bf896ec4166304150a32d9a1dc14df8229506eb8
Opcode Fuzzy Hash: 89ca0ecc7412252816ee72a3d5460ab210e8249ed44b1a74b0963d6dce541f60
Instruction Fuzzy Hash: 9BA1C1B1D142689BEB24CB28DC41AEAB7B5EF49314F1481FAD84EA2244D7385FC6CF51

Function 022EE05C Relevance: 1.5, APIs: 1, Instructions: 234COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 022EE56B

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 5ad064118a279e15eee2152ac42ee10d438981a28e88d019e2bf352999b3850f
Instruction ID: 3f9d69cd13f0e5f6d6172f2a51cedd7f7d130e639a9825674be851da85f6ed46
Opcode Fuzzy Hash: 5ad064118a279e15eee2152ac42ee10d438981a28e88d019e2bf352999b3850f
Instruction Fuzzy Hash: 09A1B0B5D142689BEB24CB28DC41AEAB7B5EF48314F1481FAD84EA2244D7385FC6CF51

Function 022EDFAC Relevance: 1.5, APIs: 1, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: ad883c3b7d45db11e98b4eea98d8777c101e778378be9bb0071c524bf4d9da65
Instruction ID: 58add0bdad1b0eec582b45c982d7c540d8b66007f89565e0bf57f713b6a6deb6
Opcode Fuzzy Hash: ad883c3b7d45db11e98b4eea98d8777c101e778378be9bb0071c524bf4d9da65
Instruction Fuzzy Hash: DAA1C0B1D152699BEB25CB28DC41AEABBB5EF48324F0480FAD84DA2244D6345FC6CF51

Function 022EDFC4 Relevance: 1.5, APIs: 1, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 1b024fde4a9c471964c13da5e1d68c2f0e63566f568f1174be9199f6518b3646
Instruction ID: e8aecd3344b5eb7b59b4637f3f6e22d7ef6b1f47f32812e1ebe27238b03aa764
Opcode Fuzzy Hash: 1b024fde4a9c471964c13da5e1d68c2f0e63566f568f1174be9199f6518b3646
Instruction Fuzzy Hash: AD91BFB1D152699BEB25CB28DC41AEABBB5EF48320F0480FAD84DA2241D6345FC6CF51

Function 022ED0BE Relevance: 1.5, APIs: 1, Instructions: 227COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 022EE56B

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: ced855f0968dc56b937473bbeb34ec49f158bab9b64c33fea9b1acbb1b30f693
Instruction ID: 8a31c6ec752660cdbdf0059eecada45f7dc090f71428e2cee0b86d383a27c134
Opcode Fuzzy Hash: ced855f0968dc56b937473bbeb34ec49f158bab9b64c33fea9b1acbb1b30f693
Instruction Fuzzy Hash: CF91AFB1D152689BEB24CB18DC41AEAB7B9EF49314F0481FAD84EA2244D7385FC6CF51

Function 022ECDB6 Relevance: 1.5, APIs: 1, Instructions: 227COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 022EE56B

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: f9237e484f14875cbe4ca4c626f02e0a5da07ac523a6da1d04d8ec7ca9a646ff
Instruction ID: 9601010f0ded4e45aeb4d3aa61748d90d6e7434ee20884b28d9e296f0d411d4b
Opcode Fuzzy Hash: f9237e484f14875cbe4ca4c626f02e0a5da07ac523a6da1d04d8ec7ca9a646ff
Instruction Fuzzy Hash: BE91E1B1D192689BEB24CF24DC41AEAB7B5EF48314F1480EAD84EA2245D7385FC6CF51

Function 022ED0C3 Relevance: 1.5, APIs: 1, Instructions: 226COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 022EE56B

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 158aea078715cf671a07dce5c1756d468e839a104ecca5704e06b5c301f28cc8
Instruction ID: 8048479dab991acc6ddf7f92533cfd3a9df3757b18254f416db6ec770297b1d8
Opcode Fuzzy Hash: 158aea078715cf671a07dce5c1756d468e839a104ecca5704e06b5c301f28cc8
Instruction Fuzzy Hash: 7591BFB1D192689BEB25CB28DC41AEAB7B5EF48314F1480EAD84EA2244D7345FC6CF51

Function 022EE085 Relevance: 1.5, APIs: 1, Instructions: 224COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 022EE56B

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 92799b9ae9223d911d444177cc98e42a9827767eed8c8d5c6d10fc4af6e23841
Instruction ID: 58cd399a078837d33a3d1522fb6824f9e0862223304c4afd756c48c5bc7a9bbd
Opcode Fuzzy Hash: 92799b9ae9223d911d444177cc98e42a9827767eed8c8d5c6d10fc4af6e23841
Instruction Fuzzy Hash: F191AEB1D142689BEB25CB28DC41AEAB7B5EF88314F0481FAD84EA2240D6345FC6CF51

Function 022ECDCD Relevance: 1.5, APIs: 1, Instructions: 221COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 022EE56B

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: d5d998fa80113e595765611069a0dd2b924eeabf4a46fac825672104e8359021
Instruction ID: e15e47f9b9ae4d34dc2d3cc9786ff81ca6c8b89bd13397f130699b527031ba6f
Opcode Fuzzy Hash: d5d998fa80113e595765611069a0dd2b924eeabf4a46fac825672104e8359021
Instruction Fuzzy Hash: 7C91BFB1D152689BEB25CB18DC41AEAB7B5EF48314F1480EAD84EA2244D7385FC6CF51

Function 022EE50D Relevance: 1.5, APIs: 1, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb5de85531f3ed42337be695547f4fb0386829e8804567788d0c6be6169105d2
Instruction ID: c525f9490e7b4df75895ee04d06ae4cf53ac3220964204204e7fa809026b6c39
Opcode Fuzzy Hash: eb5de85531f3ed42337be695547f4fb0386829e8804567788d0c6be6169105d2
Instruction Fuzzy Hash: 56919DB1D142689BEB25CB28DC41AEAB7B5EF48314F0481EAD84DA2241E6345FC6CF51

Function 022EDFFE Relevance: 1.5, APIs: 1, Instructions: 213COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 022EE56B

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 19628cd93773a2c2986d2b2b9dd87e16fcae6edb314963af103ae852c400eafb
Instruction ID: 9775010d5eb1a02cd82097ed499f962d15266f916b2c1b97664ba71864443b27
Opcode Fuzzy Hash: 19628cd93773a2c2986d2b2b9dd87e16fcae6edb314963af103ae852c400eafb
Instruction Fuzzy Hash: 6191AEB1D152689BEB25CF28DC41AEABBB5EF48324F0481FAD84DA2240D6345FC6CF51

Function 022ED19D Relevance: 1.5, APIs: 1, Instructions: 211COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 022EE56B

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: eaa071443afa55e50b2ff8225c45fb469e18ceb23e92ad44843f41098169b9d6
Instruction ID: 9633af75e2f1edc73130e2455600b7d13f1f231a3b9179370793e816fdef5c71
Opcode Fuzzy Hash: eaa071443afa55e50b2ff8225c45fb469e18ceb23e92ad44843f41098169b9d6
Instruction Fuzzy Hash: CE91AEB1D142689BEB25CF28DC41AEAB7B5EF88314F1480EAD84DA2240D6385FC6CF51

Function 022EE0D5 Relevance: 1.5, APIs: 1, Instructions: 206COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 022EE56B

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 54ec48bda5e46ce23f02c36f2013a1b34e3c46ee42dcfe5b55c269b910f0aaeb
Instruction ID: 86c3d13a5a5629733b627fff990998cca7f805de40383b7bcdec2b7739d25967
Opcode Fuzzy Hash: 54ec48bda5e46ce23f02c36f2013a1b34e3c46ee42dcfe5b55c269b910f0aaeb
Instruction Fuzzy Hash: 61819CB1D142689BEB25CF28DC41AEAB7B5EF88314F1481EAD84DA2241E6345FC6CF51

Function 022EE15F Relevance: 1.5, APIs: 1, Instructions: 204COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 022EE56B

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 458896dd40b5a36c434c5e451d78eb565a3a08e6ba250d85d420671698df1e3b
Instruction ID: 71342cb0ce1236f5fdf93763098e4e15fa1ba76592fbd22964c1a60026bb5872
Opcode Fuzzy Hash: 458896dd40b5a36c434c5e451d78eb565a3a08e6ba250d85d420671698df1e3b
Instruction Fuzzy Hash: CA819AB1D142689BEB25CF28DC41AEAB7B5EF88314F0481EAD84DA2240E6345FC6CF51

Function 022EDA2D Relevance: 1.5, APIs: 1, Instructions: 202COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 022EE56B

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 53170879ecc57a8feb50fec5e51d7e58a8e0745c7d42d63abcc9562c5c4a0259
Instruction ID: ccb2eb3e94e32745dfce74b4ec5ee240ab62e94317dc70b51dad9175d3ab6a5f
Opcode Fuzzy Hash: 53170879ecc57a8feb50fec5e51d7e58a8e0745c7d42d63abcc9562c5c4a0259
Instruction Fuzzy Hash: C9819CB1D142689BEB25CF28DC41AEAB7B5EF48314F1481EAD84DA2240E6385FC6CF51

Function 022EE044 Relevance: 1.5, APIs: 1, Instructions: 202COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 022EE56B

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 639472cecdfb6f4f91cb03e9b28b47c038c97ae0870826c4caa3ba16463cc841
Instruction ID: ddd49687fd266f6f9a8eccf8c96535a0713b3fbbbb2bb24416d854f51327f351
Opcode Fuzzy Hash: 639472cecdfb6f4f91cb03e9b28b47c038c97ae0870826c4caa3ba16463cc841
Instruction Fuzzy Hash: BB81ACB1D142689BEB25CF28DC41AEAB7B5EF48314F0481EAD84DA2240E7345FC6CF51

Function 022ED1BE Relevance: 1.5, APIs: 1, Instructions: 202COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 022EE56B

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 35db10869f260a99c2dc128a4533b910dc4f71a0a310cd7073104ba7516e8972
Instruction ID: 81b1c9060855114881ce64263a3dc72e5abdd14e36ba2bfaca3ba8ce9b5b2c76
Opcode Fuzzy Hash: 35db10869f260a99c2dc128a4533b910dc4f71a0a310cd7073104ba7516e8972
Instruction Fuzzy Hash: DE81BDB1D142689BEB25CF28DC41AEAB7B5EF48314F1481EAD84DA2240E7385FC6CF51

Function 022E43B6 Relevance: .8, Instructions: 821COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cfb7c15a7b324e2da668217411bf95e94335f25f4061e888246e41e003d79ce
Instruction ID: 5deb1f28769c959dc4b692078431122215982a681f0f937c8ce05d2d14b208e0
Opcode Fuzzy Hash: 4cfb7c15a7b324e2da668217411bf95e94335f25f4061e888246e41e003d79ce
Instruction Fuzzy Hash: 73720552E2466987DB78DB79DC016EBA2B3EF48300F04D4FD940DE7664F6704AC99B0A

Function 022E44B2 Relevance: .8, Instructions: 761COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a11ddee5d8806daa462d7a4492d99bd66a774dc13abb87c54e56d0753a4dec2b
Instruction ID: 494e37936e3c4abe679243d4a89de92188c57f8c36df85d771feca875206d82c
Opcode Fuzzy Hash: a11ddee5d8806daa462d7a4492d99bd66a774dc13abb87c54e56d0753a4dec2b
Instruction Fuzzy Hash: BA621612E2466986DB78DB79DC116EFA2B3EF48300F04D4FD940DE7664F6704AC99B0A

Function 022E4587 Relevance: .7, Instructions: 712COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87927270bfb34fb44b6e5ed7fbbe552691891520dff8713568079a63b8c68d28
Instruction ID: 9bbc16d6521ee5a8a1287575bf32e26ef086f22f17486c7c03bd6381316221b2
Opcode Fuzzy Hash: 87927270bfb34fb44b6e5ed7fbbe552691891520dff8713568079a63b8c68d28
Instruction Fuzzy Hash: 56620512A2466987DB78DB79DC416AFA2B3EF48300F04D4FD940DE7664F6704AC99F0A

Function 022E46D0 Relevance: .6, Instructions: 649COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5a8a2213e0de90c73545ff899f5415f80402a63758b09c676c4964c8482c142
Instruction ID: 1f43e8f74e96c2933910dab36258f6739b53bedc450714313f9aa45ecf5644c4
Opcode Fuzzy Hash: b5a8a2213e0de90c73545ff899f5415f80402a63758b09c676c4964c8482c142
Instruction Fuzzy Hash: FE52D712A3865986DB78DB79DC1169FA2B3EF48300F04D4FD940DE7664F6704AC99B0E

Function 022E4713 Relevance: .6, Instructions: 630COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 170f073e14aa26b6dcc4c40976eb943bda4e15314fc3f7f62705681baebfffb8
Instruction ID: 324df11a02b78f894fcefdfb4b18bdc801d96733dd57431202a1a91e941de77e
Opcode Fuzzy Hash: 170f073e14aa26b6dcc4c40976eb943bda4e15314fc3f7f62705681baebfffb8
Instruction Fuzzy Hash: 7642D612A346A986DB78DB79DC0169FA2B3EF48300F04D4FD940DE7664F6704AC99B0E

Function 022E52AA Relevance: .6, Instructions: 584COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 677d870da6c63fe0dfec6c8a47916e342ad2b62628f6b4156971ab0351dec2de
Instruction ID: 35ae154ac9a59b275d5acb762be65de1740d9e6afa117bf5ea3c37b48a6c84b9
Opcode Fuzzy Hash: 677d870da6c63fe0dfec6c8a47916e342ad2b62628f6b4156971ab0351dec2de
Instruction Fuzzy Hash: 3642B412A3466986DB78CB79DC1129FA2B3EF58300F04D4FD940DE7664F6704AC99B0E

Function 022E4EED Relevance: .6, Instructions: 584COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc2ac2b82fdb962ea51b2087966389fd87e9e68473f188f32c53f2b214b84c10
Instruction ID: 532b72e3200b4af3c19e768a31cf24b1c2d8380b399d034229f16cec4ee52f82
Opcode Fuzzy Hash: bc2ac2b82fdb962ea51b2087966389fd87e9e68473f188f32c53f2b214b84c10
Instruction Fuzzy Hash: C842C512A3466986DB78CB79DC0169FA2B3EF58300F04D4FD940DE7664F6704AC99B0E

Function 022E3F44 Relevance: .6, Instructions: 584COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad3124ba743d1554ed87cb09abf135d30e7a137d848ba30ac4d9a4e013da9fcb
Instruction ID: a3c20adc82eeffd37cc5a1b085dd8f8adfa72b324721a9a752f8c5b424abcd81
Opcode Fuzzy Hash: ad3124ba743d1554ed87cb09abf135d30e7a137d848ba30ac4d9a4e013da9fcb
Instruction Fuzzy Hash: B542B616A346A986DB78CB79DC1129FA2B3EF58300F04D4FD940DE7664F6704AC99B0E

Function 022E4E64 Relevance: .6, Instructions: 582COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 938bb7ecbc11a900aa765e892882809939f2b0eb1245a05d6045646df2966b69
Instruction ID: bd07a4a6f6981fe25bf1b8b7606998b9685d54d5436df420e79e0e26d6772fab
Opcode Fuzzy Hash: 938bb7ecbc11a900aa765e892882809939f2b0eb1245a05d6045646df2966b69
Instruction Fuzzy Hash: 3942B416A3466986DB78CB79DC0169FA2B3EF58300F04D8FD940DE7664F6704AC99B0E

Function 022E47C4 Relevance: .6, Instructions: 582COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d0ab8aeaf026bba90a095232ed251d6350b83a69bb004c34c9b2a9dc1528ab7
Instruction ID: 9a94990f3ea3674165fbf728358f00ae21789e9bb7b9218f4020d7872ba2d70c
Opcode Fuzzy Hash: 9d0ab8aeaf026bba90a095232ed251d6350b83a69bb004c34c9b2a9dc1528ab7
Instruction Fuzzy Hash: C242B616A3866986DB78CB79DC0129FA2B3EF58300F04D4FD940DE7664F6704AC99B0E

Function 022E52C5 Relevance: .6, Instructions: 579COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a29e22e85922854081f71cca688405c2d85548167b9b97f6119080e57ff83e9a
Instruction ID: 9087c28c36c573298a13be21ccea1ebeeb75bcd8385e5888fd6c0417bde75978
Opcode Fuzzy Hash: a29e22e85922854081f71cca688405c2d85548167b9b97f6119080e57ff83e9a
Instruction Fuzzy Hash: 4842B516A3466986DB78CB79DC0169FA2B3EF58300F04D8FD940DE7664F6704AC99B0E

Function 022E4F0E Relevance: .6, Instructions: 577COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d0eee647c29e8f2b815d212a81f0a2e194e66841de8abd2788d88d406cc874d
Instruction ID: 4eb9fc85fdaca7548c4fa3249932d8735c1b25d1a9e85543090d9621881f807a
Opcode Fuzzy Hash: 1d0eee647c29e8f2b815d212a81f0a2e194e66841de8abd2788d88d406cc874d
Instruction Fuzzy Hash: 7942B516A3466986DB78CB79DC0169FA2B3EF58300F04D8FD940DE7664F6704AC99B0E

Function 022E47E3 Relevance: .6, Instructions: 573COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e7d7c9c7ae2d79e9f98a2d797b564a2d6a79b4d514df60a95c6e8b20e4161df
Instruction ID: 55a49b23bf8ed493bf06a0ed2223c9ededf310dddcfe392b6bc77b69ea273e61
Opcode Fuzzy Hash: 3e7d7c9c7ae2d79e9f98a2d797b564a2d6a79b4d514df60a95c6e8b20e4161df
Instruction Fuzzy Hash: 5B42B616A3866986DB78CB79DC0169FA2B3EF58300F04D4FD940DE7664F6704AC99B0E

Function 022E52DB Relevance: .6, Instructions: 571COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62da474508057742a11383b58cc1443bb500fef7f16a1f3cd67001f35552a73b
Instruction ID: ed047ec409e23c59e237084d367916f18cfe59ac3462516046b99c6a41fc65ae
Opcode Fuzzy Hash: 62da474508057742a11383b58cc1443bb500fef7f16a1f3cd67001f35552a73b
Instruction Fuzzy Hash: 4242B516A3466986DB78CB79DC1129FA2B3EF58300F04D8FD940DE7664F6704AC99B0E

Function 022E3F73 Relevance: .6, Instructions: 570COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2812200ecab3ecb0b67221dd8598bae964ae0d3ac9868fa39ce8911d87a34d6c
Instruction ID: 58a6a3d500dfe640677e4ba5b8f4f82ec3907593968bac98b99cf49185affc4a
Opcode Fuzzy Hash: 2812200ecab3ecb0b67221dd8598bae964ae0d3ac9868fa39ce8911d87a34d6c
Instruction Fuzzy Hash: 3042B616A3466986DB78CB79DC1129FA2B3EF58300F04D8FD940DE7664F6704AC99B0E

Function 022E4E00 Relevance: .6, Instructions: 568COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13e640a6bde795afcccfd95bc729e77abd8f1076c06752f01def839b3a5f3af2
Instruction ID: 3a6cbdc5251ec75e41c8c3de5913072227ff9c5800fa11ec94157cb4d8b47fe4
Opcode Fuzzy Hash: 13e640a6bde795afcccfd95bc729e77abd8f1076c06752f01def839b3a5f3af2
Instruction Fuzzy Hash: BE42A516A3466986DB78CB79DC0169FA2B3EF58300F04D8FD940DE7664F6704AC99B0E

Function 00412D39 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 192COMMON

Download Yara Rule

Strings

[S, xrefs: 00412E9E
ZS, xrefs: 0041343B

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: LibraryLoad
String ID: ZS$[S
API String ID: 1029625771-3728667468
Opcode ID: 33d4644cb917bff10714bd33fd1a540fed5a3fab537c2662cfd63985cf9be5f8
Instruction ID: 500ec62444e3ebb547ee9cfcd6e7b56571f95cb31ecb6e532cbfbb84e7c4b541
Opcode Fuzzy Hash: 33d4644cb917bff10714bd33fd1a540fed5a3fab537c2662cfd63985cf9be5f8
Instruction Fuzzy Hash: FF5166F3C482946FF3114A61EC95AFB3B2CEB81324F0501BBE84E95641D27D5AD78A62

Function 00412AB8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 191COMMON

Download Yara Rule

Strings

[S, xrefs: 00412E9E
ZS, xrefs: 0041343B

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: LibraryLoad
String ID: ZS$[S
API String ID: 1029625771-3728667468
Opcode ID: ebb7d4b21f3f2789ba7a42a61086e7b792cf13d3c4b1e4452c02954743823912
Instruction ID: 2a975ea8838899222e52db7c47e9655d72b5c95c6bd20cef5b67d6e7a4c251a2
Opcode Fuzzy Hash: ebb7d4b21f3f2789ba7a42a61086e7b792cf13d3c4b1e4452c02954743823912
Instruction Fuzzy Hash: A25198F3C082946FF3114E61EC95AEB7B2CEB81314F1501BBE88985142D27D5AD7CA63

Function 00412AB5 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 189COMMON

Download Yara Rule

Strings

[S, xrefs: 00412E9E
ZS, xrefs: 0041343B

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: LibraryLoad
String ID: ZS$[S
API String ID: 1029625771-3728667468
Opcode ID: 065c08aeddb2104a2cb7ad637916ce5deb65287ea4e2e4589b8ae2528ef52b29
Instruction ID: f422b0b46a4f32ae8cffeecbcc3b8654069e5c9833fb1f2de6b02a831aff577e
Opcode Fuzzy Hash: 065c08aeddb2104a2cb7ad637916ce5deb65287ea4e2e4589b8ae2528ef52b29
Instruction Fuzzy Hash: 455199F3C082946FF3114A61ED95AFB3B2CEB81314F1401BBE88A85142D27D4AD7CA63

Function 00412AC6 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 186COMMON

Download Yara Rule

Strings

[S, xrefs: 00412E9E
ZS, xrefs: 0041343B

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: LibraryLoad
String ID: ZS$[S
API String ID: 1029625771-3728667468
Opcode ID: 783feb4439c88c80a16e0e7502de70af6f53aa5d94ff9a0cc2624e7e39f124c6
Instruction ID: 3713fad95f6042facef6d5533c8bf793dab353ca833e9e0dd25a68ef50fb56f7
Opcode Fuzzy Hash: 783feb4439c88c80a16e0e7502de70af6f53aa5d94ff9a0cc2624e7e39f124c6
Instruction Fuzzy Hash: 2F51A8F3C082946FF3114A61EC95AEB3B6CEB81324F1501BBE88D85542D27D5AD7CA63

Function 00412A46 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 180COMMON

Download Yara Rule

Strings

[S, xrefs: 00412E9E
ZS, xrefs: 0041343B

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: LibraryLoad
String ID: ZS$[S
API String ID: 1029625771-3728667468
Opcode ID: c6f48e7cd0eecf7417fc653f107819df553b7a18e1e5875efd7125a56ed23982
Instruction ID: eec7766f336c639dc5c104cd5089f815d892ca58a0a3faa92f508f359d76b9fc
Opcode Fuzzy Hash: c6f48e7cd0eecf7417fc653f107819df553b7a18e1e5875efd7125a56ed23982
Instruction Fuzzy Hash: F15197F3D082846FF3118A61EC95AEB3B6CEB81324F1501BBE84985142D27D4AD7CA63

Function 00412A54 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 178COMMON

Download Yara Rule

Strings

[S, xrefs: 00412E9E
ZS, xrefs: 0041343B

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: LibraryLoad
String ID: ZS$[S
API String ID: 1029625771-3728667468
Opcode ID: b0c37ceb01e6a744b44bcfae27e793781672c56313d6ceb83978324c3d91745d
Instruction ID: c3bbb445e71ec3cf809c4c17db1f2fa1c2eef1199c76e86d3e1d0981e3e33c1a
Opcode Fuzzy Hash: b0c37ceb01e6a744b44bcfae27e793781672c56313d6ceb83978324c3d91745d
Instruction Fuzzy Hash: 4751A7F3C082946FF3114A61EC95AEB3B6CEB81324F0502BBE84D81142D27D4AD7CA63

Function 00412DFE Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 176COMMON

Download Yara Rule

Strings

[S, xrefs: 00412E9E
ZS, xrefs: 0041343B

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: LibraryLoad
String ID: ZS$[S
API String ID: 1029625771-3728667468
Opcode ID: 10f468adac0c43252f6c956df160583efd5d89b5531dfeadfc4f405f11fea512
Instruction ID: fac2e0c2549d4a41ec496dd4513f9f16676a3b452c3c131d3037acbf793aa085
Opcode Fuzzy Hash: 10f468adac0c43252f6c956df160583efd5d89b5531dfeadfc4f405f11fea512
Instruction Fuzzy Hash: 7151A7F3C082946FF3124E61EC95AEB3B6CEB81324F1501BBE84D81142D27D5AD7CA62

Function 00412E57 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 156COMMON

Download Yara Rule

Strings

[S, xrefs: 00412E9E
ZS, xrefs: 0041343B

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: LibraryLoad
String ID: ZS$[S
API String ID: 1029625771-3728667468
Opcode ID: 72bcd7e3df70aa62b3d863e5b639c00a45342b9f2c408ca18adc24254c4c2246
Instruction ID: b7da3c453632e6b41d87ab9e269fcfa430e24e8e096ebb457210649530357b5e
Opcode Fuzzy Hash: 72bcd7e3df70aa62b3d863e5b639c00a45342b9f2c408ca18adc24254c4c2246
Instruction Fuzzy Hash: 4B41AAF3C582942FF3114A61ECD5AEB7B2CEB81324F1542BBE84D81541D23D5AD3CA62

Function 00412860 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 144libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00000041,00412EA5,00412DEF,?,?,?,00412DEF,00000000,?,?,?,00412DD9,?,?), ref: 00413418

Strings

ZS, xrefs: 0041343B
LEPM, xrefs: 00412860

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: LibraryLoad
String ID: LEPM$ZS
API String ID: 1029625771-393753287
Opcode ID: d559e4de3db8a68b60625b070f67a7ee77ce1d41ded11604615e62444ceb7f2f
Instruction ID: 4c69732009a192a983f3aa896ad9d960646b999439ae60ed7264d34601e74164
Opcode Fuzzy Hash: d559e4de3db8a68b60625b070f67a7ee77ce1d41ded11604615e62444ceb7f2f
Instruction Fuzzy Hash: C34174F3C541945BF3114A61EC95AFB7B3CEB81318F0441BBE84D91182D23C8AC2CAA2

Function 007C54BF Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 007C68B4

Strings

R, xrefs: 007C8714
HGE:, xrefs: 007C861B

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID: HGE:$R
API String ID: 4275171209-2520022362
Opcode ID: b7716ec7c2f570b711521073b8d662cf72a31c8ef091f20622b2ba462fc55271
Instruction ID: 44840038f0b970f902d79c1216b88b2a75f9e3e78640006bcf1d89e5289a8977
Opcode Fuzzy Hash: b7716ec7c2f570b711521073b8d662cf72a31c8ef091f20622b2ba462fc55271
Instruction Fuzzy Hash: 489104B1D051648FE7248A14DC98BEABBB5EF86304F1480FDD88D56282DB795EC1CF92

Function 004126E6 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 231COMMON

Download Yara Rule

Strings

ZS, xrefs: 0041343B

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID: ZS
API String ID: 0-2462379649
Opcode ID: b689a92e5d7def25d82695540fb90d04cd71f44d8679e4434bb862f600d694c1
Instruction ID: 57be4d4d3afa589d0c108b3ba971e396d98cba20068f4baa574af7610a4ff12b
Opcode Fuzzy Hash: b689a92e5d7def25d82695540fb90d04cd71f44d8679e4434bb862f600d694c1
Instruction Fuzzy Hash: 257146B2D042549BF7148B25DDA0AFF7B78EB82309F1441BBD84996281D27C5BD2CA52

Function 007CD360 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 221processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 007CD695

Strings

jjjj, xrefs: 007CD686

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 2486bdc88d31b10f709e9ffa3b71b3cec7b0c925f2ae4ff38e2376150806e3d1
Instruction ID: 88b59d048a40fa540e4c077202370963748d3cf0c14d5d521cc7b6fd07af317d
Opcode Fuzzy Hash: 2486bdc88d31b10f709e9ffa3b71b3cec7b0c925f2ae4ff38e2376150806e3d1
Instruction Fuzzy Hash: 048105B1D081649BF738CA14DCA5FFAB775EB85311F2442FED90E66680D63C6E90CA41

Function 007CC00B Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 200processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 007CD695

Strings

jjjj, xrefs: 007CD686

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 45105df53d35995dc64fe39eea82e4193980a0790ac253acfa5912a4e89f6109
Instruction ID: ce4e44b34d4fc6f3599a3590b226f0c15db348d045183761711023476c09ac93
Opcode Fuzzy Hash: 45105df53d35995dc64fe39eea82e4193980a0790ac253acfa5912a4e89f6109
Instruction Fuzzy Hash: 546100B2D052699AE7348B11CC41FFBB775FB84710F2481FEE40D66680E6784EC28B61

Function 00413256 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 196libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00000041,00412EA5,00412DEF,?,?,?,00412DEF,00000000,?,?,?,00412DD9,?,?), ref: 00413418

Strings

ZS, xrefs: 0041343B

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: LibraryLoad
String ID: ZS
API String ID: 1029625771-2462379649
Opcode ID: ae423d70bab962cb160c108afc09c3f34999213eac85954a283ad62fd0f658b5
Instruction ID: 5d2e029ac55714db53f2e4eea410231a24517283a85e3f1a4de123304fda265a
Opcode Fuzzy Hash: ae423d70bab962cb160c108afc09c3f34999213eac85954a283ad62fd0f658b5
Instruction Fuzzy Hash: 95517AB2D082985BE7119E60DC98AFF7B39EB82316F1402BBD84E56141D63C5FC2CA42

Function 0041B951 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 194COMMON

Download Yara Rule

Strings

XR, xrefs: 0041BAEF

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ProtectVirtual
String ID: XR
API String ID: 544645111-3798754874
Opcode ID: 297b1092e55ec90580a004fbd03d533e675c4918095546f26a2e5041391b6e36
Instruction ID: c97cd5d7e908595f5dd0c382b21f27ee5fdfa821c09038170dfa5f82458a5a48
Opcode Fuzzy Hash: 297b1092e55ec90580a004fbd03d533e675c4918095546f26a2e5041391b6e36
Instruction Fuzzy Hash: 9A6121F2D40125ABE724CA14ED85FFB7779FB80304F1581FAD90D56684E63C9EC28A92

Function 007CD164 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 182processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 007CD695

Strings

jjjj, xrefs: 007CD686

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: e5c2f66418ba02be27d5cfb9f8151588842f58c137760160bf933c235f3d84ba
Instruction ID: c8108bb24937f40496d34d7f5a6375e71d5b948ee3c5a67af8ea6abdd1d5f802
Opcode Fuzzy Hash: e5c2f66418ba02be27d5cfb9f8151588842f58c137760160bf933c235f3d84ba
Instruction Fuzzy Hash: F25136F1D042589BF734CB10DC95FE6BB39EB80310F1842FEE84926282D23D9E81CA52

Function 00412742 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 180libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00000041,00412EA5,00412DEF,?,?,?,00412DEF,00000000,?,?,?,00412DD9,?,?), ref: 00413418

Strings

ZS, xrefs: 0041343B

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: LibraryLoad
String ID: ZS
API String ID: 1029625771-2462379649
Opcode ID: ef2d36f23e0a3fd7cc0ebaf2c4275247f328d2c06641b26696ad0e18f0eac324
Instruction ID: 6a30ec1bbb7a20723e5a4926f39018656803d11d037ff659579fdf3e19307803
Opcode Fuzzy Hash: ef2d36f23e0a3fd7cc0ebaf2c4275247f328d2c06641b26696ad0e18f0eac324
Instruction Fuzzy Hash: 435164F2D041945BF7118A65ECA4BEB7B3CEB82319F0441BBE84D92281D27C4BD2CA52

Function 007CC240 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 166processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 007CD695

Strings

jjjj, xrefs: 007CD686

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 7b52b5e4a3027d78e6fe06744682c4c4b1c347e7b32df019120eabb751b66f57
Instruction ID: 4cb97c86398a8c6b80c797d3306307e2d88e6d9960c4bf56cb1e443aa3e05d5b
Opcode Fuzzy Hash: 7b52b5e4a3027d78e6fe06744682c4c4b1c347e7b32df019120eabb751b66f57
Instruction Fuzzy Hash: 44716AB1D096A89BEB25CB28CC55BE9BBB1AF48310F1441EED80DA2280E7754FC5CF41

Function 00412476 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 165libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00000041,00412EA5,00412DEF,?,?,?,00412DEF,00000000,?,?,?,00412DD9,?,?), ref: 00413418

Strings

ZS, xrefs: 0041343B

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: LibraryLoad
String ID: ZS
API String ID: 1029625771-2462379649
Opcode ID: ebd62d0f0f7f4029c25b6a9a6bfafcceeaed4918c7fa6442de4f80d59159765e
Instruction ID: b7f28b0900a90bd95ecec506453e7213f8003918e8cebf5a6bde4e404f5df122
Opcode Fuzzy Hash: ebd62d0f0f7f4029c25b6a9a6bfafcceeaed4918c7fa6442de4f80d59159765e
Instruction Fuzzy Hash: 7E5177F3C541645BF7118A65EC95BEB7B3CEB81318F0441B7E84D91181D27C5AD2CA92

Function 007DEB6C Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 165injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 007DFCA9

Strings

ZW, xrefs: 007DF222

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: ZW
API String ID: 3559483778-4266465787
Opcode ID: fa2317c11d93b63e4b65eaf5ad0cf3056b201062d3990300ede013773fcb5b45
Instruction ID: c2e831c7b4fe8306644d9ae21a92d014c8d13781217ad3239e736d089dcfa70b
Opcode Fuzzy Hash: fa2317c11d93b63e4b65eaf5ad0cf3056b201062d3990300ede013773fcb5b45
Instruction Fuzzy Hash: 9F5126F2D185589BF720C614DC45BEB77B8EB81310F1482FBE54E92641E77C5EC28A92

Function 007CCAAD Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

jjjj, xrefs: 007CD686

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: d6dd9b6df76a4e03e6ac4a26de7707ecdeb86dbd1be5c293ab762e8148a1c007
Instruction ID: 39b6f01fc79b2758bc46cefd36dcbfe11ff8a344445275535352661cefff6bba
Opcode Fuzzy Hash: d6dd9b6df76a4e03e6ac4a26de7707ecdeb86dbd1be5c293ab762e8148a1c007
Instruction Fuzzy Hash: 6A419BF2D042585FF3248A60DC56FF77738EB41750F2841FEE50A6A181E53C9E85CA62

Function 00412FE2 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 156libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00000041,00412EA5,00412DEF,?,?,?,00412DEF,00000000,?,?,?,00412DD9,?,?), ref: 00413418

Strings

ZS, xrefs: 0041343B

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: LibraryLoad
String ID: ZS
API String ID: 1029625771-2462379649
Opcode ID: 3258096c14b836ea924ed5038400e6afaa1ac6e2c3ded6312b7e4df7b69aba57
Instruction ID: b3834171cce6667ddfd989815c031d16d29dcec5def6940ca7761efb85b6b329
Opcode Fuzzy Hash: 3258096c14b836ea924ed5038400e6afaa1ac6e2c3ded6312b7e4df7b69aba57
Instruction Fuzzy Hash: 2F5187F3D081645FF3118E65DCA5AEB7B78EB82314F0641BBE84D12642D23C4ED2CA92

Function 00412360 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 155libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00000041,00412EA5,00412DEF,?,?,?,00412DEF,00000000,?,?,?,00412DD9,?,?), ref: 00413418

Strings

ZS, xrefs: 0041343B

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: LibraryLoad
String ID: ZS
API String ID: 1029625771-2462379649
Opcode ID: bf11c2e576fbe2fa70799526608d63895373b2a6d58f6185fe4dbdec64b5ccb9
Instruction ID: bdc5fdab2263bb943e3f0748e2b589a0fe4618315d955d88e03dc55fa3221438
Opcode Fuzzy Hash: bf11c2e576fbe2fa70799526608d63895373b2a6d58f6185fe4dbdec64b5ccb9
Instruction Fuzzy Hash: D541A8F3C541546FF3104A61EC95AFB7B7CEB81314F0442BBE84E91581D23C9AD2CAA2

Function 00412845 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 152libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00000041,00412EA5,00412DEF,?,?,?,00412DEF,00000000,?,?,?,00412DD9,?,?), ref: 00413418

Strings

ZS, xrefs: 0041343B

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: LibraryLoad
String ID: ZS
API String ID: 1029625771-2462379649
Opcode ID: c9498cd3f2d0175d3b9de52ca07847c6812e09a8ab3e87bcacc5bb6ffab2ca90
Instruction ID: c2fe8f93307956bfe799330bf1b7e3750b126921670747919949f07ca5391278
Opcode Fuzzy Hash: c9498cd3f2d0175d3b9de52ca07847c6812e09a8ab3e87bcacc5bb6ffab2ca90
Instruction Fuzzy Hash: 804186F3C541546FF3108A65ECA5AFB7B3CEB81318F0441BBE84E91581D23C9AD2CA92

Function 0041241A Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 151libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00000041,00412EA5,00412DEF,?,?,?,00412DEF,00000000,?,?,?,00412DD9,?,?), ref: 00413418

Strings

ZS, xrefs: 0041343B

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: LibraryLoad
String ID: ZS
API String ID: 1029625771-2462379649
Opcode ID: 07d5a1a27e70b0528757a26456a45df99cb4f04da0ffaaa894e58601ef996ebd
Instruction ID: a3452a62f0df0127f9aada33bb85a6c7ce6f143670d836698932b549e81d01ca
Opcode Fuzzy Hash: 07d5a1a27e70b0528757a26456a45df99cb4f04da0ffaaa894e58601ef996ebd
Instruction Fuzzy Hash: 3F4195F3C541949BF3114A61EC95AFB7B3CEB81314F0441BBEC8DA2581D23C4AD2CAA2

Function 022EFC62 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

R, xrefs: 022F0027

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateFile
String ID: R
API String ID: 823142352-1968290334
Opcode ID: 63b82f035c16f1dc3bc6182f691a6941d4feedbc4d364c2fd4c55c724f0df32e
Instruction ID: 82706baf037a4c9e3e7d5197c9ca22c1aadb2e132b81fe54a17824b4b8984452
Opcode Fuzzy Hash: 63b82f035c16f1dc3bc6182f691a6941d4feedbc4d364c2fd4c55c724f0df32e
Instruction Fuzzy Hash: 934189F1D252549FF7208A24DC94BAAB778EB81320F1081FED94A56AC5D6785FC2CF42

Function 0041236E Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 147libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00000041,00412EA5,00412DEF,?,?,?,00412DEF,00000000,?,?,?,00412DD9,?,?), ref: 00413418

Strings

ZS, xrefs: 0041343B

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: LibraryLoad
String ID: ZS
API String ID: 1029625771-2462379649
Opcode ID: 21618b770b219075f8daf0b053c4ea8cc1c01eb36123fe5eec03ac757414fa3d
Instruction ID: 8d35c53544f7cdd24c78a73d700035d404b7c4d7d3353ba80f6b02b1d28edab3
Opcode Fuzzy Hash: 21618b770b219075f8daf0b053c4ea8cc1c01eb36123fe5eec03ac757414fa3d
Instruction Fuzzy Hash: CA4196F3C541946FF3114A65EC95AEB7B3CEB81314F0441BBE84D92582D23C8AD2CAA2

Function 00412437 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 146libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00000041,00412EA5,00412DEF,?,?,?,00412DEF,00000000,?,?,?,00412DD9,?,?), ref: 00413418

Strings

ZS, xrefs: 0041343B

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: LibraryLoad
String ID: ZS
API String ID: 1029625771-2462379649
Opcode ID: 77ccd395c6903d29ccee4545ed484d1de90538513a678d906e13ceac7b862488
Instruction ID: 3c08b682ad9cd5734bedaa6c1cc00eb4e6f0fe583f5cec063e744805227aa912
Opcode Fuzzy Hash: 77ccd395c6903d29ccee4545ed484d1de90538513a678d906e13ceac7b862488
Instruction Fuzzy Hash: 3F4155F3C541945BF7114A65EC95BEB7B3CEB81314F0441BBE88D91581D23C4AD2CA92

Function 00412E8F Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 139libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00000041,00412EA5,00412DEF,?,?,?,00412DEF,00000000,?,?,?,00412DD9,?,?), ref: 00413418

Strings

ZS, xrefs: 0041343B

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: LibraryLoad
String ID: ZS
API String ID: 1029625771-2462379649
Opcode ID: 90a0b036543a2f6c7e6408df060900b385b2f38da0353727ca590dc4179aa8e9
Instruction ID: 35b66cb3875a9624df63a8bfae23989296fbf850b64248a65b6b246097c57912
Opcode Fuzzy Hash: 90a0b036543a2f6c7e6408df060900b385b2f38da0353727ca590dc4179aa8e9
Instruction Fuzzy Hash: EF4178F3C042945FF3114E61EC95AEB7F6CEB82318F0502BBE88945142D23C5AD6CA53

Function 022F03D9 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 138fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 022F0631

Strings

E?C:, xrefs: 022F058A

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateFile
String ID: E?C:
API String ID: 823142352-3219198154
Opcode ID: 7ead2b41bfb5efb8b8967eb83c3f030e45b0995ae3bc91b55d85def99e76353d
Instruction ID: 8ed5f88f8d633f6efc0a35e1a57bc1fe0fb57b367f2e8160bc71aad2feb01f7f
Opcode Fuzzy Hash: 7ead2b41bfb5efb8b8967eb83c3f030e45b0995ae3bc91b55d85def99e76353d
Instruction Fuzzy Hash: A54177B1C142A49FF724C614DC90BBBBBB9EB81310F0481F9D949A618AD7786BC1CF42

Function 004128A6 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 134libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00000041,00412EA5,00412DEF,?,?,?,00412DEF,00000000,?,?,?,00412DD9,?,?), ref: 00413418

Strings

ZS, xrefs: 0041343B

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: LibraryLoad
String ID: ZS
API String ID: 1029625771-2462379649
Opcode ID: 495d46b8a045acfd64ebe108d397dbbd5d176c810d8c7999506230f710160913
Instruction ID: 8250bf0be383e8f1db8d0e8698784a18643fb9d6f523964f95bfb807420d83d9
Opcode Fuzzy Hash: 495d46b8a045acfd64ebe108d397dbbd5d176c810d8c7999506230f710160913
Instruction Fuzzy Hash: 354198F3C541945BF3114A61ECA5AFB7F3CEB81319F0441BBE88D91182D23C5AC2CA92

Function 00412FDD Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00000041,00412EA5,00412DEF,?,?,?,00412DEF,00000000,?,?,?,00412DD9,?,?), ref: 00413418

Strings

ZS, xrefs: 0041343B

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: LibraryLoad
String ID: ZS
API String ID: 1029625771-2462379649
Opcode ID: f270bcfe35a8b2d71ebb95b600bc974d44bddaf42d903282da6c54c69c24fe98
Instruction ID: 4684b4616e06a7f96334628557b4b906cdf3a49c5b664f178e3c55859f9a176c
Opcode Fuzzy Hash: f270bcfe35a8b2d71ebb95b600bc974d44bddaf42d903282da6c54c69c24fe98
Instruction Fuzzy Hash: 534157F3D141945BE3114E65ECA5AFB7B7CEB82315F0602BBE88D52541D23C4AD2CA92

Function 00412F65 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 130libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00000041,00412EA5,00412DEF,?,?,?,00412DEF,00000000,?,?,?,00412DD9,?,?), ref: 00413418

Strings

ZS, xrefs: 0041343B

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: LibraryLoad
String ID: ZS
API String ID: 1029625771-2462379649
Opcode ID: 777f02fff77ec352f040041cff80284e7a43e9d0cf5c505703af527703a7cea0
Instruction ID: bcc81e1f96410a4ad58d1532a21a146b40d6c2468bebf01ba4a70c2374c7757c
Opcode Fuzzy Hash: 777f02fff77ec352f040041cff80284e7a43e9d0cf5c505703af527703a7cea0
Instruction Fuzzy Hash: 9E4176F3D041945FF3018E65DCD4AEB7B38EB82314F0642BBE88956582D63C4AC2CB92

Function 00412EB9 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 125libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00000041,00412EA5,00412DEF,?,?,?,00412DEF,00000000,?,?,?,00412DD9,?,?), ref: 00413418

Strings

ZS, xrefs: 0041343B

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: LibraryLoad
String ID: ZS
API String ID: 1029625771-2462379649
Opcode ID: 91518e683e1a2ce4d445f979bd24057f38a2a15ba113631853ae8a573cf80d0e
Instruction ID: ee81e99096b1627d2a84c6bcdecbbfbea5b8d28cecd606755c8e42b746d97997
Opcode Fuzzy Hash: 91518e683e1a2ce4d445f979bd24057f38a2a15ba113631853ae8a573cf80d0e
Instruction Fuzzy Hash: 483176F3D542941FF3114E65EC95AEB7B2CEB82314F0102BAE88D51542D23C4AC3CA92

Function 022EFCA6 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

R, xrefs: 022F0027

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateFile
String ID: R
API String ID: 823142352-1968290334
Opcode ID: 09b5171998d7cf0aca0ce627da256cb453e0f1eed00bf604e180a8792723b9c6
Instruction ID: 944a9ef90696b66fdaaa5988c756b48efeb536448dc3934c8a3a87f9f2e9c5eb
Opcode Fuzzy Hash: 09b5171998d7cf0aca0ce627da256cb453e0f1eed00bf604e180a8792723b9c6
Instruction Fuzzy Hash: 994186F2D152145FF7208A24EC94FAB7738EBC0320F1041FED90A166C5D6795FC68A52

Function 007CC057 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 121processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 007CD695

Strings

jjjj, xrefs: 007CD686

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: db1d814488029c9ac6a907d3bc15056118826444cedc5639ade7c94199bfe55f
Instruction ID: e563ccb4c95b9f8022efcb485c833a1fdd917333badf3204c22b9797ae844b60
Opcode Fuzzy Hash: db1d814488029c9ac6a907d3bc15056118826444cedc5639ade7c94199bfe55f
Instruction Fuzzy Hash: A341E1B2D04218AAF7748A55DC81FFAB375FB84750F2581FEE90D66680EA7C0EC1CA51

Function 022EFF37 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

R, xrefs: 022F0027

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateFile
String ID: R
API String ID: 823142352-1968290334
Opcode ID: dbaa1ee39bc3c4ee7ab83c7108c8c3dcf7fdce3d052dfad58b8dbdc8a5d45e07
Instruction ID: 2b2d0e294a446aa92671e58535868147cd28465c6ceb57072d755a95a96d0271
Opcode Fuzzy Hash: dbaa1ee39bc3c4ee7ab83c7108c8c3dcf7fdce3d052dfad58b8dbdc8a5d45e07
Instruction Fuzzy Hash: 394145F1D152145FF7208A14ECA4FAA7738EB80320F1481FED90A566C5D6796F86CA52

Function 022EFFED Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

R, xrefs: 022F0027

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateFile
String ID: R
API String ID: 823142352-1968290334
Opcode ID: 701ca9dc894243c9faf4055b98c41ba00352690292a2c7290e64ad2dc2359713
Instruction ID: d6fa949a18cd1282699aac00b47933fa3508e4c8f8a2e83f982107f6ac156942
Opcode Fuzzy Hash: 701ca9dc894243c9faf4055b98c41ba00352690292a2c7290e64ad2dc2359713
Instruction Fuzzy Hash: 333186F1D112185FF7208A24ECA5BAA7739EBC0320F1081FED94A5A6C5D6795FC68A42

Function 0041209C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

ZS, xrefs: 0041343B

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: LibraryLoad
String ID: ZS
API String ID: 1029625771-2462379649
Opcode ID: c936444899166486c291b4d4cab85be12ce892fd355e8cc0f1f0c2b2fb23b6d6
Instruction ID: 5c18b8e28b03624b261743e310582489e948a3bc2e283a7f741795f71ca6db84
Opcode Fuzzy Hash: c936444899166486c291b4d4cab85be12ce892fd355e8cc0f1f0c2b2fb23b6d6
Instruction Fuzzy Hash: 933137F3D582842BE3115A72ECA5AEB7F2CDBC2319F0502BBE88901482D23D56D3C653

Function 004133CF Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00000041,00412EA5,00412DEF,?,?,?,00412DEF,00000000,?,?,?,00412DD9,?,?), ref: 00413418

Strings

ZS, xrefs: 0041343B

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: LibraryLoad
String ID: ZS
API String ID: 1029625771-2462379649
Opcode ID: f94d4d0e4157cc6a77adf26bdb4e7c61f95f8f96cf3f72d106c976a12fbbe454
Instruction ID: 43030d14bdb5315ff056caea3392bcdbe375063c14f2bf2063c579fee5a6239d
Opcode Fuzzy Hash: f94d4d0e4157cc6a77adf26bdb4e7c61f95f8f96cf3f72d106c976a12fbbe454
Instruction Fuzzy Hash: B93168F3D541945FE3115E61ECD59EB7B2CDB82319F0502BBE88A01482D23C5AC3CA92

Function 007CC125 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 109processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 007CD695

Strings

jjjj, xrefs: 007CD686

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 5addfcc8dd4f5e1d0ebbaa27365699c63f42adc29866d196085a724f23210a31
Instruction ID: f88d3a4ae9b9514536d77c993ed71b5ee72c1f60e50821f53bc0f6b6dfd414df
Opcode Fuzzy Hash: 5addfcc8dd4f5e1d0ebbaa27365699c63f42adc29866d196085a724f23210a31
Instruction Fuzzy Hash: 043121B2D04219ABF7348A41DC45FEB7764BB84360F2441BEE90D291C1E67D1EC2CA52

Function 022E3F0A Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

R, xrefs: 022F0027

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateFile
String ID: R
API String ID: 823142352-1968290334
Opcode ID: 90b6e189c36162fa7c8cfd78babb308acebe17c286818b719c7fb68ae837cd9c
Instruction ID: 38c078c4109fece27f71c7875be5f07633f4d9d437e3b8dd1d72c58b13a98ac5
Opcode Fuzzy Hash: 90b6e189c36162fa7c8cfd78babb308acebe17c286818b719c7fb68ae837cd9c
Instruction Fuzzy Hash: EE3166F1D152185FF7208A24DCA4BBAB738EB80720F1081FED9496A6C6D6795FC6CA41

Function 004120CA Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 106libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00000041,00412EA5,00412DEF,?,?,?,00412DEF,00000000,?,?,?,00412DD9,?,?), ref: 00413418

Strings

ZS, xrefs: 0041343B

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: LibraryLoad
String ID: ZS
API String ID: 1029625771-2462379649
Opcode ID: 8d5bb8fa5de1464be69fa82762f147bfc78e62c4df8a1299f902c775e2ff1d2c
Instruction ID: b54e2c239857f7843c56b01a330bc45cc5b141789bb839129ab5218234562dd2
Opcode Fuzzy Hash: 8d5bb8fa5de1464be69fa82762f147bfc78e62c4df8a1299f902c775e2ff1d2c
Instruction Fuzzy Hash: F33148F3C541941BE3015E61ECE5AFB7B2CDB82319F054177E88A05442D13C0AD3C652

Function 022F50B1 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 105fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 022F68AD

Strings

GM@P, xrefs: 022F50FE

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: FileRead
String ID: GM@P
API String ID: 2738559852-3302473722
Opcode ID: bf9d9784f70ca91d45279f623d780340a6a194182d3800a4e97b039880946017
Instruction ID: 362247ccc85670b952f7b57abcc39747056824652212682fae082179465db36c
Opcode Fuzzy Hash: bf9d9784f70ca91d45279f623d780340a6a194182d3800a4e97b039880946017
Instruction Fuzzy Hash: AD319BF2D281016FF7248660CC46BBBBB78EB81314F0401BDEA0E49585D77DAA96CE51

Function 022FA5C5 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 102fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,39335C83,?,00000000), ref: 022FAACA

Strings

HO4<, xrefs: 022FA73B

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: FileWrite
String ID: HO4<
API String ID: 3934441357-2422729283
Opcode ID: ea0118f0d1da07435fa09e39192a17a4790179fecc588b394a87bfd17a2a0ee6
Instruction ID: 32abb7179f8991973ea5c2e577a6f7ad4e18fe2a17973bb9427414512c241ac1
Opcode Fuzzy Hash: ea0118f0d1da07435fa09e39192a17a4790179fecc588b394a87bfd17a2a0ee6
Instruction Fuzzy Hash: 7A31F3F2D11615AFFB248B64DD95BAABBB8FB40311F0042FED90E57280E6795E80CE51

Function 004120D3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 101libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00000041,00412EA5,00412DEF,?,?,?,00412DEF,00000000,?,?,?,00412DD9,?,?), ref: 00413418

Strings

ZS, xrefs: 0041343B

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: LibraryLoad
String ID: ZS
API String ID: 1029625771-2462379649
Opcode ID: 07a0a73dba91beeb663b0812180f0412571b0cee83a4b1bf3e306bd50362b549
Instruction ID: efc1a58475bf513dbf1a65ef158b92c27f9fedd27ab1df0ae8889a949546926a
Opcode Fuzzy Hash: 07a0a73dba91beeb663b0812180f0412571b0cee83a4b1bf3e306bd50362b549
Instruction Fuzzy Hash: 553149F3D541941BE3015EA6ECE5AEB7B2CDB81319F0541BBE88905482D23C5AD7C652

Function 00412F2D Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 101libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00000041,00412EA5,00412DEF,?,?,?,00412DEF,00000000,?,?,?,00412DD9,?,?), ref: 00413418

Strings

ZS, xrefs: 0041343B

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: LibraryLoad
String ID: ZS
API String ID: 1029625771-2462379649
Opcode ID: 31aea22fbd637ba54443f1b499f1241e98338ca7c56ba4d8e6dedf05b9871b2a
Instruction ID: 04e3ae321fc3a35b9d0ac1d25426877a90969d4762d12d38ba649ea34a3c8c5b
Opcode Fuzzy Hash: 31aea22fbd637ba54443f1b499f1241e98338ca7c56ba4d8e6dedf05b9871b2a
Instruction Fuzzy Hash: 763137F3D542945FE3125E61ECE59EB7B2CEB82319F0501BBE88A01442D23C5A82CA52

Function 007CC14F Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 007CD695

Strings

jjjj, xrefs: 007CD686

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 69200835488a79a93b4d0297f115ebf16271aee6844a486d1c4167623b6377b4
Instruction ID: e431c8846b4d10aea233807fa58e8fa823eeec102c15b95f409eb7a9aa99cbfe
Opcode Fuzzy Hash: 69200835488a79a93b4d0297f115ebf16271aee6844a486d1c4167623b6377b4
Instruction Fuzzy Hash: EE31EDB2D44229AAF7348A41DC85FFBB364EB84360F2441BEE90E256C0E67D1EC19A51

Function 007CD506 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 87processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 007CD695

Strings

jjjj, xrefs: 007CD686

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 1cc86ba105540e2e7e883a5f8d71e91efa4d4f88ae45e922c9a648e0c6cd3ddf
Instruction ID: 71099d26f3b46d8427537bafc3dc7657f574f9a807860e2b259b3d8a4cad34d2
Opcode Fuzzy Hash: 1cc86ba105540e2e7e883a5f8d71e91efa4d4f88ae45e922c9a648e0c6cd3ddf
Instruction Fuzzy Hash: 1E21F8B1D086589BFB388A50DC99FFA7774EB45351F2442FEE50A361C0D6785E80CE45

Function 007CD5D4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 76processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 007CD695

Strings

jjjj, xrefs: 007CD686

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: eab2b874ea0ec1df992b2677fea897318a93e33899f9704bbf74769cc3e43418
Instruction ID: 507799db24e7bf3d0cc6423ebfcd326a4994b1ea1d132baa64f08d6824afb503
Opcode Fuzzy Hash: eab2b874ea0ec1df992b2677fea897318a93e33899f9704bbf74769cc3e43418
Instruction Fuzzy Hash: 332104B2D04248ABF7388A10EC59FFB7378EB44350F2402FDE50A26280E6BD1E84CA55

Function 007CD0DF Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

jjjj, xrefs: 007CD686

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 1729918eb3f70ee0c448ff8fac837d66ba2b1d58dff796e31d11957c4fe89048
Instruction ID: 66305e08206d14300c3e5748612c819076630701f35b6943054fc25b13b4ceda
Opcode Fuzzy Hash: 1729918eb3f70ee0c448ff8fac837d66ba2b1d58dff796e31d11957c4fe89048
Instruction Fuzzy Hash: 862136B1D08358ABF734CA20DC96FFA7734EB84780F2401FDE549256C1EA795E84CA45

Function 007CBE9F Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 007CD695

Strings

jjjj, xrefs: 007CD686

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 5a39903b01c5f2d514320662861a0f335e3321e675e7765fbaba823fabe87c3b
Instruction ID: 4e74517fb2c9c401d419edaafe2c91d673326de77bbb61b9ae1fb77fd5d2b933
Opcode Fuzzy Hash: 5a39903b01c5f2d514320662861a0f335e3321e675e7765fbaba823fabe87c3b
Instruction Fuzzy Hash: F31122B2908318ABF7348A41DC45FEB7364E784750F2801FEE90E651C0E6BD4E85DA52

Function 0041E6F6 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

>O=3, xrefs: 0041E7E0

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ExitProcess
String ID: >O=3
API String ID: 621844428-2672735195
Opcode ID: 2188f71bd98ac8c77a3e75f116370bc8c1573bcefd7d52afc790310a8c25f674
Instruction ID: a9e63ccf1ab33b1c78b2012b1ead8e00f96956ba29e9910835799a0ccd160a32
Opcode Fuzzy Hash: 2188f71bd98ac8c77a3e75f116370bc8c1573bcefd7d52afc790310a8c25f674
Instruction Fuzzy Hash: A221C3F5804024AFE724DB15DD98AFAB7B8FB84300F1440FBD94A96381D5385EC28E56

Function 007CD0EE Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

jjjj, xrefs: 007CD686

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: e1f6e2856a2dfeb34d4701aeb8914ecbdc144ba76881c150da67be087d53058e
Instruction ID: b512f6fa586f7ff54a6ee5735331dbfbc9e2b2ad77d4942348eecd113d359d0d
Opcode Fuzzy Hash: e1f6e2856a2dfeb34d4701aeb8914ecbdc144ba76881c150da67be087d53058e
Instruction Fuzzy Hash: 7A1159B1D0C398ABF734CA20CC95FBA7731EB44780F2401FDE5492A6C1DA785E85CA45

Function 0041C8B7 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?), ref: 0041C902

Strings

7H6F, xrefs: 0041C9AA

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ProtectVirtual
String ID: 7H6F
API String ID: 544645111-613594796
Opcode ID: 0ecf9480cbf7882961ff804efad5064d4975f3149facf3584d2a7d2572a9ee8e
Instruction ID: 6f111ec82f4c0be1076ae83d791e85d82093275c64666d9131b9b54121dbbd1c
Opcode Fuzzy Hash: 0ecf9480cbf7882961ff804efad5064d4975f3149facf3584d2a7d2572a9ee8e
Instruction Fuzzy Hash: BC11B2F2994145AEE3148A20DD84AFF6679EBC0710F2081BBD10996644D63C5BC24B5B

Function 007CC286 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 007CD695

Strings

jjjj, xrefs: 007CD686

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: be3baf9bc29a80b050df0dc9ba620e7a388c8a46a4768b9c1597adc708757c9d
Instruction ID: 4ddbe63755b278b030fd8e453f8b9d03bb736c62e77048c5a5601f6f2acc864f
Opcode Fuzzy Hash: be3baf9bc29a80b050df0dc9ba620e7a388c8a46a4768b9c1597adc708757c9d
Instruction Fuzzy Hash: 511159B2A483186BF7348940DC46FBB7364E744790F2400FEE909691C1E6B85E82D695

Function 022EA104 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

G=IE, xrefs: 022EA105

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: Open
String ID: G=IE
API String ID: 71445658-741967880
Opcode ID: 5b207533747125a4b462ccfb2139b22063de95e15db7591d5de1882241886105
Instruction ID: 8314bd66b6eb9574670d4a079e544a98aeed705c82a0e08a9feb14121bcc44d1
Opcode Fuzzy Hash: 5b207533747125a4b462ccfb2139b22063de95e15db7591d5de1882241886105
Instruction Fuzzy Hash: 0B21F071C256A88FDB20CB60CC847EEB7B5AB40301F5480EBD94AAA186C2B41EC4CF50

Function 022EF22D Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 59fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 022F0631

Strings

7M5A, xrefs: 022EF22E

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateFile
String ID: 7M5A
API String ID: 823142352-2534453799
Opcode ID: fecfdc9e98fba97ad7fd0fd3a401f53df11e5e0c675bdb741bb069afba2a2a42
Instruction ID: dd21d6c4fa7b948e3173a67a7705b26293a1a0a647c048ea2db8608f99695b8c
Opcode Fuzzy Hash: fecfdc9e98fba97ad7fd0fd3a401f53df11e5e0c675bdb741bb069afba2a2a42
Instruction Fuzzy Hash: AA11C0B19253195FFB758A28DC54B7A7774E741720F1043FAE64A5D0CAC3B40BC1CA41

Function 007CCAFE Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 59processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 007CD695

Strings

jjjj, xrefs: 007CD686

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 97679f3059b4ad6702e13468d54bcee16309c7bfc0685282622a8ba6e3130e83
Instruction ID: b9df951d8c3a36d1502c833d6127a346da74594c94ac5f19a6dcb3a70525e8b0
Opcode Fuzzy Hash: 97679f3059b4ad6702e13468d54bcee16309c7bfc0685282622a8ba6e3130e83
Instruction Fuzzy Hash: B7112BF1E483186BF7348A40DC42FBB7334A744B90F2841FEF50A291C0E6B95E85D655

Function 022EF235 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 022F0631

Strings

LB?2, xrefs: 022EF236

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateFile
String ID: LB?2
API String ID: 823142352-328276619
Opcode ID: f986dcc16bc8641535bf2fe5bfb3bd3b87148521be6d703cbe39931a69c03853
Instruction ID: 249fe511b2516ba653baf905fa5f9acea614b7771fd149c2536c05f98b7d775b
Opcode Fuzzy Hash: f986dcc16bc8641535bf2fe5bfb3bd3b87148521be6d703cbe39931a69c03853
Instruction Fuzzy Hash: B51180B19153086FFB358A28DC54B767774D741720F1043FAE68A5A0D6C7B41BC1CA41

Function 007CD250 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 007CD695

Strings

jjjj, xrefs: 007CD686

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 6dd1a150c682c0ce6e3ff76f131cab37756d93a26f10e0f8b77fd002aceeaba6
Instruction ID: be23ab148d9847ed83079945e248450d4a3a574490439139ba46e28f6e5d339c
Opcode Fuzzy Hash: 6dd1a150c682c0ce6e3ff76f131cab37756d93a26f10e0f8b77fd002aceeaba6
Instruction Fuzzy Hash: 6B1102B1D093586BFB38CA50DC46FBAB335AB44790F2841FDE90936280EA785E848A45

Function 007CCB09 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 007CD695

Strings

jjjj, xrefs: 007CD686

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: ec94e36108fc1747c5647eadc20e96d76832204b4fae868ca6dd6baec96f31e6
Instruction ID: a17617dcebfca2e6d1c1862092decac0f14559c844921ed74a195fbb88fba80d
Opcode Fuzzy Hash: ec94e36108fc1747c5647eadc20e96d76832204b4fae868ca6dd6baec96f31e6
Instruction Fuzzy Hash: 7D0126B2A483186BF7348E51DC42FBAB374B744B90F2441FDE509291C1E6B85E808A55

Function 007CD1CD Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 007CD695

Strings

jjjj, xrefs: 007CD686

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: c7850a3c69f3a76940fba617947604078a299583294087111ae9f6210e6ad823
Instruction ID: 2b30e9485bb4b06c0519ebf3358083da61fac0867d2903be06fc682d7b456365
Opcode Fuzzy Hash: c7850a3c69f3a76940fba617947604078a299583294087111ae9f6210e6ad823
Instruction Fuzzy Hash: 071125B1D083586BF734CA50DC42FAAB374AB48790F2441FDE90936280EA785E80CA45

Function 007CD115 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,?,?), ref: 007CD695

Strings

jjjj, xrefs: 007CD686

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateProcess
String ID: jjjj
API String ID: 963392458-48926182
Opcode ID: 202fe40729a127a41a69973af7f188384bc609ff3bf96d13ee648020f0e956ee
Instruction ID: 4a018ce6b9e692f0e2f6495e728e2296a8317dddadd455d8dc4eb83884ac591f
Opcode Fuzzy Hash: 202fe40729a127a41a69973af7f188384bc609ff3bf96d13ee648020f0e956ee
Instruction Fuzzy Hash: E11108B1D093586BF738CA40DC52FBA7334A744791F2401EDE909362C0EA795E84CE45

Function 00415891 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

K32GetPerformanceInfo.KERNEL32(?,00000038), ref: 004158CC

Strings

AFGP, xrefs: 00415891

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: InfoPerformance
String ID: AFGP
API String ID: 3070290716-2728958208
Opcode ID: 34021aab0df8c30b68509d85cad6f7f23cd9b0eae278491cca64df0ccd636a5c
Instruction ID: 1945e980edbab817ef39c0ba866f98325aa2011041c08a88d7416a837801803f
Opcode Fuzzy Hash: 34021aab0df8c30b68509d85cad6f7f23cd9b0eae278491cca64df0ccd636a5c
Instruction Fuzzy Hash: 9E211A35905A298FCB28CF58CE84AD9FBB5BB88309F1482D9D00DA7258C7755BC5CE44

Function 022E8DC9 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,FFFFEADA,00000000,000F003F,FFFFF5C2), ref: 022EA26A

Strings

;P6K, xrefs: 022E8DC9

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: Open
String ID: ;P6K
API String ID: 71445658-46172001
Opcode ID: 83e86160ac1f96d6102d9cf3f9cabe0a0daba2811f65ff4a33b6f28040b68656
Instruction ID: 868b98630b1cb9838a6205d6d9cb8f8ce76b6abfb566d5371323a9537e7634c3
Opcode Fuzzy Hash: 83e86160ac1f96d6102d9cf3f9cabe0a0daba2811f65ff4a33b6f28040b68656
Instruction Fuzzy Hash: E701D4B2D365689AEB308A90CC04BEFB675AB50305F4540FAE50E76094D7F81BC4DE92

Function 022F5496 Relevance: 1.8, APIs: 1, Instructions: 260fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 022F68AD

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 59ff09b6953ef85080a49c34903bc155d61cd4747b23f978242efd95ad3e054d
Instruction ID: 8809a47b332375c627adbd68124c8ca04d3d4dfd225412d61c45bdf14df2e9bf
Opcode Fuzzy Hash: 59ff09b6953ef85080a49c34903bc155d61cd4747b23f978242efd95ad3e054d
Instruction Fuzzy Hash: 1CB1BEB1D146289FEB248F68DC84BEAB7B5EF84315F1081F9E90D66244E7785BC1CE41

Function 022F59FD Relevance: 1.7, APIs: 1, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 976494ba567e9b5802b5b7dc755de1e36c8a6a0c034ccfb278a6058130d8edab
Instruction ID: 67a0daaa66707ca992cfc23eceeabb3239002d881858a0cd831b5e178602b202
Opcode Fuzzy Hash: 976494ba567e9b5802b5b7dc755de1e36c8a6a0c034ccfb278a6058130d8edab
Instruction Fuzzy Hash: 089134B2D1022A9BE764CA64DC84BFBBB79EB80315F0441F9D90E56244EA385FD5CF81

Function 022F5328 Relevance: 1.7, APIs: 1, Instructions: 225fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 022F68AD

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 9218e85567934d5dfcb593d4f5a1235769e0355642198d7c07fe5fdf52f05731
Instruction ID: 42c9eeec1118eab05ea045609f75d6f924a65918c64c5610278d7c148a1692c4
Opcode Fuzzy Hash: 9218e85567934d5dfcb593d4f5a1235769e0355642198d7c07fe5fdf52f05731
Instruction Fuzzy Hash: B58147B2D2162A4EE7208B64DC40BFBB7B6EF84310F0441FAD94DA6644E3795AD0CB91

Function 022E92F8 Relevance: 1.7, APIs: 1, Instructions: 216registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,FFFFEADA,00000000,000F003F,FFFFF5C2), ref: 022EA26A

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 05b85ab5e33315706fe350275b57ec977976bea854c48317456e6c5048cf5285
Instruction ID: 970fa83ebe73dcebf25a304aacce8471b81833280cb31c579567943b38cf5e40
Opcode Fuzzy Hash: 05b85ab5e33315706fe350275b57ec977976bea854c48317456e6c5048cf5285
Instruction Fuzzy Hash: 3781CDF1D142189FEB20CB54DC94BEA77B8EB41304F5881EAD80E96685D639AFC5CF11

Function 022EECBC Relevance: 1.7, APIs: 1, Instructions: 212fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 022F0631

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f55e8a6f9619ba6ce52a27a0ea2d3385ef046c6ed248e062900d7a18dcd5cf66
Instruction ID: 84a6e5105769772ccc562ff8c70b4350ef19f07393cc59319d2ac285675dcc03
Opcode Fuzzy Hash: f55e8a6f9619ba6ce52a27a0ea2d3385ef046c6ed248e062900d7a18dcd5cf66
Instruction Fuzzy Hash: EF6159A2D242149BF7208A64DC51BF77738EF41320F0502FAD94E97284D2799FC18B62

Function 022E7AF1 Relevance: 1.7, APIs: 1, Instructions: 208COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(FFFFEB3C,00000000), ref: 022E7E67

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 99fd1bb37bdf813a197c2eb25c37c0bb4f3953f846749b2277c1f8a35f2c4a12
Instruction ID: b22588b1da9c0a893dc6a5f03548e595e91fa66ec5d101d98bbaf0e5d87dcd27
Opcode Fuzzy Hash: 99fd1bb37bdf813a197c2eb25c37c0bb4f3953f846749b2277c1f8a35f2c4a12
Instruction Fuzzy Hash: B081F3B2E045558FFB24CA14CC84BFABB76EB80305F1482FAD90D57684D7386BC28E51

Function 022F5971 Relevance: 1.7, APIs: 1, Instructions: 201fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 022F68AD

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: ebdda297a3db3375f5417fff72a6bab363b7053cfa2bf3c74050e5266b9353ee
Instruction ID: 9a324ec9a0327d95a63551195839f325acd3fd450c155b7a61ce7070a91a2c24
Opcode Fuzzy Hash: ebdda297a3db3375f5417fff72a6bab363b7053cfa2bf3c74050e5266b9353ee
Instruction Fuzzy Hash: F97113B2D1022A8BE768CB54CC84BFBB775EB80311F0441F9EA0E67284DA385ED1CE51

Function 022E78CA Relevance: 1.7, APIs: 1, Instructions: 172COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(FFFFEB3C,00000000), ref: 022E7E67

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: db37e65c83261c84c209116efc689415f18afdfca86a365e740188e85dd84712
Instruction ID: bb5162af97e13d692cf66defc86edd3ea36168da638548dfe55427791a231330
Opcode Fuzzy Hash: db37e65c83261c84c209116efc689415f18afdfca86a365e740188e85dd84712
Instruction Fuzzy Hash: FA51D3B2E102299BEB208A14DC40EEBBB79EB85310F0541FAD80E67744D7786FD5CE91

Function 0041D771 Relevance: 1.7, APIs: 1, Instructions: 172COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(D7402EF8), ref: 0041EB1A

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 3d11b010f8c49f715c143eea529b08edbf2f12115a050e909012947c6e7420ec
Instruction ID: 9fda3dc78f9cbf4ed1a3cea627e40ccda274df0d504d730017d0ba600a67698e
Opcode Fuzzy Hash: 3d11b010f8c49f715c143eea529b08edbf2f12115a050e909012947c6e7420ec
Instruction Fuzzy Hash: 5A7168B1D096688AEB24CB29DC407DABBB1BF89314F1082EAC84D63341E7355EC1CF55

Function 007DA622 Relevance: 1.7, APIs: 1, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53aad7855f9320e1ab1e31cccb8c6a34d1993650b22976ad70a4f24193366e2f
Instruction ID: 8b175283de039607f454e6d28410cd26acca2bb4ed77d1d60574c6b1b270d8ca
Opcode Fuzzy Hash: 53aad7855f9320e1ab1e31cccb8c6a34d1993650b22976ad70a4f24193366e2f
Instruction Fuzzy Hash: 6551D4B2D04164ABE721CB14DC84BEA7B75BF91311F1880FBD84D67641E63C9BC68E92

Function 022F5139 Relevance: 1.7, APIs: 1, Instructions: 166fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 022F68AD

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: eeb0d5e3ffde51e7a0c76c66ab1577242a28d99c7b005007b51992f7a6a0b223
Instruction ID: a0bbd57d3251d536855b982acf45cc78c6852d0d13a7ebfa568f2734b5e9e5a5
Opcode Fuzzy Hash: eeb0d5e3ffde51e7a0c76c66ab1577242a28d99c7b005007b51992f7a6a0b223
Instruction Fuzzy Hash: 145133F2D216165EF7208A20DC54BFBB77AFB84310F0481FAD90D97284E67D6B858B91

Function 007DA259 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

APIs

VirtualProtectEx.KERNELBASE(?,?,00001000,00000040,?), ref: 007DB3C8

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 594a175ecd6ced2da9555853ccd88fb5d5488ff6b98b1c8e9c46a2cf350d7181
Instruction ID: 87e02bf70a77d1c2bbfd77b69e0e46e167d81c002681a70831fa62c57c071955
Opcode Fuzzy Hash: 594a175ecd6ced2da9555853ccd88fb5d5488ff6b98b1c8e9c46a2cf350d7181
Instruction Fuzzy Hash: 8151E5B2D04228ABE7248A14DC45BEB7774FB90310F1441BBE90E66741E6399EC6CA93

Function 022EF3F2 Relevance: 1.7, APIs: 1, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c435e031dbf51082ff4eb8a0db54bc356bff7e4201819030635ab5a8ac20dc7b
Instruction ID: 826ed233f765fe4241f18ae81bd0dc84c4022615df0373e40979d7f41063ff39
Opcode Fuzzy Hash: c435e031dbf51082ff4eb8a0db54bc356bff7e4201819030635ab5a8ac20dc7b
Instruction Fuzzy Hash: 5551E172D142698BEB258B28CD48BDABBB5EF40314F0442FAD90E77694D7781BC5CE81

Function 022F0258 Relevance: 1.6, APIs: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 022F0631

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f98c3330cab1a88b57e9537a850b0f592a734c8b0e70e5f3573937adbe4b2664
Instruction ID: 2b06dd71ce4e24f5260637a6617fc785fb53a5ab1f40923dab2f05986a0d7cb8
Opcode Fuzzy Hash: f98c3330cab1a88b57e9537a850b0f592a734c8b0e70e5f3573937adbe4b2664
Instruction Fuzzy Hash: 605115B2D142245BE760CB18CC94FEBBB79EB81310F0441FAD9496728AD6746FC1CE91

Function 022EF3CB Relevance: 1.6, APIs: 1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31dc728305162805fc7cd0b9277e92ed593106d5acdfbe1c24332a910b9e6711
Instruction ID: e57cefa00452c83a5bb25d46212c1399ffc1f726a7c48e816d83b4bbe531bdf5
Opcode Fuzzy Hash: 31dc728305162805fc7cd0b9277e92ed593106d5acdfbe1c24332a910b9e6711
Instruction Fuzzy Hash: F551F272D142698BEB258B28CD48BDABBB0EF40314F0442FAD90E63694DB741BC5CF81

Function 007DA5AD Relevance: 1.6, APIs: 1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d1ec7c9f0529c89d90d7ffd0900fcf835f6ce5ecbcc748da58af19b0d231bf
Instruction ID: 563f977426c96594ea1faf5451f583cfe9c75bc5f210ee4bbeee84adca927c46
Opcode Fuzzy Hash: d5d1ec7c9f0529c89d90d7ffd0900fcf835f6ce5ecbcc748da58af19b0d231bf
Instruction Fuzzy Hash: A441E9F2D04164ABE7218A14DC84BEB7B74FB91311F1880FBD80D57641E63C9AC68A93

Function 022E902F Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2be291479830d2fbe9dc639eb4a6b1f7dba0ab31680f7c6337a007205b4e761
Instruction ID: d3ec968c37ad7bc6e207fe8f9415e7b391fde962026f5c1db2e118181340bcc4
Opcode Fuzzy Hash: e2be291479830d2fbe9dc639eb4a6b1f7dba0ab31680f7c6337a007205b4e761
Instruction Fuzzy Hash: FD51DFB1D282289BEB308B58DC45BEAB7B4FF58314F4441FAE90E62244E7755BC1CE41

Function 007E44E6 Relevance: 1.6, APIs: 1, Instructions: 141threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 007E5D29

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 00c507815878aa9346387db989f07705a87a2c23d3a59003d956a15953e4ca57
Instruction ID: d45c7ef99f116a4c6c35218de41b117e3c91fba8b5b9d56573ce9635d9caff39
Opcode Fuzzy Hash: 00c507815878aa9346387db989f07705a87a2c23d3a59003d956a15953e4ca57
Instruction Fuzzy Hash: 5F41AAE3D504446EF3144515FC89FF73A2CEBC4360F19417EE90D96281E2BD9ED68662

Function 022E9008 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbda8dfc12f5dc6b289be1a168d315fdd4d20dd52c3835575a471c064af54c24
Instruction ID: 336fc2324f17c8ed4a2f27856c9abdd29099d2adc7bd2e2377baaf2c3b5677d4
Opcode Fuzzy Hash: fbda8dfc12f5dc6b289be1a168d315fdd4d20dd52c3835575a471c064af54c24
Instruction Fuzzy Hash: DB51D0B1D282289BEB308B58DC45BEAB7B4FF58314F4441FAD90E62244E7755BC5CE41

Function 0041E530 Relevance: 1.6, APIs: 1, Instructions: 132COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(D7402EF8), ref: 0041EB1A

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: b38589e663f1d0a94cbad1566c14fcffb7a63927a1edb6844676e909c4797d53
Instruction ID: 7e50f36ccbcc6d4466dc8f61e553b2d1c9425d4f2e60ae23613b57f6c297c318
Opcode Fuzzy Hash: b38589e663f1d0a94cbad1566c14fcffb7a63927a1edb6844676e909c4797d53
Instruction Fuzzy Hash: 954104F6C001109FE3288A25DC59BEB7B79EB90320F5441BEDC4D16680E67DAEC2CA52

Function 022F043A Relevance: 1.6, APIs: 1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17e0a6e1c04186a4aeee59d2e6bae5ca23160390e9d72018c0c4f5aa803b78c5
Instruction ID: 61023c55102493e5800638844e18fef7a3132bd04a25bacbff86e6cd436f6741
Opcode Fuzzy Hash: 17e0a6e1c04186a4aeee59d2e6bae5ca23160390e9d72018c0c4f5aa803b78c5
Instruction Fuzzy Hash: D2412BB1D252A88FEB25CB14CCA0BBBB77AEF41305F1441F9D6499618AC7745B85CF01

Function 007D490A Relevance: 1.6, APIs: 1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: a640f5ba84fd6cdc87ea22283993b62c8d25acfb67b0814098d9af2da25c4fa6
Instruction ID: d7ea56eb081eb4c76a0f9183dd3e5d35047952d864e3ed53f374b2c1403d334b
Opcode Fuzzy Hash: a640f5ba84fd6cdc87ea22283993b62c8d25acfb67b0814098d9af2da25c4fa6
Instruction Fuzzy Hash: 534146F3E05554ABF7208A15DC44EF7B779EBC1320F1881BAE80992A84D67C5FC18A92

Function 022EF44B Relevance: 1.6, APIs: 1, Instructions: 124fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 022F0631

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ef6aaa137b4ecee16e1218263285f2ae157fa74e437c08a93189bae657a88814
Instruction ID: 922699fb765991edd75880f4d242e3428634427523e02cd157cc56193f9cd615
Opcode Fuzzy Hash: ef6aaa137b4ecee16e1218263285f2ae157fa74e437c08a93189bae657a88814
Instruction Fuzzy Hash: F441F572D142699AEB258B68DC49BDABB74EF40324F0002FAD90E37195E7781BC5CE81

Function 0041BC04 Relevance: 1.6, APIs: 1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 9706e9e47762efb1f81bb958b92d1363c603771d891d7b58cddcea015df803b7
Instruction ID: 233f4790ae10ccbcb4b5b1ec70ba86b92a09e951aa8c730997dd6cbae1734be1
Opcode Fuzzy Hash: 9706e9e47762efb1f81bb958b92d1363c603771d891d7b58cddcea015df803b7
Instruction Fuzzy Hash: E44124B2D445649BF7248A24EC85BFF7B78EB81304F1441FBE54D52680D73C4AC68B96

Function 022E8C12 Relevance: 1.6, APIs: 1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 260edadfa8fa68e9518993af0642521899fb18cef6a12e286eab0f43e037e8c5
Instruction ID: 229afd1f841ab3a45b17e5cea11fdbcf68e9396215cafd3d097bdba6570e6793
Opcode Fuzzy Hash: 260edadfa8fa68e9518993af0642521899fb18cef6a12e286eab0f43e037e8c5
Instruction Fuzzy Hash: 69413CA2D252289AEB208B54DC407FFB775EF94304F1440FAE94E66154E6B91EC0DF92

Function 022F58A1 Relevance: 1.6, APIs: 1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: ce40b27d67622899e5dff206317fcf11023ebabbfa7ffd83465c5daeba62f8c7
Instruction ID: 3de3bfb0072ea450eab5534d084670feff3712584074a9eb0e3b6976abc18905
Opcode Fuzzy Hash: ce40b27d67622899e5dff206317fcf11023ebabbfa7ffd83465c5daeba62f8c7
Instruction Fuzzy Hash: 474137F2D5120A9BE724CB50DC84EEBB7B9EBC4311F0081F9E50E56244E6785AD2CE11

Function 0041BC97 Relevance: 1.6, APIs: 1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 54ebfaddfd4047ed9f321e3aa6ec292f599ea8e738238342139c2064a0e6ecf4
Instruction ID: 8dde430b86904a7d14e3573f2e04c388efdc331cc9535f988928a9e67936e8e8
Opcode Fuzzy Hash: 54ebfaddfd4047ed9f321e3aa6ec292f599ea8e738238342139c2064a0e6ecf4
Instruction Fuzzy Hash: DB4146B2D081A49BF7248A24EC94BFB7B74EB81304F1441FFD58E16180D7380AC6CB96

Function 0041BC84 Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d5006fdf797247639559e539658797c8fd070de7098407e9bba45f47b412e339
Instruction ID: 4d77cb473ed991f1f80c992c92cb9a9b6efbdb195f84fa2879067f963255c0ca
Opcode Fuzzy Hash: d5006fdf797247639559e539658797c8fd070de7098407e9bba45f47b412e339
Instruction Fuzzy Hash: 2E4124B2D082A49BE7258A64DC84BFB7BB5FF81304F2441FFD58956181D7380AC6CB96

Function 022E8C18 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a3389a943f2af44ca550661e1719c6336bd82002903329c885c3d3a03d9d8eb4
Instruction ID: 755b53890aac98d5cf55013da9febcc87ce7b3ab359253037fb57dd9c51188b2
Opcode Fuzzy Hash: a3389a943f2af44ca550661e1719c6336bd82002903329c885c3d3a03d9d8eb4
Instruction Fuzzy Hash: 47415CA1C262689AEB208B64CC407FFB775EF94304F1440FAE94E66154E6B91AC0DF92

Function 0041C4C8 Relevance: 1.6, APIs: 1, Instructions: 117memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?), ref: 0041C902

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 43adf1e43a3eed2bf6b3d7e15240e66a4dcd21f0a237103355414fbea62d9e68
Instruction ID: 096713552a1c6ff9d6ce1fc3a894d5393b13b6e2ea34b32d18d533e5bd818789
Opcode Fuzzy Hash: 43adf1e43a3eed2bf6b3d7e15240e66a4dcd21f0a237103355414fbea62d9e68
Instruction Fuzzy Hash: BE41D1B2D40168AFE724CA14DD88EFB7779FB80300F1481FAD80D57245E6386EC68A95

Function 0041D351 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(D7402EF8), ref: 0041EB1A

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 7ebb29af14a113e16419f3233e79ddda0eb637283398f2851e460233fa74f04e
Instruction ID: febcbaf7e849111292310d5a1218d5d803228f78b54eebe7e25823dd63d8ab48
Opcode Fuzzy Hash: 7ebb29af14a113e16419f3233e79ddda0eb637283398f2851e460233fa74f04e
Instruction Fuzzy Hash: 153106F2D405286FF3148A14EC89BF77B28EB81334F1481BBE90E16681D63D5ED589A7

Function 00415780 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

K32GetPerformanceInfo.KERNEL32(?,00000038), ref: 004158CC

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: InfoPerformance
String ID:
API String ID: 3070290716-0
Opcode ID: 08fbde8dd96b6ed31b5c604855fd61289c6bbefd09ed46fe13e838e2a7a58d17
Instruction ID: 04f7df20039ad99a2e71c6aaa66132dd1b64f8d2defbe6ccd74a137b8d95a579
Opcode Fuzzy Hash: 08fbde8dd96b6ed31b5c604855fd61289c6bbefd09ed46fe13e838e2a7a58d17
Instruction Fuzzy Hash: BD41F471D04A188FDB24CE28CD84BEABB75EBC5305F14C2FAD40CA6644C3795BC58E45

Function 007DB256 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

VirtualProtectEx.KERNELBASE(?,?,00001000,00000040,?), ref: 007DB3C8

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 7882c87ec69a67a3834f04db5e35098a223758482fa7f53d3705c2c5a3862f71
Instruction ID: 286e0a513f0ff7dcaae6e8d49dc223ea22529a878ce55afa7795eee23bc4c1e2
Opcode Fuzzy Hash: 7882c87ec69a67a3834f04db5e35098a223758482fa7f53d3705c2c5a3862f71
Instruction Fuzzy Hash: 3A3117B2E041549BF7348A45DC95FFF3B79EB81320F1542BBD50DA6280D77C5AC28A51

Function 022EF629 Relevance: 1.6, APIs: 1, Instructions: 115fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 022F0631

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: defa2a986f81fdd1c146ba9b9dc6790bc8011e01a293af6b210809e9206f7095
Instruction ID: 0bd421be77c6298309a177940e3181e566ded82fe09affd43ae8bd3c7019a4be
Opcode Fuzzy Hash: defa2a986f81fdd1c146ba9b9dc6790bc8011e01a293af6b210809e9206f7095
Instruction Fuzzy Hash: D0415772D102258FEB208A64DD98FEBBB34EB80310F0502FAD40E676D5D6785BC0CE92

Function 007DAE18 Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

VirtualProtectEx.KERNELBASE(?,?,00001000,00000040,?), ref: 007DB3C8

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 69be83a20d6556198e6400706c9837d8ddf108b6079cb455c20fd34c53dc9d93
Instruction ID: d77c5105c69e08f0b9b3d81a37d2d391c8d90f440d178fe8007c655dfadd3530
Opcode Fuzzy Hash: 69be83a20d6556198e6400706c9837d8ddf108b6079cb455c20fd34c53dc9d93
Instruction Fuzzy Hash: 604103B2D04219EFE724CA10DD85BEAB775FBC0301F1441FAD90D62781D63DAE858E52

Function 0041B8A8 Relevance: 1.6, APIs: 1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: e42b6efe4bdbce025ddb18194efaf48bdac0117bf75d48e694273fcd894b8bf5
Instruction ID: 2376a7fc50019cd4858170505443d1de33d499c726b3b77527ca7ee7ef314111
Opcode Fuzzy Hash: e42b6efe4bdbce025ddb18194efaf48bdac0117bf75d48e694273fcd894b8bf5
Instruction Fuzzy Hash: 6D31F6B2D441659BE7248A24DD44BFB7B79EB80310F1081BFE54E62584D63C1AC6CFD6

Function 022EF582 Relevance: 1.6, APIs: 1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 25126fda864ab9014a01631a6f938e1ca49eab1662617f1d87487ebbfb105d0a
Instruction ID: 31e620fb54b50d4c3335ef5fa2dbcf038232b699a03810ede12084d601f74278
Opcode Fuzzy Hash: 25126fda864ab9014a01631a6f938e1ca49eab1662617f1d87487ebbfb105d0a
Instruction Fuzzy Hash: F1414672E0536A8BEB218B78CC98BDABB74AB41310F1502FEC54D67596C6740BC4CF81

Function 022E9C7E Relevance: 1.6, APIs: 1, Instructions: 106registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,FFFFEADA,00000000,000F003F,FFFFF5C2), ref: 022EA26A

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: bc0beb2083925cb3186fd6b9d92f944f7182148029d8916a3ae296c9ac167297
Instruction ID: d2ce270addc8191ac58155e4182dd4826092f514510493e371b8a4e673fa9dcc
Opcode Fuzzy Hash: bc0beb2083925cb3186fd6b9d92f944f7182148029d8916a3ae296c9ac167297
Instruction Fuzzy Hash: 5C4134B1D296A49FEB24CA50CC44BEA7B74EB41301F1001FFD84EA6685D6B96AC4CF52

Function 007D4A9A Relevance: 1.6, APIs: 1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 93accb3dcc3666a2953f583530db0ce0e59f6382f5da504c405ed56472adafbb
Instruction ID: 6337d6b9c7fe8279c31d3e7a4b858b76874d20aeff7b209d65d4ddb01a0a55a9
Opcode Fuzzy Hash: 93accb3dcc3666a2953f583530db0ce0e59f6382f5da504c405ed56472adafbb
Instruction Fuzzy Hash: 9831F4F2C046549BF310CA14EC85BBBB779EB80310F2881BAED0D56744E67D5ED68A92

Function 007DF26C Relevance: 1.6, APIs: 1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 21f130870ba8daf11d2c72f272d3562f3ec014ba20a16cec91cd9fd0ad1fe459
Instruction ID: e41126903820eadf828a27dd3fbfb67bf1704e8eca61b2ee7798dff527b65a9d
Opcode Fuzzy Hash: 21f130870ba8daf11d2c72f272d3562f3ec014ba20a16cec91cd9fd0ad1fe459
Instruction Fuzzy Hash: 7B31E7F2D0C564DBE720CA15DC44AEB7778EB85310F1082FBE80E66740D6389ED18E92

Function 0041B8BB Relevance: 1.6, APIs: 1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d091bed384ded007bf85430eae259a42af1aa21f4b2e5a193d689c59ac776884
Instruction ID: 504157baec646bca1ec3adc672a8d484a6221ae95629cf0ba7976268f0a4bb4d
Opcode Fuzzy Hash: d091bed384ded007bf85430eae259a42af1aa21f4b2e5a193d689c59ac776884
Instruction Fuzzy Hash: 7B31E5B2E441659BE7248A24DD44BFB7B79EB80300F1041BBE50E62584C63C5AC68E96

Function 0041BCF7 Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b9007f3f1fbd2257efec72ef1ae79601df59aedda758e59755f6f3c818c61e78
Instruction ID: 04bff3a93f112da24e6973f4b7ea790aa6b42c2a4a2598153d2a7b03a0871ac0
Opcode Fuzzy Hash: b9007f3f1fbd2257efec72ef1ae79601df59aedda758e59755f6f3c818c61e78
Instruction Fuzzy Hash: 4D31E4B2D441649BF7249A14ED84BEB7778EB81304F1441FBE58D62180D73C5AC68B97

Function 0041D546 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(D7402EF8), ref: 0041EB1A

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 9166f809895674462d8be835322852a26e2f80a4b239ccecbecada02d2a5b3e6
Instruction ID: e652d673572942b12103926c9685cc918835e4d5d7799d3786f29ef648ff551a
Opcode Fuzzy Hash: 9166f809895674462d8be835322852a26e2f80a4b239ccecbecada02d2a5b3e6
Instruction Fuzzy Hash: 0331FEF1D052649EEB208B24DC40BFBB7B5EF94304F1441BAD84D96245E77C0AC28B5A

Function 022FA527 Relevance: 1.6, APIs: 1, Instructions: 95fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,39335C83,?,00000000), ref: 022FAACA

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: e6b4381e3deef4c0ff7986064e0758bfcad5d63e3327b7bea908070f69ce99c0
Instruction ID: 52842bc6c44fde5f8eedaf5e03caf8b30acdab320be4abd9077272256b16b1fc
Opcode Fuzzy Hash: e6b4381e3deef4c0ff7986064e0758bfcad5d63e3327b7bea908070f69ce99c0
Instruction Fuzzy Hash: 1F31BEB1D157189FEB24CB64CD94BAAFBB8FB84301F0082FED94956284EA345E85CF51

Function 007D484D Relevance: 1.6, APIs: 1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 6674f722c78d96567fb5ad0a34485ff7d1afb9a592bfb337c3366b0ede5e6153
Instruction ID: 0841235dbf6a421efb031eb6fef2210a20a785984361e7c34f97921f8bf44d90
Opcode Fuzzy Hash: 6674f722c78d96567fb5ad0a34485ff7d1afb9a592bfb337c3366b0ede5e6153
Instruction Fuzzy Hash: D73149F2E092589BE7208A21DD40BFBB7B9EB84311F1481FBE90961641D63D6EC49A52

Function 0041C33A Relevance: 1.6, APIs: 1, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?), ref: 0041C902

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b7cb4ca851a4ce805c4a0da3f72b95b9958987f400ffcd2ae8c5a60fa371a3df
Instruction ID: 08fb8933787ed71cdf0b7a9c8021c8d0d83e44b7f69856d074964de5c0ccf509
Opcode Fuzzy Hash: b7cb4ca851a4ce805c4a0da3f72b95b9958987f400ffcd2ae8c5a60fa371a3df
Instruction Fuzzy Hash: 0F21A2B2D94115AEE7208A24DD84BFBB779EBC4310F20C1FBD40966244D67C5EC28E56

Function 0041BD21 Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 848d5300b14c9ee140e6192c77e22b6a1aa0ecf8a00ec5112174ccd371e223b4
Instruction ID: d00e8c32d7ce8432159a518b16c8bc38f0c385aee38a7f7438b8f354da6a1ccc
Opcode Fuzzy Hash: 848d5300b14c9ee140e6192c77e22b6a1aa0ecf8a00ec5112174ccd371e223b4
Instruction Fuzzy Hash: 602136B2E441A49BE7209A64DD84BEF7BB5FBC0300F2481FBD54D62580D73C0AC68B96

Function 022EF64A Relevance: 1.6, APIs: 1, Instructions: 88fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 022F0631

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a646f53c7d5b84a08dc12fc132998f0816ec5baf9f6a5415037b30a4931941e3
Instruction ID: 9f23e455b87937ebc518ff7a84b77d0f53642e07eb0838022f4852e0ad6a5886
Opcode Fuzzy Hash: a646f53c7d5b84a08dc12fc132998f0816ec5baf9f6a5415037b30a4931941e3
Instruction Fuzzy Hash: FE315B72D112254BF7218A64CD98FEB7B74EB40310F0102FAD90E675D4D6781B85CE91

Function 0041D596 Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(D7402EF8), ref: 0041EB1A

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 049345b425538f16508c784c72a48ad2c5a1be648f90bdf72d4d9c7c2e8dc4fe
Instruction ID: 9593f0815f388715bdd42da103e85223d200683214fca81f38b0505d88904f90
Opcode Fuzzy Hash: 049345b425538f16508c784c72a48ad2c5a1be648f90bdf72d4d9c7c2e8dc4fe
Instruction Fuzzy Hash: A531F2F2D056645EEB108B25DC84BEBB7B5FF94310F1081BAD44D96244E77C0AC28B66

Function 007E4891 Relevance: 1.6, APIs: 1, Instructions: 88threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 007E5D29

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: c0042bcded03c78f899974201258eead66cba8bca6fb14314fa3fe3f830e0936
Instruction ID: deb899a4f7b61cc549376dc7231cd4b785dbe85ca3c2fb8e00366afcf39d523f
Opcode Fuzzy Hash: c0042bcded03c78f899974201258eead66cba8bca6fb14314fa3fe3f830e0936
Instruction Fuzzy Hash: 7921BEE3D404046EF3104525FC89FEB263DEBC4320F2E807AE90DD6581D07D9AC54662

Function 007E45F9 Relevance: 1.6, APIs: 1, Instructions: 88threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 007E5D29

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 5103e1a3b557e696ef8c4a56aec5d5e67d576db233f803b29b29af34090a8708
Instruction ID: 928c8ae9de5212fe9e077ba785269580ec6fba18c201ec7fd8bca3a1e2ce45b8
Opcode Fuzzy Hash: 5103e1a3b557e696ef8c4a56aec5d5e67d576db233f803b29b29af34090a8708
Instruction Fuzzy Hash: 8321BBE3D409046EF3104575FC8DFEB2A2DEBC4320F1A807AE90D96581D07D9AC546A2

Function 022F5C6C Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 2e761311dcf254a8038dd50cedc3964843ec7a0fc0d43c95795a56b2b2571bbe
Instruction ID: 626e5942474839f6b7ac70a29f489cbe3722620c9ab402bb7e84c7ea2d7af5a1
Opcode Fuzzy Hash: 2e761311dcf254a8038dd50cedc3964843ec7a0fc0d43c95795a56b2b2571bbe
Instruction Fuzzy Hash: D921E9B2D24619ABE7248A90DC44FEBB378EB84311F0441FDE90E56284E77D5AD1CF92

Function 0041D588 Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(D7402EF8), ref: 0041EB1A

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 9144e7f5a9c0bac8705eb5cbcc68d7447ee0829963f19968626df032378619c9
Instruction ID: bec38ef65f7426005587853f5cd2280205496c0e3387c0f44631cef7f1ed3ce0
Opcode Fuzzy Hash: 9144e7f5a9c0bac8705eb5cbcc68d7447ee0829963f19968626df032378619c9
Instruction Fuzzy Hash: CC3122F2D052649EFB108B24DC84BFB77B5EF95300F1481BBD84D96245E77C0AC28A5A

Function 0041B8FC Relevance: 1.6, APIs: 1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 4f5d5a4f2a23aa370561da98a2559f042077d2f538b1c64122a59a2202be86c0
Instruction ID: 919cf333947c51c194ee1d204399548295e76f8a7979637d998e4dcc910bc384
Opcode Fuzzy Hash: 4f5d5a4f2a23aa370561da98a2559f042077d2f538b1c64122a59a2202be86c0
Instruction Fuzzy Hash: BD21E5B2E481649BF7249A28DD44BFB7B78EB80300F1441FFE54E61584DA3C5BC68B96

Function 022F00C5 Relevance: 1.6, APIs: 1, Instructions: 85fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 022F0631

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c18f5c126d3ec040645338ecd1faa57720a9c515bca7797a8e43625942605cdb
Instruction ID: a6b966fbdd7a86926e2d7d279eb3e077b8409bda20fd8e725802803ec26b6a2a
Opcode Fuzzy Hash: c18f5c126d3ec040645338ecd1faa57720a9c515bca7797a8e43625942605cdb
Instruction Fuzzy Hash: 02217CB1D252985FE7218B64DC94BEABB34EB41320F1401FEDA489B1C7D6781F85CB11

Function 0041E9D8 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(D7402EF8), ref: 0041EB1A

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: b9959513abbd2a1dad26b98798810d45bdbc62ac6d9d338d7a7ab732c6ecd391
Instruction ID: c876375216a2e9770c2f7fc7b6ce0da2900cfac5bdd6962dc4c502a2f0846c35
Opcode Fuzzy Hash: b9959513abbd2a1dad26b98798810d45bdbc62ac6d9d338d7a7ab732c6ecd391
Instruction Fuzzy Hash: AE2103F2D00024AEF728CA55DC99AFBB774EF80311F2481BFD91A56280D6381EC58E96

Function 022FA48A Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 5490b07fad91f1e92dbd914d3a3a65b9f62b81e61c07d8fc1cf713a53a9f7077
Instruction ID: 7d7b4f0901087de599215da310febe601d7631dd4462794ae0b052067efbd707
Opcode Fuzzy Hash: 5490b07fad91f1e92dbd914d3a3a65b9f62b81e61c07d8fc1cf713a53a9f7077
Instruction Fuzzy Hash: 0321F1F2D14614AFF720CA29CD84BBBB7B9EB84310F1481F9E90D92644E6385B85CE52

Function 007CB696 Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 7ac8ba915d8f3e30ece8aad8a2698d2b7831ab89c4df0e5b2c596162248637b4
Instruction ID: 8fbaeb3410fc38f374b5cea050dd5ec5231d4ff14487d6f4b72b0065eaaae30e
Opcode Fuzzy Hash: 7ac8ba915d8f3e30ece8aad8a2698d2b7831ab89c4df0e5b2c596162248637b4
Instruction Fuzzy Hash: 0C21C3F2E185189BF720CA14DC54BEA77B8EB84300F1482FBE50ED6241E73D9EC08A51

Function 022E7D73 Relevance: 1.6, APIs: 1, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(FFFFEB3C,00000000), ref: 022E7E67

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: c190859babafead3dafa9400205d07213e933e07b9addcf88b458c6e3da520fa
Instruction ID: 88b428c9048669aa52f2cd52f103cde3c9c6f9b009139bb5a2430203aff29432
Opcode Fuzzy Hash: c190859babafead3dafa9400205d07213e933e07b9addcf88b458c6e3da520fa
Instruction Fuzzy Hash: 4131E5B2E146254BFB308A55DC44BFBBB75DB80311F4481FAD80DA6684D7782FC58E51

Function 0041B850 Relevance: 1.6, APIs: 1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d0b0b600e115e13be73deda8f0e91418f5e1e76fb42ef3ed69b5a3cf51d09dce
Instruction ID: 89296fae9905840c96aedbc97f0a25a67150922b4a299720c405fd992c46ff51
Opcode Fuzzy Hash: d0b0b600e115e13be73deda8f0e91418f5e1e76fb42ef3ed69b5a3cf51d09dce
Instruction Fuzzy Hash: 0721F4B2E441649BE7248A24DD44BFB7B78EB80300F1441FBE54E62680D63C5BC68BD6

Function 022EF5D8 Relevance: 1.6, APIs: 1, Instructions: 80fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 022F0631

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4e4bfaec29d5acb4d1e7f20096acdcb55a1c559112d3ab994b38ef1c0e6d106c
Instruction ID: f7c9ccb1c17628fb7240c21367909a21f43df699e3bb6f5ea05ee468cbb93767
Opcode Fuzzy Hash: 4e4bfaec29d5acb4d1e7f20096acdcb55a1c559112d3ab994b38ef1c0e6d106c
Instruction Fuzzy Hash: 40212672D142298BEB218A68DD98FDABB74AB40310F0002FAD90E675D5D7B81BC4CE91

Function 0041BD3C Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 3f7f104f813742eb250b82f35265417ee0a00ee756ec41f5950ba2198eb1fc36
Instruction ID: dbfb1aa1a663d21a7839373e1c61584fb64a7d54a8508add7e40311eaaf2f27f
Opcode Fuzzy Hash: 3f7f104f813742eb250b82f35265417ee0a00ee756ec41f5950ba2198eb1fc36
Instruction Fuzzy Hash: 3F2106B2E441649BE7248A14DD84BEB7778FBC0300F1481FBE54E62580D63C5BC68BD6

Function 0041BD8C Relevance: 1.6, APIs: 1, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?), ref: 0041C902

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: cb4ed7e8ac2a7728a9a680d916bc9e8961df88ea75702eb88eaed2c96c1a99a0
Instruction ID: 71a042a2a4bceed1098f5dad328c48339e819107fd2b46fe29d0de180579e361
Opcode Fuzzy Hash: cb4ed7e8ac2a7728a9a680d916bc9e8961df88ea75702eb88eaed2c96c1a99a0
Instruction Fuzzy Hash: 8C21D4B3A44654AAF7148614ED84FFB7BB9EB80310F1441BBE20A55580DA3C5BC68BA6

Function 022E8CCE Relevance: 1.6, APIs: 1, Instructions: 77registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,FFFFEADA,00000000,000F003F,FFFFF5C2), ref: 022EA26A

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 4e7ecd55da1e81811e3e855f9aa5064328136d8286c56697ca067755ada20421
Instruction ID: a04c30af73ab6f8731f90d9b813a2567c877e03911e9a2fb60d06821de925f39
Opcode Fuzzy Hash: 4e7ecd55da1e81811e3e855f9aa5064328136d8286c56697ca067755ada20421
Instruction Fuzzy Hash: BE2133B2D26128AAEB208651CC00BFFB675EF90304F5540FBF54E65094E6B80AC0DEA2

Function 022E9144 Relevance: 1.6, APIs: 1, Instructions: 77registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,FFFFEADA,00000000,000F003F,FFFFF5C2), ref: 022EA26A

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 1de6ab79ea6754565818f523816dbdd40fad1e3c1fa3052635a970bb8e861ef5
Instruction ID: 138cb9db0c089811f12eb803198020825b7a341f9982491a6d64d5cbfe9bb56d
Opcode Fuzzy Hash: 1de6ab79ea6754565818f523816dbdd40fad1e3c1fa3052635a970bb8e861ef5
Instruction Fuzzy Hash: 9C2128F2D34154AFEB308A95DC48BEB7678EB50300F5540FBD90E62584E2B95BC4CE52

Function 022EFA39 Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 022F0631

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 302522d9e6883326e24055ee094e18312e2ee0f7ee7da6e2100ee6b496b1eb25
Instruction ID: 6dc4da89a97e74c84457c849248cf2cd26e83bfbfc4fe10a32c6e64b315a9e0f
Opcode Fuzzy Hash: 302522d9e6883326e24055ee094e18312e2ee0f7ee7da6e2100ee6b496b1eb25
Instruction Fuzzy Hash: 58213B72D142298BEB318B68CD98FDAB774AB40310F0102FAD90E675D5D7B81BC5CE81

Function 022E8A41 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 0265b2d1b4b85b21bbb1218fb8f44e44ccff40ffc76afd888dcde0b40aed9b1d
Instruction ID: 71e7931703c12b02992087931b435eb765742cf18cb57e08e3bdd94c3df16cee
Opcode Fuzzy Hash: 0265b2d1b4b85b21bbb1218fb8f44e44ccff40ffc76afd888dcde0b40aed9b1d
Instruction Fuzzy Hash: 1B2149B2C351586EEB208A50CC50BFB7778EB40304F5841FAE40EA6691D7B94BC4DF52

Function 007D443F Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 567e7bcc2e5bd6e346f83b58f8d4432d9a075bb944f0c356d55f5feddd66499f
Instruction ID: fa2cd71628e1ca4be8c74b177138f903e88c6f15344da2d06eef215875f19a49
Opcode Fuzzy Hash: 567e7bcc2e5bd6e346f83b58f8d4432d9a075bb944f0c356d55f5feddd66499f
Instruction Fuzzy Hash: 4C2145B1E091849BE720CA25DC04BFBB7B8EBC4311F1481FAE909A2241D6396EC4CF52

Function 022EA177 Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,FFFFEADA,00000000,000F003F,FFFFF5C2), ref: 022EA26A

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 70ab9f3f4347d020bdd2293d48903f7f03f1e67f2b2edc572668a5108298a82f
Instruction ID: c081be5b42fb7ff9ce6e304ff68dad766b5c5c927f9fa90c2d7a7bc5f4ae50c3
Opcode Fuzzy Hash: 70ab9f3f4347d020bdd2293d48903f7f03f1e67f2b2edc572668a5108298a82f
Instruction Fuzzy Hash: 67210572C256A48BFB208B60CD84BEA7BB5EB40315F0481F7D84EA6185C2B85AC5CF51

Function 022F5387 Relevance: 1.6, APIs: 1, Instructions: 73fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 022F68AD

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: fbed3d3934b996eb3212916d1eb70aeeea9ffcc4c3307835b0b1ddd71548b367
Instruction ID: 3bf63769d0a9b93aa1f3992feefb91c20f044b4eeb8042f66215101bdc909412
Opcode Fuzzy Hash: fbed3d3934b996eb3212916d1eb70aeeea9ffcc4c3307835b0b1ddd71548b367
Instruction Fuzzy Hash: 9F21D6B2E2011A9BEB308A44CC04BFBB6B5EBC5315F4441B9E90DA5684D3BD4AD1CA51

Function 022E8D4D Relevance: 1.6, APIs: 1, Instructions: 73registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,FFFFEADA,00000000,000F003F,FFFFF5C2), ref: 022EA26A

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: d91e2db89aeaa30e50cba2b6adc20e440368518ccfa42fb5d2706fc8610f1f33
Instruction ID: 3ab4a2338689b667029a4fdbcc64836595db020f4be102075a290b13789fea42
Opcode Fuzzy Hash: d91e2db89aeaa30e50cba2b6adc20e440368518ccfa42fb5d2706fc8610f1f33
Instruction Fuzzy Hash: 9D2136B1D266689AEB248A50CC44BFEBB70EB50314F5400FAF58E65494C6F80BC0DF92

Function 022E921F Relevance: 1.6, APIs: 1, Instructions: 71registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,FFFFEADA,00000000,000F003F,FFFFF5C2), ref: 022EA26A

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 3529d330c929f801c621ea0765c7233ca741c5b8bda4c2a840b63e527d07dd5c
Instruction ID: 5ea10bfdf7e1b2026e4e25de670650760fc5b9eac560e8ed1bc0cd6374a4f659
Opcode Fuzzy Hash: 3529d330c929f801c621ea0765c7233ca741c5b8bda4c2a840b63e527d07dd5c
Instruction Fuzzy Hash: DC2101F2D39108ABEB308A94DC99BEA7278EB50300F4540FBD90E61980E2B51BC4CE12

Function 022E966A Relevance: 1.6, APIs: 1, Instructions: 71registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,FFFFEADA,00000000,000F003F,FFFFF5C2), ref: 022EA26A

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 9c4f470adf2259842180923379e1cd556dffa241d78c08a44aacf46f3ea8b6b3
Instruction ID: d3f4ba301b9db619932c45fcea032ab216f1bcb79ae8b61b638e3531eb05beca
Opcode Fuzzy Hash: 9c4f470adf2259842180923379e1cd556dffa241d78c08a44aacf46f3ea8b6b3
Instruction Fuzzy Hash: 102104F2D34118ABEB308A55DC89BEB7278EB50300F4500FBE90E61980E2B95BC4CE12

Function 022F01BE Relevance: 1.6, APIs: 1, Instructions: 71fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 022F0631

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 671833b1b26f090a747c19c6b50152c714d6dd0d3789224d8d7bbf4958c5c235
Instruction ID: 8ee8d481d686c98e79a7ada1899cd38433da8846b5c860a4ef2cfdc6b4c43d7d
Opcode Fuzzy Hash: 671833b1b26f090a747c19c6b50152c714d6dd0d3789224d8d7bbf4958c5c235
Instruction Fuzzy Hash: D32138B19152585BF7648A28DCA1FBA7738DB41310F1042FED64A662C6D6B42F81CE51

Function 022E9159 Relevance: 1.6, APIs: 1, Instructions: 70registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,FFFFEADA,00000000,000F003F,FFFFF5C2), ref: 022EA26A

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 99957187a687982ef8e2ba304ce17231b832643a27124a9930a5b667b6ee6dbc
Instruction ID: c24a3572b1ce1eb905d9c3a16b273fde9df5bc62e84fdb9581cdf21b2e23c71b
Opcode Fuzzy Hash: 99957187a687982ef8e2ba304ce17231b832643a27124a9930a5b667b6ee6dbc
Instruction Fuzzy Hash: 8D21F6F2D351199FEB308A94DC54BEB7278EB50300F5541FBD90E61984E2B95BC4CE12

Function 007D44D1 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: f8bd147a3e07e2cd21aad9145d837a0ccda21a954087a85e26ddd23365dbadab
Instruction ID: ee716aa31a323ca6f5426679212de44661d528240f423d939695cc42ec057af4
Opcode Fuzzy Hash: f8bd147a3e07e2cd21aad9145d837a0ccda21a954087a85e26ddd23365dbadab
Instruction Fuzzy Hash: B72146F2E091889BE720CA24CC50BFAB7B8EB84301F1445EAE509A2241D6389FC48F56

Function 022E8A6D Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,FFFFEADA,00000000,000F003F,FFFFF5C2), ref: 022EA26A

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 5e25c4ded7c59c974a91bf9071df71d64874743663324bf0fdec0ca285fb1731
Instruction ID: 41117ccf857bfe53866a2baf9838eb38b87c788254b733ed7fb18e7b2b139900
Opcode Fuzzy Hash: 5e25c4ded7c59c974a91bf9071df71d64874743663324bf0fdec0ca285fb1731
Instruction Fuzzy Hash: A02149B1C36168AEEB208B50CC04BEB7674EF40301F5841FEE14E66195D3B84AC4DF52

Function 022F57A0 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 76220f3977faf2e3810cccb7ec2d882e13e748c8a73078adb8f95f4eeb663ede
Instruction ID: 97a82713f215016cfe696bb01d9ccd06e3d54de74dc2e953c5179b3d1e048241
Opcode Fuzzy Hash: 76220f3977faf2e3810cccb7ec2d882e13e748c8a73078adb8f95f4eeb663ede
Instruction Fuzzy Hash: B4212BB2D106199FE724CA94DC84FEBB3B8DB84312F0042FDE50A96240E7795AC1CE41

Function 0041C57A Relevance: 1.6, APIs: 1, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?), ref: 0041C902

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: e884ea3615f68915cd6486771df87ec3aaadeaf914bbce31f6b6b38778d638cd
Instruction ID: 63cc06720d77cb964a1069a501748f8c6d40e600055f4cac379066f209d2a74e
Opcode Fuzzy Hash: e884ea3615f68915cd6486771df87ec3aaadeaf914bbce31f6b6b38778d638cd
Instruction Fuzzy Hash: 5521AFF2E40115ABE724CA14DE88BFE7779FB84310F1481FAD90D66244D638AEC28F95

Function 022E921A Relevance: 1.6, APIs: 1, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,FFFFEADA,00000000,000F003F,FFFFF5C2), ref: 022EA26A

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: c2a2bdab9c243af4cb519b36f68e307da4319053efb604ee285be201faf50008
Instruction ID: 238ce576bb21e8e0f263c7c35d1c3261f3c109d33e0629d23d487f9da7e9cd82
Opcode Fuzzy Hash: c2a2bdab9c243af4cb519b36f68e307da4319053efb604ee285be201faf50008
Instruction Fuzzy Hash: F421D1F2D39158ABEB308A95DC98BEA7278EB50300F5540FBD50E61984E2B55BC4CE12

Function 022E92A6 Relevance: 1.6, APIs: 1, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,FFFFEADA,00000000,000F003F,FFFFF5C2), ref: 022EA26A

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: eb5476e9ed882e8772a81337230b44f7ccf5fad165375b1ee90bfe5bc73de986
Instruction ID: 1284ae3a3c0c36ff2c09c56f3522c79feda5688c3a526ed5eb7fffc8c9d740dd
Opcode Fuzzy Hash: eb5476e9ed882e8772a81337230b44f7ccf5fad165375b1ee90bfe5bc73de986
Instruction Fuzzy Hash: 912108F2D39158AFEB308A55DC54BEB7278EB54300F5540FBD50E61984E2B55BC4CE12

Function 022EFA80 Relevance: 1.6, APIs: 1, Instructions: 66fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 022F0631

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 002d46e56dcb70966dcba9d782b7e4b50c92d3d8b088ce6d18ba8c3b3d1a460a
Instruction ID: 063185b04518e2ee6480dc664a19625656255fb8c05830f5666d8b16d7da8d7b
Opcode Fuzzy Hash: 002d46e56dcb70966dcba9d782b7e4b50c92d3d8b088ce6d18ba8c3b3d1a460a
Instruction Fuzzy Hash: 0D213572D012284BEB218B38CC98BDABB74AB41720F0106FAD94D67595C7741BC5CE81

Function 007E51F2 Relevance: 1.6, APIs: 1, Instructions: 66threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 007E5D29

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 1685995db14b4bea56df49c13a2b509e959ebb4a311b873e9a540b6b9ce7f894
Instruction ID: 3a1bf48bc645c4e2f8cc15e2535d6df9cc311f0dfcaa2d6b186dd3ccf55852b3
Opcode Fuzzy Hash: 1685995db14b4bea56df49c13a2b509e959ebb4a311b873e9a540b6b9ce7f894
Instruction Fuzzy Hash: D31108D3E558486EF3004561FCC9EEB262EDBD4324F2E80B6E90DCA941D07E9AD64662

Function 022FA740 Relevance: 1.6, APIs: 1, Instructions: 65fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,39335C83,?,00000000), ref: 022FAACA

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 854baa137cda90bea313041d47012f516bbef07c055070cb6eebf0baa5c348e8
Instruction ID: c3f338dc784afecd9db0aef225a0a8220056253d14f25217a00ddb8f2e79d858
Opcode Fuzzy Hash: 854baa137cda90bea313041d47012f516bbef07c055070cb6eebf0baa5c348e8
Instruction Fuzzy Hash: DF217FB1D246289FEB24CA48DDA0FEAB774AF04302F0041FAE90E67201D6756EC4CF91

Function 022E6A86 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(FFFFEB3C,00000000), ref: 022E7E67

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 01a6f4679bab0bb084f1b527c2e7f0981c8e3fdde600de4d045d4f4fd0456e77
Instruction ID: d3704b25bf868e3b3f08ff84f94935d45c0a75898e8cbb7bf63c695bc191765d
Opcode Fuzzy Hash: 01a6f4679bab0bb084f1b527c2e7f0981c8e3fdde600de4d045d4f4fd0456e77
Instruction Fuzzy Hash: 4421C3B2D106195FFB208B25CC44AEBBF39EB81311F0481FAD80D96684D6B89EC5CE51

Function 022F0590 Relevance: 1.6, APIs: 1, Instructions: 64fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 022F0631

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b72da2fd78545d2c65cb088d7dd609ffdd2ebad56d13971b67a4d5f196caee99
Instruction ID: 93a1c69b63c3d405109444628f6dd7a711cfb547795506ef5b113dadb8fc473a
Opcode Fuzzy Hash: b72da2fd78545d2c65cb088d7dd609ffdd2ebad56d13971b67a4d5f196caee99
Instruction Fuzzy Hash: F91172B1D153589FF7608A14CC90BEAB775E781310F1086FAD549561CACBB81BC5CB41

Function 0041D668 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(D7402EF8), ref: 0041EB1A

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 05e3a607d241241facb8610d77570649f2c2fae76727c92e1860b4efc56f2fc4
Instruction ID: afdd1b5bf88c651636b31b67bbddffc0dbf128731cd74242ecac539dd7d47ccb
Opcode Fuzzy Hash: 05e3a607d241241facb8610d77570649f2c2fae76727c92e1860b4efc56f2fc4
Instruction Fuzzy Hash: F81129B2D015645AF7244B25DC48BEA7BB1EB91320F1002FFD45D551C0EB7D0AC18F56

Function 007C1E6B Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 6b541a12ba665e008a4f3aa36bc641e822c91e9bad5921215ce32a19ba45a317
Instruction ID: 1359aa6ce47e2ce96af88c93b4481c247ad19574fa2c499268420073b99839f0
Opcode Fuzzy Hash: 6b541a12ba665e008a4f3aa36bc641e822c91e9bad5921215ce32a19ba45a317
Instruction Fuzzy Hash: A21136B1A091989BE730CE25CC54BFBB7B8EB84301F1045EEE509A2685D6399E84DF52

Function 022EF189 Relevance: 1.6, APIs: 1, Instructions: 63fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 022F0631

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 6e57e2c517c4625da8b1c4a78b9fa58f442a00acda9bd194a43a020ad8e1fffe
Instruction ID: 57c3e65c0e84152a142f3a48ea187c34acf1ac86a67dfd4accec8dc7d8588e22
Opcode Fuzzy Hash: 6e57e2c517c4625da8b1c4a78b9fa58f442a00acda9bd194a43a020ad8e1fffe
Instruction Fuzzy Hash: ED11D0B1D153095FFB348A24DC90BB6B734E780320F1043FAEA4A5A1C9C3B81BC5CA42

Function 022EEE8A Relevance: 1.6, APIs: 1, Instructions: 62fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 022F0631

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 6363c8ccd778124f0df8578606da49ed3c5de348fc8513d32805d28a2febfea9
Instruction ID: e69831cca0c016c33edf091933f291f845c9b8444994e53ab22025e5cb9e0cea
Opcode Fuzzy Hash: 6363c8ccd778124f0df8578606da49ed3c5de348fc8513d32805d28a2febfea9
Instruction Fuzzy Hash: 0C1180B19253095FFB358A68DC54BBA7774DB81720F1043FAE68A5D0C9C7B41BC5CA41

Function 0041584E Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

K32GetPerformanceInfo.KERNEL32(?,00000038), ref: 004158CC

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: InfoPerformance
String ID:
API String ID: 3070290716-0
Opcode ID: cac4fa0d9d1d9c18d144994956350a29e95c9542f02bb6636dfc131eff03a664
Instruction ID: e0f8179c1336ac81cc45ba5832bc162a7c5ace26956e0bd301f146446026f0c6
Opcode Fuzzy Hash: cac4fa0d9d1d9c18d144994956350a29e95c9542f02bb6636dfc131eff03a664
Instruction Fuzzy Hash: BB315275905A188FCB28CF18CE84BD9FB75FB88309F1082EAD00DA6258C7755BC5CE05

Function 022EA10D Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 254ebdd155409af2551e41d2522a63f30feff7995dc649f73a2cbd0b74139e86
Instruction ID: 11e52c8c848116571439df8287b4daa804f8d0c29dd9844588dbb41a6b10ddae
Opcode Fuzzy Hash: 254ebdd155409af2551e41d2522a63f30feff7995dc649f73a2cbd0b74139e86
Instruction Fuzzy Hash: 1921D271C256A48FDB20CB50CC847EEB7B5FB44305F0480EBD94AA6146C6B41EC4CF50

Function 022EEE84 Relevance: 1.6, APIs: 1, Instructions: 59fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 022F0631

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f27b85954b88c366400a83c51c576daa0a572211ffb8237635578323b53cd7c6
Instruction ID: 2870ca420c47869d5cd298ecdf961ff411d9253421471e2f4c7833bc656a473f
Opcode Fuzzy Hash: f27b85954b88c366400a83c51c576daa0a572211ffb8237635578323b53cd7c6
Instruction Fuzzy Hash: D9115CB19253089EFB258A68DC54B767774D781720F1443FAE64A590C9C7B41BC5CA42

Function 022E9D59 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: c17844cae46d717957b5ec3751cf5d60f20433d6ef1f288ea4d3264f26aa762f
Instruction ID: 0be755510ef8013ba54adbdcd2015e7ab59247b3a01d0c413e555cf8286026a2
Opcode Fuzzy Hash: c17844cae46d717957b5ec3751cf5d60f20433d6ef1f288ea4d3264f26aa762f
Instruction Fuzzy Hash: A2214071D1A7A45FEB25CB20CC446EA7F74AB01301F0441FFC84E6A596C6B91AC4CF42

Function 0041E7E6 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(D7402EF8), ref: 0041EB1A

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 3df9edadc7478aba76dcaf909d1eb47501a4305910041f09022907ad6128504b
Instruction ID: 3317f061348198a0b33bf00933f66bff60d60a2551b3d44ca44322a4b44b435e
Opcode Fuzzy Hash: 3df9edadc7478aba76dcaf909d1eb47501a4305910041f09022907ad6128504b
Instruction Fuzzy Hash: 961101B59040588FEB54DF55DCC96EAB7B1EF84301F1082EAC84A46285DA3869C68E56

Function 007DB057 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

VirtualProtectEx.KERNELBASE(?,?,00001000,00000040,?), ref: 007DB3C8

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 855f08c16e881d70812eebe6eb252f3a9f2055de863e35d2e2738adac9057ebb
Instruction ID: 58d323872f8bea556970589dc5b51710b375d6762c3f0d58629742a6b4349fce
Opcode Fuzzy Hash: 855f08c16e881d70812eebe6eb252f3a9f2055de863e35d2e2738adac9057ebb
Instruction Fuzzy Hash: A511C8B1D04618DBD724CB14DC81BDA7775EB84300F1441EAD50D67341D739AE818E91

Function 022E96B3 Relevance: 1.6, APIs: 1, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,FFFFEADA,00000000,000F003F,FFFFF5C2), ref: 022EA26A

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 7aa4ae24464e4bdfefd7129ab4da7f1198522759b3380c79b3550a7cab3def5f
Instruction ID: cfc900f1246128930c571f17cdda0f51aa6139b4f7b9f377375db07a5c148de7
Opcode Fuzzy Hash: 7aa4ae24464e4bdfefd7129ab4da7f1198522759b3380c79b3550a7cab3def5f
Instruction Fuzzy Hash: 011123F2D38148AFEB308A64CC84BEB7678EB50700F4540FBE50E61984E2B55BC4CE11

Function 022F0168 Relevance: 1.6, APIs: 1, Instructions: 55fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 022F0631

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 702eea0ceed8dbc681b900edadad1d1885e62711eceb83df685284be67cf6af5
Instruction ID: 8025cffe3fb911a0188a49160d50d236baa72ca6b6fce68e6fa076e1777c5ff2
Opcode Fuzzy Hash: 702eea0ceed8dbc681b900edadad1d1885e62711eceb83df685284be67cf6af5
Instruction Fuzzy Hash: EB1159B1D552285BE7308624CC91FEABB38EB80B20F0042FADA496A1C6C6781B91CB41

Function 004154DC Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

K32GetPerformanceInfo.KERNEL32(?,00000038), ref: 004158CC

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: InfoPerformance
String ID:
API String ID: 3070290716-0
Opcode ID: e06ce30df0be77a559fc3103ab0d8d0aaa9ca89f47a410b210127fc1c860b9a0
Instruction ID: 70af6eed08bcfcf3a402eddf7fda24e49447667fe55ceb5b221fb891d81c8d11
Opcode Fuzzy Hash: e06ce30df0be77a559fc3103ab0d8d0aaa9ca89f47a410b210127fc1c860b9a0
Instruction Fuzzy Hash: 96215175D046298FCB28CF18CE94AD9FB75EB48309F1481E9D40DA7254C3796BC8CE45

Function 022F020A Relevance: 1.5, APIs: 1, Instructions: 49fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 022F0631

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d03b1a99256eb793bc367fa8b606990c745c3fdea4c7ef24c76f716cae697b09
Instruction ID: 1c7f9fdd54859de1c9fccc494a1fdfa59d1251a62f4e8877334ac23e71ccd27f
Opcode Fuzzy Hash: d03b1a99256eb793bc367fa8b606990c745c3fdea4c7ef24c76f716cae697b09
Instruction Fuzzy Hash: B41126719153589FE7618B28DCA1FA9B774AB81710F2042EAD6896A1C7C7701B81CF41

Function 022E96CD Relevance: 1.5, APIs: 1, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,FFFFEADA,00000000,000F003F,FFFFF5C2), ref: 022EA26A

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 4b636a61464bd5102a1b6dff0e5542d5e4d70f07dfdb61ad567fac1c89f86763
Instruction ID: f23a26cb2231e89ebbc3b5c8a880302d5436d331a209b50d0b2f5d643e36bca7
Opcode Fuzzy Hash: 4b636a61464bd5102a1b6dff0e5542d5e4d70f07dfdb61ad567fac1c89f86763
Instruction Fuzzy Hash: 511104F2D255589BEB308B65CC48BEEB2B4EB94700F0540FB944E62980D2B45BC4CE11

Function 022E79BD Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(FFFFEB3C,00000000), ref: 022E7E67

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 8a8688deb6b226e429a56965ba1d20ac4196ff0fe194614f817ec5f9e593a55d
Instruction ID: aef7505f786eefb1896a8f2d4e6a9ffedaf0b4b52d99238e799ea2c063978b85
Opcode Fuzzy Hash: 8a8688deb6b226e429a56965ba1d20ac4196ff0fe194614f817ec5f9e593a55d
Instruction Fuzzy Hash: 5E016DB1E106199BEB308B15DC45AFBBB79EB80301F0440FAD80E96640D774AFD4CE11

Function 022E8DB7 Relevance: 1.5, APIs: 1, Instructions: 46registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,FFFFEADA,00000000,000F003F,FFFFF5C2), ref: 022EA26A

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 509eecbf96ab9ca6614fd52422842ab530bf517f364b0c68bf39e5d6410553ad
Instruction ID: 0631fd9d37e3316a44417e2ad9900c58d0cb84b1545d5277c3dafa269e96b266
Opcode Fuzzy Hash: 509eecbf96ab9ca6614fd52422842ab530bf517f364b0c68bf39e5d6410553ad
Instruction Fuzzy Hash: 5401F9B2D364689AEB208690CC04BEFB674AF50305F4500FBE60E76495D3F81BC4DE92

Function 022F0218 Relevance: 1.5, APIs: 1, Instructions: 45fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 022F0631

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: fdbb1252a7bd6ef2ef06eea0bf7dbbbcf46185376a741ac746e6febf66c53bc0
Instruction ID: 68c77048ef86c0540669555802af1275baec5a6960176492a7272555a500b7e5
Opcode Fuzzy Hash: fdbb1252a7bd6ef2ef06eea0bf7dbbbcf46185376a741ac746e6febf66c53bc0
Instruction Fuzzy Hash: 8A01F5709553584FEB218B28CCA0FA9B774EB81710F1047EAD689AA1C6CB701B81CF40

Function 022E8AB4 Relevance: 1.5, APIs: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,FFFFEADA,00000000,000F003F,FFFFF5C2), ref: 022EA26A

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 6711f7ed6418b7fe12e1aa74db560aeefdb69f426a3cb729a3ddfeca8c080b19
Instruction ID: 2dd6eefb13ed5c1f20913b478bfa9e4dcb88fc2309c49a5505d9b1add4e3d41e
Opcode Fuzzy Hash: 6711f7ed6418b7fe12e1aa74db560aeefdb69f426a3cb729a3ddfeca8c080b19
Instruction Fuzzy Hash: C50124B2D36468AAFB208680CC04BEB7664AB40305F0900FAE50E26194E7F91BC4DE93

Function 0041545F Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

K32GetPerformanceInfo.KERNEL32(?,00000038), ref: 004158CC

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: InfoPerformance
String ID:
API String ID: 3070290716-0
Opcode ID: 7f383bb5423532cd1d81faa130cb64201a1d037c1e136f84da3ac0c7dfa93b38
Instruction ID: d293f64c5f5a877bd7551b67b84384ca01d22a03d1e676f115613057efd1ce6d
Opcode Fuzzy Hash: 7f383bb5423532cd1d81faa130cb64201a1d037c1e136f84da3ac0c7dfa93b38
Instruction Fuzzy Hash: 1D213C75D056298FCB28CF18CE84AD9FB75AB8830AF1482E9940D67258C7755BC8CE45

Function 022EF26E Relevance: 1.5, APIs: 1, Instructions: 44fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 022F0631

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f9833ff7548dc34194a1a6c9d461927081ce3e26c9a2aec48d0e6202a897872b
Instruction ID: bab433070c71a119789b4a138c25ea8585b1c7e7c42a32bff853157384065042
Opcode Fuzzy Hash: f9833ff7548dc34194a1a6c9d461927081ce3e26c9a2aec48d0e6202a897872b
Instruction Fuzzy Hash: 690142B19593689FE7708A28DCD0F69B770AB81720F1103EAE68A6A0D6CB7456C5CB41

Function 022E8AC7 Relevance: 1.5, APIs: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,FFFFEADA,00000000,000F003F,FFFFF5C2), ref: 022EA26A

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 293dab4e1355e5125a87ed83789587c12ea351b42e098c2fe4145b1cc50b38fe
Instruction ID: 90b1c0ab92c213512870e6879637cc1c778f029f2e8d61c5ca712df440ed5dc6
Opcode Fuzzy Hash: 293dab4e1355e5125a87ed83789587c12ea351b42e098c2fe4145b1cc50b38fe
Instruction Fuzzy Hash: C501F2B2D364685AFB208A80CC04BFB7664EB90306F0540FAE64E76081D7F80BC49E92

Function 022E8DD0 Relevance: 1.5, APIs: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,FFFFEADA,00000000,000F003F,FFFFF5C2), ref: 022EA26A

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 163967fcde1e136bf2274517dab0ea1a076f66841ecc9e39ef10a25b3bb86b60
Instruction ID: 789b41267ed6e1f2ee1eccb0caf1203f03c1b81ed7115a3e2d967ca15f6de659
Opcode Fuzzy Hash: 163967fcde1e136bf2274517dab0ea1a076f66841ecc9e39ef10a25b3bb86b60
Instruction Fuzzy Hash: 670128B2D365A85AEB308A50CC04BEBBB74AB40305F0940FAE54D76081D7B90BC4DF92

Function 00414577 Relevance: 1.5, APIs: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

K32GetPerformanceInfo.KERNEL32(?,00000038), ref: 004158CC

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: InfoPerformance
String ID:
API String ID: 3070290716-0
Opcode ID: d1ee04c2fbe6a15381bd68ff7bf9d17b519d95fb6b56b8dc6bcd39029a38916b
Instruction ID: 6ff44a3d5f877eb970b508e6ee8b5510f4790d54a333420b659381e4788db7c9
Opcode Fuzzy Hash: d1ee04c2fbe6a15381bd68ff7bf9d17b519d95fb6b56b8dc6bcd39029a38916b
Instruction Fuzzy Hash: E5216F35D04A288FCB28CF1CCE84AD9FBB5AB8830AF1481E9D00D67254C7B55BC8CE45

Function 022E8ABB Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,FFFFEADA,00000000,000F003F,FFFFF5C2), ref: 022EA26A

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 6eb088bebe5fb5b96498564d51221e0c56a02b013ec6f7e44bfb280343515aba
Instruction ID: ee2dddd567dfa3f59a8d588723af89e20aa31fcb72a6df509a5f69255a265156
Opcode Fuzzy Hash: 6eb088bebe5fb5b96498564d51221e0c56a02b013ec6f7e44bfb280343515aba
Instruction Fuzzy Hash: 1E01D8B2D365689AFB208680CC04BEB7564AB40305F0940FAE50E66195D7F907C4DF92

Function 022F5104 Relevance: 1.5, APIs: 1, Instructions: 42fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 022F68AD

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7656fec96c29f9c074042e2cb7fedf1d78f9f5f37bf6ea2013ea0515b6040016
Instruction ID: 0942bf2a1d427db03993dde16fb6c4fd5598d4baed80bf4172a4530897b1cd2b
Opcode Fuzzy Hash: 7656fec96c29f9c074042e2cb7fedf1d78f9f5f37bf6ea2013ea0515b6040016
Instruction Fuzzy Hash: B601D6F2E1400A9AFB308945DC04FBBB679E7C4711F0042F9E60D96144D3795B95CE92

Function 022F018F Relevance: 1.5, APIs: 1, Instructions: 42fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 022F0631

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c6d340cd89ea6c90d837813230a2a0cb7aabb70da71dfad4e133e56814fc78ce
Instruction ID: e07abdffb461d953279a39b62115e72ef7ca34701699819ea2063bcc24c254e7
Opcode Fuzzy Hash: c6d340cd89ea6c90d837813230a2a0cb7aabb70da71dfad4e133e56814fc78ce
Instruction Fuzzy Hash: 7A0128709153589FEB71CB28CC91BA8B770AB81710F0002EAD6896B1C6C7701B81CF01

Function 022F05E0 Relevance: 1.5, APIs: 1, Instructions: 42fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 022F0631

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5cd477d0af641beeaa0e0a9c694d40e26e07ebb03e8fc27adde5cb5dfad8414e
Instruction ID: df56c49498df7a58feb7ae52f42add0b9b8a057adf350c097c52e683a64e46d4
Opcode Fuzzy Hash: 5cd477d0af641beeaa0e0a9c694d40e26e07ebb03e8fc27adde5cb5dfad8414e
Instruction Fuzzy Hash: E60128B19153585FDB318B28CC91B99B774AB81710F1043EAD6896B1D6CB701B81CF01

Function 004153B3 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

K32GetPerformanceInfo.KERNEL32(?,00000038), ref: 004158CC

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: InfoPerformance
String ID:
API String ID: 3070290716-0
Opcode ID: ed95c95af143d39756197dee4f6952960cd36d4d27e336ac3e816a14dc6d99db
Instruction ID: 3ba6b18637a99eaaa8732e4fa763c19b0f6059fa441f45fc28853f8b1f5a36e6
Opcode Fuzzy Hash: ed95c95af143d39756197dee4f6952960cd36d4d27e336ac3e816a14dc6d99db
Instruction Fuzzy Hash: FE212C35D056298FCB28CF18CE84AD9FBB5BB88309F1482D9D00D67258C7B56BC9CE44

Function 0041BDDC Relevance: 1.5, APIs: 1, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?), ref: 0041C902

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 49218daff4ea8acce8cede8fb6f313900eabf054b6cca5c2d5ad2da8ad299355
Instruction ID: 7a45b502f1972d595ee1d15ed42fa38fdc5559aab970b38914fa20645463de9b
Opcode Fuzzy Hash: 49218daff4ea8acce8cede8fb6f313900eabf054b6cca5c2d5ad2da8ad299355
Instruction Fuzzy Hash: FBF0F6B3B94050AAF3108568DE48FFF663DEBC0710F1081BBE10951548D37C4AC68A6A

Function 022E8B57 Relevance: 1.5, APIs: 1, Instructions: 40registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,FFFFEADA,00000000,000F003F,FFFFF5C2), ref: 022EA26A

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 5a6a81043ee288f03bbfe9688084d3c2df455f30f200a3832245c058cb60175c
Instruction ID: 695c8eb5cf5d3120d70953161f7ae00eb602c5f36447b65ec702dadb00db37ab
Opcode Fuzzy Hash: 5a6a81043ee288f03bbfe9688084d3c2df455f30f200a3832245c058cb60175c
Instruction Fuzzy Hash: 0901D6B2D365685AFB308A80DC04BEB7675AB50305F0940FAE50E76084D7F91BC4DF92

Function 022F0104 Relevance: 1.5, APIs: 1, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 022F0631

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e8874df21efb0bb5d934c518450484a77cd406f58f6ecf3db8532f029cd86f60
Instruction ID: a8f592aab1be4ed2b7d4c008b4ab00f476969a32904cf7db9bd8eb9e4ac984e5
Opcode Fuzzy Hash: e8874df21efb0bb5d934c518450484a77cd406f58f6ecf3db8532f029cd86f60
Instruction Fuzzy Hash: 9E01A7719563589FEB718B24CCA1FA9B774AB81710F1006DED6496B1D6C7701B81CF41

Function 022E7917 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(FFFFEB3C,00000000), ref: 022E7E67

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 6d6fd890e7242dd6331dad99c8eaba07d567814a110b22310251de679dec185b
Instruction ID: 6788c53972702fdf5685a331232528d8dfb948fd158db7a40feab831df9e3ae0
Opcode Fuzzy Hash: 6d6fd890e7242dd6331dad99c8eaba07d567814a110b22310251de679dec185b
Instruction Fuzzy Hash: C6015671E1062A8BEB348B15CC44AEBBB79AB80701F0480FAD40EA6784D7B46FC5CE10

Function 022E7325 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(FFFFEB3C,00000000), ref: 022E7E67

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 382e17d0ca479f46ff2afecb267649162de34db7fb614ae8e14b9e6026cb291a
Instruction ID: 2e40f30af584aa9877cbc54d5e7e598a4d223067432511f3951931a686331b0e
Opcode Fuzzy Hash: 382e17d0ca479f46ff2afecb267649162de34db7fb614ae8e14b9e6026cb291a
Instruction Fuzzy Hash: 46016DB2E106198BFB308A55DC05BFBBB79EB80701F0440FAD40D96684D6B8ABD9CE11

Function 0041C3D3 Relevance: 1.5, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?), ref: 0041C902

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 40d3474f630a4fec03724429afd3a43fa7d5f96285e18ca9e65deebc6059e1f7
Instruction ID: 6190c4b6cced46c122709d9c9b5de9864f6243b17d90f462b09c9fae2e0a7f71
Opcode Fuzzy Hash: 40d3474f630a4fec03724429afd3a43fa7d5f96285e18ca9e65deebc6059e1f7
Instruction Fuzzy Hash: 06F0C8B2A901456EE7148A24DE88FFF7739FBC0710F1081BB910916644DA381FC28F56

Function 0041C487 Relevance: 1.5, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?), ref: 0041C902

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d258c66c663c7e85694d7bf98307ee0b1761912062046b8f629198e0197b8dab
Instruction ID: 2bd3af5a63590701d1b304cad8726302829d2d446360695ee48fedf76b57faba
Opcode Fuzzy Hash: d258c66c663c7e85694d7bf98307ee0b1761912062046b8f629198e0197b8dab
Instruction Fuzzy Hash: 81F0A4F2E80145ABE7108A24EE84BFF7775FBC4300F1481BA950956644D63C5FC28F56

Function 0041D44C Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(D7402EF8), ref: 0041EB1A

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: e194949cec0fc3e07b3f3a2adccd35e534c68e3a88cb69a5383b20f6a16a0c95
Instruction ID: 51353235cc0bbda5fd92549d991a60ce0002548d54e5637c3be1b005b541cf7d
Opcode Fuzzy Hash: e194949cec0fc3e07b3f3a2adccd35e534c68e3a88cb69a5383b20f6a16a0c95
Instruction Fuzzy Hash: 28F052B3E41A5829F3104614ECCCBEB7A28EBA1318F140276C8AE0058093BD0AC94143

Function 0041BDED Relevance: 1.5, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?), ref: 0041C902

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 7ae522e80f6143d143f77111367a115b9137b8a4b48ef61a10504f0e024ce2a5
Instruction ID: 3a9f84ca04a5f4222e2198e3ab1a8244a6235dd6e9d5e65736e2f192916af043
Opcode Fuzzy Hash: 7ae522e80f6143d143f77111367a115b9137b8a4b48ef61a10504f0e024ce2a5
Instruction Fuzzy Hash: B1F0B4B2A94551AAF7108624DD88FFF6679EBC0710F1081BBE10955548D37C4AC38B5A

Function 0041B599 Relevance: 1.5, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?), ref: 0041C902

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: c51217fafc185d9269aeca0b898d25de28ebbe38b33f528b7c2e56f912b87ff2
Instruction ID: 753261be9491d2aa98875b88da70849313b9ab1246490330f3977855b22d4a5d
Opcode Fuzzy Hash: c51217fafc185d9269aeca0b898d25de28ebbe38b33f528b7c2e56f912b87ff2
Instruction Fuzzy Hash: DBF0B4B2A840416AF3148534DE48FFF2678E7C0710F1081BEA20A51588D67C5BC64A6A

Function 022EA204 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: edefdae79f9becd55f665de300c12d4f3a9c01f4c39d1eb1813d29259471f634
Instruction ID: cc91618fcb7dd18347fa45c602bd866b3cb8cd7e1fe4b7fd33ad08a20710f27c
Opcode Fuzzy Hash: edefdae79f9becd55f665de300c12d4f3a9c01f4c39d1eb1813d29259471f634
Instruction Fuzzy Hash: 8001D172C256689FEB20CB90CD04BEEB676AB14300F0081EAD90A72585D6B56A80CF61

Function 0041C8BC Relevance: 1.5, APIs: 1, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,00000040,?,?,?,?,?), ref: 0041C902

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 421a3b135cec50a608d8a10a7f6080b8e30bddd468e97aa787bcf5fe1efd55bb
Instruction ID: ee2f3a1662e34070fcb7f31a266ea4dd292dababfb9e6773fd12be15ace9bdd4
Opcode Fuzzy Hash: 421a3b135cec50a608d8a10a7f6080b8e30bddd468e97aa787bcf5fe1efd55bb
Instruction Fuzzy Hash: A4F0AFB2A84155AAE7208A20CE84AFE7779BBC0300F2080FA910912608D6384FC28F59

Function 022E9E44 Relevance: 1.5, APIs: 1, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,FFFFEADA,00000000,000F003F,FFFFF5C2), ref: 022EA26A

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 2272f48fb8c5b7f550e73d322aff455504d54c3cbb5c2060615dc1a1850dc995
Instruction ID: 237aa7e48210680fc1bbb8249b697465ef51e0b87b2e93ba56b373c883660e84
Opcode Fuzzy Hash: 2272f48fb8c5b7f550e73d322aff455504d54c3cbb5c2060615dc1a1850dc995
Instruction Fuzzy Hash: 7FF0AFB1C11658AFFB208A60CD84BEF7675EB04300F0441FAD90EA6685E6B55BC4CE52

Function 0041D458 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(D7402EF8), ref: 0041EB1A

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 5ff4c357373daed80dc8c454946927df261fdbb0b7fd29f0dd0b2c7c46b6c5f5
Instruction ID: da6c086fce03fefa46b68366052a714510746307276c52312d01a9609e9b11d9
Opcode Fuzzy Hash: 5ff4c357373daed80dc8c454946927df261fdbb0b7fd29f0dd0b2c7c46b6c5f5
Instruction Fuzzy Hash: 80F0A0A3E456646AF7204A15EC8CBEB7A28FBD1324F1101B6D8AD1118497BC0AC54496

Function 0041D6CD Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(D7402EF8), ref: 0041EB1A

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 510a6f1b66563baf406cce278973b3c333ca70110a41b8b6768398abc0cd7f25
Instruction ID: 866d33d6995e503645e34c5c33de1eaf57a0ad3764d27555215d7a075314255c
Opcode Fuzzy Hash: 510a6f1b66563baf406cce278973b3c333ca70110a41b8b6768398abc0cd7f25
Instruction Fuzzy Hash: 74F089B3E041545BF7148515EC4CBEF7625ABD1314F204177D85E12584EB7C0BC5499B

Function 022EA213 Relevance: 1.5, APIs: 1, Instructions: 30registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,FFFFEADA,00000000,000F003F,FFFFF5C2), ref: 022EA26A

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 48d2350626866060b63362d50c8be268299bf7090e9767b871a394bebfb40ac0
Instruction ID: 5b4af4ba9a05d2d5e1144a71ed9a6b761fc6f4a8af052137e8821c47a1962ddc
Opcode Fuzzy Hash: 48d2350626866060b63362d50c8be268299bf7090e9767b871a394bebfb40ac0
Instruction Fuzzy Hash: E5F06DB1C215689FEB208A50CD44BEE7675AB04301F0481FAE90E76685E6B56BC0CF51

Function 0041E701 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 662f06e934e002863bf53061b26c55296d17c247a3c71084fbcfa0fa26d2e6c0
Instruction ID: 5220f4670b871671a2a1e9bf3dcb15dde29d9b67adb6422096324bf9956861ff
Opcode Fuzzy Hash: 662f06e934e002863bf53061b26c55296d17c247a3c71084fbcfa0fa26d2e6c0
Instruction Fuzzy Hash: B4F0B4B48041549FDB64CB41DC58BEAB734FB80300F1040EAD84A96380D6382DC28E56

Function 022E9D02 Relevance: 1.5, APIs: 1, Instructions: 29registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,FFFFEADA,00000000,000F003F,FFFFF5C2), ref: 022EA26A

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 058230a50c90c06fa8db4a4da5e2844d958db1b89c188c2c80a3fe87517880b1
Instruction ID: 63d5fb777c3160a789e0a24d2a00c52dd3a8d0d6c6e6ce98753cf6ad85c27283
Opcode Fuzzy Hash: 058230a50c90c06fa8db4a4da5e2844d958db1b89c188c2c80a3fe87517880b1
Instruction Fuzzy Hash: 44F0F0B1D216689FFB20CB50CD04BEE7671EB84300F1082FAD50A62588E6B55BC4CF52

Function 007DF73F Relevance: 1.5, APIs: 1, Instructions: 29injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 007DFCA9

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 5efba415d828b8e723c9fdb8a1978cf3b217c80f21a9e86744acb984a2d3b7ee
Instruction ID: be9dddfadab7350b33249568b9abb743158954eb406db287e1b6e41779ec7817
Opcode Fuzzy Hash: 5efba415d828b8e723c9fdb8a1978cf3b217c80f21a9e86744acb984a2d3b7ee
Instruction Fuzzy Hash: FAF012B2E591189FDB34CB14DC40BAAB3B4FB48700F1042D9E90D93201D7345E90CF91

Function 022E9D13 Relevance: 1.5, APIs: 1, Instructions: 28registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,FFFFEADA,00000000,000F003F,FFFFF5C2), ref: 022EA26A

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 20c8a4289065f54697b0e2a4cf03b908c2a402b0532c37e3d37a41303006da5e
Instruction ID: 9631930f8064a47f990a2bd8b6ffce0b3bdc6d9c7e2ec4086caea0506e375161
Opcode Fuzzy Hash: 20c8a4289065f54697b0e2a4cf03b908c2a402b0532c37e3d37a41303006da5e
Instruction Fuzzy Hash: FEF0BEB1D256A89FEB34CB90CD44BEEB7B5AF44300F1081EAD50A72586E6B45BC0CF11

Function 022F5D58 Relevance: 1.5, APIs: 1, Instructions: 28fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 022F68AD

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: e42954dd4f5e73d09e1baba2ddc9ccc9e58eb4daa6f74dea67769c9dec93c736
Instruction ID: 43b642c98603cd888df19dcaf83c0699c342b16d126bbc0e07d0f1ee72620db1
Opcode Fuzzy Hash: e42954dd4f5e73d09e1baba2ddc9ccc9e58eb4daa6f74dea67769c9dec93c736
Instruction Fuzzy Hash: 38E065B2A651199BE724CA84DC40FB7F3BCDB84311F0441FDE90E96144E6B69E94CE92

Function 0041D6E9 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(D7402EF8), ref: 0041EB1A

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: c8f0fc474c34b6991865726a76f8d9fb3721aaf797a817d97c05e4ab61ade92c
Instruction ID: 1cab257cf471bb050a53d1bac3eb13bab437b3b0d4f5a9b3cfd5ddab1f797484
Opcode Fuzzy Hash: c8f0fc474c34b6991865726a76f8d9fb3721aaf797a817d97c05e4ab61ade92c
Instruction Fuzzy Hash: 30F0E5B3E001586FF7108A15EC8CBEF7739BBD1304F2046B6D85C12284E7780BC94996

Function 0041D784 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(D7402EF8), ref: 0041EB1A

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 27a0db7b34ff32f8634644cf7dbfde056d14ac601f3bde2adc5f9cbbd0dd4251
Instruction ID: 1cb11f0bbc2b77ecdfb981c620183c8667390ad437427f570b6c12d61070fa1f
Opcode Fuzzy Hash: 27a0db7b34ff32f8634644cf7dbfde056d14ac601f3bde2adc5f9cbbd0dd4251
Instruction Fuzzy Hash: 20E022B3E400986AF3108A15EC8CBEF7A38ABD1309F2001B2D4AD12280D37D0BC54552

Function 007D4F60 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 007D54B7

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 85bee0ebcfc22c98867b1f4f3413758d4f25c8363e9a6c20e31cbc3d7159f2cb
Instruction ID: bcd5eff485b307e09ffbe3a0180fa0df57b291e5a0721ffc49cdbaedea0e849f
Opcode Fuzzy Hash: 85bee0ebcfc22c98867b1f4f3413758d4f25c8363e9a6c20e31cbc3d7159f2cb
Instruction Fuzzy Hash: C7F030B0D092A99BDB24CA05DC80BBAF375EB84711F2441EAEA0963340D6755ED0DF95

Function 0041D789 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(D7402EF8), ref: 0041EB1A

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 1affc5e17e0ee0776f51dfa98af9453508e4d894ca1b04f06dd5be157f0153de
Instruction ID: 1b3be4579ace77c27fbeabeedc0b8cce8d9bf5567f04d5d31646724a2e972fca
Opcode Fuzzy Hash: 1affc5e17e0ee0776f51dfa98af9453508e4d894ca1b04f06dd5be157f0153de
Instruction Fuzzy Hash: 91E022B2F401C82EF7514A25DC8CBEF7F39ABD1308F2001B5D89C11280D3B80BCA4552

Function 022FA55D Relevance: 1.5, APIs: 1, Instructions: 24fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,39335C83,?,00000000), ref: 022FAACA

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 582403293fc9f4a77af45909711e22ba21b58bc5aa963ffbbfb8c2c344e60475
Instruction ID: 10076daa50444e1bd0d0cd5c15ae37dd78ad2d34740012f5d4a82b826285be26
Opcode Fuzzy Hash: 582403293fc9f4a77af45909711e22ba21b58bc5aa963ffbbfb8c2c344e60475
Instruction Fuzzy Hash: FEF030B1D556199FDB20CE55CE40BAAF7B4EB48202F0081F9A90DA7344E6355E808F81

Function 022FAA73 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,39335C83,?,00000000), ref: 022FAACA

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: e3948e04d4d249ae6e2d51c8b379bddcb0b0bb1150f89c1e480ee43e0c74d367
Instruction ID: ed695786aa1aee9af3134d4814a41ec85137516fa4c8f8998113da8242873847
Opcode Fuzzy Hash: e3948e04d4d249ae6e2d51c8b379bddcb0b0bb1150f89c1e480ee43e0c74d367
Instruction Fuzzy Hash: 3EE039B5D556189FEB24CA50CD80BAAF374FB84602F4042E9AD0DA6240E6355E808F81

Function 007D4965 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 007D54B7

Memory Dump Source

Source File: 00000000.00000002.2407247584.00000000007C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c0000_AdobePremierPDF.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: d2717c9c40407948c508554e7adddedeacc1fc28c6ba34b563ea781e2db58928
Instruction ID: c4c61da756b4a0770587973ebc57b2819ae781c53477b7d9623a578fee7ec193
Opcode Fuzzy Hash: d2717c9c40407948c508554e7adddedeacc1fc28c6ba34b563ea781e2db58928
Instruction Fuzzy Hash: 26E026B090D29997E720CA05DC81FB6B3B8EB44702F1401EEEA0DB2240DA755DC09FC6

Function 022FA626 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,39335C83,?,00000000), ref: 022FAACA

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 6666af7a2be9f1e968a76ac4e8aa3b6b2d503e2dd92193dd37a04323f6e5646f
Instruction ID: 2dca381db6de707a26efc6fa8beb16f9913519c8d86002c334d4c687d5b7996d
Opcode Fuzzy Hash: 6666af7a2be9f1e968a76ac4e8aa3b6b2d503e2dd92193dd37a04323f6e5646f
Instruction Fuzzy Hash: 6CE06DB1D056199FEB20CA45CE80BAAF7B4FB84301F1082E9A80DA3200E6716E818F80

Function 022E7F99 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(FFFFEB3C,00000000,?,022E7EF1,FFFFEB3C), ref: 022E7FB2

Memory Dump Source

Source File: 00000000.00000002.2407468365.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22e0000_AdobePremierPDF.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 099fb8e5582878f5391c85c70b6b4d16914509952c863d5ce775db7cc48a9a05
Instruction ID: 6136554519b34998359e9f11d0482921149f3812539e3cbb29dd529e1930de0d
Opcode Fuzzy Hash: 099fb8e5582878f5391c85c70b6b4d16914509952c863d5ce775db7cc48a9a05
Instruction Fuzzy Hash: A0E06DB2C043584BEB148A00CC45EE9B375EB40320F0440E6E449D2240EA749BD18E42

Function 0041E72C Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: e0af22e1442cca98db1a89eb4f1ed730ce2a48a7c0c70779d9cf2fb36ae0d019
Instruction ID: ec4ed733a68c952aa95a1192ed0ab34c8e7d6b1d8364f1aeee3db35769f2993d
Opcode Fuzzy Hash: e0af22e1442cca98db1a89eb4f1ed730ce2a48a7c0c70779d9cf2fb36ae0d019
Instruction Fuzzy Hash: D6E04F748446A48EC755DB50CC9D6FCB735FF85302F2145DAC49A5A291DA3019C28E95

Function 0041EAC8 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(D7402EF8), ref: 0041EB1A

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: fe034146fb8c74fd31d5124755eb1eb473bed3467b34be391527d82cb755be65
Instruction ID: 1af61aa5e668b8596aecae1fbdc977b5bb0947348f21648cf9518f6764818eca
Opcode Fuzzy Hash: fe034146fb8c74fd31d5124755eb1eb473bed3467b34be391527d82cb755be65
Instruction Fuzzy Hash: 0EE0EC71840554DEE799CA51DC5D6EA73B0FB88311F2101EBD54A1A2C0DB342DC28E44

Function 0041E6B8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(D7402EF8), ref: 0041EB1A

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 4d86f326485f59c4e3427a44e4ed84efc37e348e554e7190962e49fe289a37b0
Instruction ID: 4d3bfaa43e6df136e9b4ac78455ba1c71c09e42bb3b92b831b647f87378d05bc
Opcode Fuzzy Hash: 4d86f326485f59c4e3427a44e4ed84efc37e348e554e7190962e49fe289a37b0
Instruction Fuzzy Hash: 0DD09274944568CADB65DA54DC4D6D8B7B0BB88301F1005EAD44F6A380DB342BC0DE46

Function 0041E747 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(D7402EF8), ref: 0041EB1A

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 3dd6ccccb025860445d31459ea9677be8de921b2b0a75c96778e130f1f5e8f61
Instruction ID: 6673a634f9eef8b9d5ad6f90622e359143aabf44b7743fb1aac5f2b371f3beb0
Opcode Fuzzy Hash: 3dd6ccccb025860445d31459ea9677be8de921b2b0a75c96778e130f1f5e8f61
Instruction Fuzzy Hash: CED09274844168CACB65CA40DC4C6D8B770BB88301F2401EAD40E2A340DB302AC0DE45

Function 0041E01A Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(D7402EF8), ref: 0041EB1A

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: c67ee8382289cd3187e0565fff5626fa5c34cb61046b25fa3cb746eea523d970
Instruction ID: e314f741ed96654955b4fbcdfb87658db9fc91043cc5b064cbdabd0d59faa299
Opcode Fuzzy Hash: c67ee8382289cd3187e0565fff5626fa5c34cb61046b25fa3cb746eea523d970
Instruction Fuzzy Hash: F5B012B18840548AD791CF05EC4C7CCB6707B00325F2801E2D44F64190DB3616C4AD4B

Function 0041A340 Relevance: 1.4, APIs: 1, Instructions: 128memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 0041A765

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a4edd474e3bd5ca87c052ab32c96034f6741e55e92377221d097c618d1df8c91
Instruction ID: 3e51d61aed352713595103a69bb84cddc50d3512fe7ca2c40dd6da16d6a0ad30
Opcode Fuzzy Hash: a4edd474e3bd5ca87c052ab32c96034f6741e55e92377221d097c618d1df8c91
Instruction Fuzzy Hash: 4041F2B1D052689FE724CB14CD84BEA7B70EB85300F1481FBD94A67682D6385ED28F42

Function 0041A165 Relevance: 1.4, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 0041A765

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 212d7394bd7d4c17345687a2183c0624aa73022c120bf881de67e4ca4bbc35aa
Instruction ID: 4ab1f29890a4545c01e74dad705dca16a0f8e72cc63794f0c7034355495ea517
Opcode Fuzzy Hash: 212d7394bd7d4c17345687a2183c0624aa73022c120bf881de67e4ca4bbc35aa
Instruction Fuzzy Hash: B631D0B1D46215AEF7248600DC85BFB7778FB98310F2442BBE90956680E63C5ED68E53

Function 0041A177 Relevance: 1.3, APIs: 1, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 0041A765

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 454285fa21e6f59e412a6edb072f28afb1eb1ebfc29ff5ff5998a850c3ee8306
Instruction ID: cb294ceb1206d2e2b70a610abffe678af77dc021f5ae76b71c7b4922c4796a0e
Opcode Fuzzy Hash: 454285fa21e6f59e412a6edb072f28afb1eb1ebfc29ff5ff5998a850c3ee8306
Instruction Fuzzy Hash: 1421D4B2D46255AFF3248611DC89BFB7738FB98310F2441B7D90966680E63C4EC68E62

Function 0041A1AB Relevance: 1.3, APIs: 1, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 0041A765

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f11a8f3ab7179c5c346931aa141021d011f3e7bbf97f60886921df9df8e9aceb
Instruction ID: 7d7ea67286a867372d2cb26469690bb28697e3842dcc4900d30682439c1bc50a
Opcode Fuzzy Hash: f11a8f3ab7179c5c346931aa141021d011f3e7bbf97f60886921df9df8e9aceb
Instruction Fuzzy Hash: 8311BEF1E49299AEF3218610DC84BEA7B78FB59300F2801FBD90965281D2394EC78E57

Function 0041A1DD Relevance: 1.3, APIs: 1, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 0041A765

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 530477df919adc1abb9fd2e9f469e0a276eb81c4188248443d05c5c56b0b9f01
Instruction ID: 2c2f7076af28dc54d0c8ae05990bd090a512473cba38de3544eef4080ecd839e
Opcode Fuzzy Hash: 530477df919adc1abb9fd2e9f469e0a276eb81c4188248443d05c5c56b0b9f01
Instruction Fuzzy Hash: 4201CCB1D46259AFF7208601CC88BFB7778EB98311F2041F7DA0966280D63C4EC68E53

Function 0041A2AA Relevance: 1.3, APIs: 1, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 0041A765

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ec4d58be7dc80b679cc241d13c019c72209513d45ef3bd979e008de095266c39
Instruction ID: e79da8fa29a1a8e96fc6b87bb40a58c845abd28b52d7f0f02ed3f7c1315ca776
Opcode Fuzzy Hash: ec4d58be7dc80b679cc241d13c019c72209513d45ef3bd979e008de095266c39
Instruction Fuzzy Hash: 901108B1E052549FE7708614DC48BDB7774EB88301F1001FBE90DA6380E6389EC68E52

Function 0041A1F4 Relevance: 1.3, APIs: 1, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 0041A765

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: fc1537744e3ef4a578e1659bca02c946789c9fea0288bd0fd04183fa16cf1178
Instruction ID: 8e8a8cf0cbd4c93255f9bde40ead25bfda08f91ed816fa5e674bdfe33aab494c
Opcode Fuzzy Hash: fc1537744e3ef4a578e1659bca02c946789c9fea0288bd0fd04183fa16cf1178
Instruction Fuzzy Hash: 0201BCB5D45659EFF7608A11CC89BEA7738FB98310F1042F6D90966280D6388EC68F52

Function 0041A1EF Relevance: 1.3, APIs: 1, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 0041A765

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d236aa888dc79e9ae7eab0c2f3392f167090e5bed8e6ee3af8b0d9900b5b0349
Instruction ID: a6a5a824e9f9a132f4a3d3fd9b6d16639dfba14d1d7d1c76ef97de0bfd786332
Opcode Fuzzy Hash: d236aa888dc79e9ae7eab0c2f3392f167090e5bed8e6ee3af8b0d9900b5b0349
Instruction Fuzzy Hash: ED01B1B1D45659DFF7618A11CC88BEA7774FB98301F2041F6DA0966280D6384EC6CF02

Function 0041A365 Relevance: 1.3, APIs: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 0041A765

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a15a86716b02fb1913d32cc4bcb829903f912e2eb5ec2f5e4e2d875b055c736e
Instruction ID: 81f24732bc1fe707ab27b9ababa4727ed717e6a950f87e826b8e2464329a1f30
Opcode Fuzzy Hash: a15a86716b02fb1913d32cc4bcb829903f912e2eb5ec2f5e4e2d875b055c736e
Instruction Fuzzy Hash: 06F046B0C09290AFE7118B20CC987E97B30EB89304F1482EBE548AA182C1358EC3CB01

Function 0041A236 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 0041A765

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 423bc99e107ac8933435b2f8006546392f2382721e06ebc1859b34b9231b8e75
Instruction ID: dae2401402a4d8356f06912fd779740c8a4527bcd4ed1cf14d0a4660132cc49c
Opcode Fuzzy Hash: 423bc99e107ac8933435b2f8006546392f2382721e06ebc1859b34b9231b8e75
Instruction Fuzzy Hash: D8F0A0B4D45798CFE7619A91CC88BE97770EB58705F2043E7D918691C0D6348EC78F45

Function 0041A300 Relevance: 1.3, APIs: 1, Instructions: 26memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 0041A765

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 94e8c789e75a4fb9f60e1286ff1f4a3ca8701a8545f96723d611c4b7ec024491
Instruction ID: 92ddbff5125385df3e03f7b13669965ff164a426e8bd48f35456aa4234729dfa
Opcode Fuzzy Hash: 94e8c789e75a4fb9f60e1286ff1f4a3ca8701a8545f96723d611c4b7ec024491
Instruction Fuzzy Hash: F8F0A9B8D492A8CFE7528B508C987E8B730EB49B05F1002DBE609A62C0C6308E838F00

Function 0041A714 Relevance: 1.3, APIs: 1, Instructions: 25memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 0041A765

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6272ad71c2d89ba41ff4c6198ce16f502a510ea2cf765c6604c6ff6f222a3efa
Instruction ID: 4afc04d6b0fe20a0eb610c6fc1b19e2a8e6cd7271f46d56046fb88b0adb86c36
Opcode Fuzzy Hash: 6272ad71c2d89ba41ff4c6198ce16f502a510ea2cf765c6604c6ff6f222a3efa
Instruction Fuzzy Hash: C2F0A0B4D44354DFE7529B61CC887EA7770EB18701F1002E7E60CA52C0D6349EC28F45

Function 00419410 Relevance: 1.3, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 0041A765

Memory Dump Source

Source File: 00000000.00000002.2406852449.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2406829642.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406901662.0000000000441000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.000000000044E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406923881.0000000000454000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000045C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2406966325.00000000004BA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AdobePremierPDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 94f3d0878abe3b05ac4646c2dd24253d00f8c9ad199668c3a26603c3d29c11d6
Instruction ID: 3319bf6a54699e2d7ef9e753575e314c74fd4be5ae6e627efad82c75dbf29e59
Opcode Fuzzy Hash: 94f3d0878abe3b05ac4646c2dd24253d00f8c9ad199668c3a26603c3d29c11d6
Instruction Fuzzy Hash: 29E026B0D492649EF34166504C9D7E937388B09B00F1000E7E208B81C0E2348EC78B47

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report AdobePremierPDF.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\Documents\NordVPNnetworkTAP\Lang\RemotePCPrinter.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
AdobePremierPDF.exe

Function 007CE4CD Relevance: 37.3, APIs: 2, Strings: 19, Instructions: 557
COMMON

Function 022F2D00 Relevance: 12.7, APIs: 1, Strings: 7, Instructions: 748
COMMON

Function 022F410D Relevance: 9.4, APIs: 1, Strings: 5, Instructions: 399
memoryCOMMON

Function 022F313F Relevance: 9.4, APIs: 1, Strings: 5, Instructions: 370
COMMON

Function 022F3225 Relevance: 9.3, APIs: 1, Strings: 5, Instructions: 312
COMMON

Function 004124FE Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 349
libraryCOMMON

Function 00412946 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 254
COMMON

Function 022F3CB6 Relevance: 7.9, APIs: 1, Strings: 4, Instructions: 406
COMMON

Function 022F3CC4 Relevance: 7.9, APIs: 1, Strings: 4, Instructions: 404
COMMON

Function 022F30F4 Relevance: 7.9, APIs: 1, Strings: 4, Instructions: 388
COMMON

Function 022F4027 Relevance: 7.9, APIs: 1, Strings: 4, Instructions: 364
memoryCOMMON

Function 022F404A Relevance: 7.9, APIs: 1, Strings: 4, Instructions: 355
memoryCOMMON

Function 022F3D84 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 349
COMMON

Function 022F3DA5 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 342
COMMON

Function 022F40AC Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 338
COMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre