Edit tour

Windows Analysis Report
MicrosoftWORD.exe

Overview

General Information

Sample name:	MicrosoftWORD.exe
Analysis ID:	1587444
MD5:	683c5db3796f6ef32a5598a9c442c6b0
SHA1:	39b40a2bb77bc0d46361dec3ecd69d1547b39e6d
SHA256:	cc3f501d414d5bb8fcbb3a4bcfb2b085b9e67a1e7739118f1b727a9336e16f74
Tags:	exePrivateLoaderuser-zhuzhu0009
Infos:

Detection

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (creates a PE file in dynamic memory)

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Allocates memory in foreign processes

Drops large PE files

Injects a PE file into a foreign processes

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Writes to foreign memory regions

Yara detected Costura Assembly Loader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

MicrosoftWORD.exe (PID: 7880 cmdline: "C:\Users\user\Desktop\MicrosoftWORD.exe" MD5: 683C5DB3796F6EF32A5598A9C442C6B0)

csc.exe (PID: 8120 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.2623673471.00000000092B0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000003.00000002.2622956360.0000000007C01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000003.00000002.2622510013.0000000006A61000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: csc.exe PID: 8120	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.csc.exe.92b0000.3.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
3.2.csc.exe.7c86448.1.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\Favorites\components\assets\Chrominum_A.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\MicrosoftWORD.exe, ProcessId: 7880, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Chrominum_A

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: MicrosoftWORD.exe	Virustotal: Detection: 65%			Perma Link
Source: MicrosoftWORD.exe	ReversingLabs: Detection: 52%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\MicrosoftWORD.exe

Unpacked PE file: 0.2.MicrosoftWORD.exe.2890000.2.unpack

Source: MicrosoftWORD.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: MicrosoftWORD.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: Vxfoecavth.pdb source: csc.exe, 00000003.00000002.2623327581.00000000090E0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1816568083.0000000007EDE000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1816568083.0000000007CFC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: csc.exe, 00000003.00000002.2623721923.0000000009310000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1816568083.0000000008015000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1816568083.0000000007EDE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: csc.exe, 00000003.00000002.2623721923.0000000009310000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1816568083.0000000008015000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1816568083.0000000007EDE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\jenkins_home\workspace\indows-4.5-non-Arxan_release_5.6\CloudAgentInstaller\Release\CloudAgentInstaller.pdb source: MicrosoftWORD.exe, Chrominum_A.exe.0.dr

Source: global traffic

TCP traffic: 192.168.2.9:49881 -> 181.71.216.203:30203

Source: Joe Sandbox View

IP Address: 181.71.216.203 181.71.216.203

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: newstaticfreepoint24.ddns-ip.net

Source: csc.exe, 00000003.00000002.2622510013.0000000006A61000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.2622510013.0000000006CB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: MicrosoftWORD.exe, Chrominum_A.exe.0.dr	String found in binary or memory: http://www.newhb.com
Source: csc.exe, 00000003.00000002.2623721923.0000000009310000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1816568083.0000000008015000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1816568083.0000000007EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: csc.exe, 00000003.00000002.2623721923.0000000009310000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1816568083.0000000008015000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1816568083.0000000007EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: csc.exe, 00000003.00000002.2623721923.0000000009310000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1816568083.0000000008015000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1816568083.0000000007EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: csc.exe, 00000003.00000002.2623721923.0000000009310000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1816568083.0000000008015000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1816568083.0000000007EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: csc.exe, 00000003.00000002.2623721923.0000000009310000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000002.2622510013.0000000006A61000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1816568083.0000000008015000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1816568083.0000000007EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: csc.exe, 00000003.00000002.2623721923.0000000009310000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1816568083.0000000008015000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1816568083.0000000007EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: MicrosoftWORD.exe, Chrominum_A.exe.0.dr	String found in binary or memory: https://www.qualys.com/docs/qualys-cloud-agent-windows-install-guide.pdf

System Summary

Drops large PE files

Source: C:\Users\user\Desktop\MicrosoftWORD.exe

File dump: Chrominum_A.exe.0.dr 959567321

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_04C944A3	3_2_04C944A3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_04C944B0	3_2_04C944B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_0923E090	3_2_0923E090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_09232220	3_2_09232220
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_09231CA8	3_2_09231CA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_09232141	3_2_09232141
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_09232024	3_2_09232024
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_0923F0B0	3_2_0923F0B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_09232099	3_2_09232099
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_092320C3	3_2_092320C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_0923E3B7	3_2_0923E3B7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_09231C10	3_2_09231C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_09231FDF	3_2_09231FDF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_0937FB40	3_2_0937FB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_0937FB0A	3_2_0937FB0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_0937FAD8	3_2_0937FAD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_0937E508	3_2_0937E508
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_09395988	3_2_09395988
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_09394CD8	3_2_09394CD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_09397BAE	3_2_09397BAE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_093933E0	3_2_093933E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_093927C8	3_2_093927C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_09395978	3_2_09395978
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_093939B0	3_2_093939B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_093939A1	3_2_093939A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_093939B0	3_2_093939B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_093959C8	3_2_093959C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_093950ED	3_2_093950ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_09394CCA	3_2_09394CCA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_09392B10	3_2_09392B10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_09397BF6	3_2_09397BF6

Source: MicrosoftWORD.exe	Binary or memory string: OriginalFilename vs MicrosoftWORD.exe
Source: MicrosoftWORD.exe, 00000000.00000002.1614608842.0000000002FB4000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudAgentInstaller.exeH vs MicrosoftWORD.exe
Source: MicrosoftWORD.exe, 00000000.00000002.1614416704.000000000291C000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLziarzrkco.exe" vs MicrosoftWORD.exe
Source: MicrosoftWORD.exe, 00000000.00000002.1612682652.0000000000A1C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCloudAgentInstaller.exeH vs MicrosoftWORD.exe
Source: MicrosoftWORD.exe	Binary or memory string: OriginalFilenameCloudAgentInstaller.exeH vs MicrosoftWORD.exe

Source: MicrosoftWORD.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal84.evad.winEXE@3/1@1/1

Source: C:\Users\user\Desktop\MicrosoftWORD.exe

File created: C:\Users\user\Favorites\components

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Mutant created: \Sessions\1\BaseNamedObjects\mono1234

Source: MicrosoftWORD.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\MicrosoftWORD.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: MicrosoftWORD.exe, 00000000.00000002.1614608842.00000000029A0000.00000004.00001000.00020000.00000000.sdmp, MicrosoftWORD.exe, 00000000.00000002.1611222948.000000000055B000.00000002.00000001.01000000.00000003.sdmp, MicrosoftWORD.exe, 00000000.00000000.1368718103.000000000055B000.00000002.00000001.01000000.00000003.sdmp, Chrominum_A.exe.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: MicrosoftWORD.exe, 00000000.00000002.1614608842.00000000029A0000.00000004.00001000.00020000.00000000.sdmp, MicrosoftWORD.exe, 00000000.00000002.1611222948.000000000055B000.00000002.00000001.01000000.00000003.sdmp, MicrosoftWORD.exe, 00000000.00000000.1368718103.000000000055B000.00000002.00000001.01000000.00000003.sdmp, Chrominum_A.exe.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);

Source: MicrosoftWORD.exe	Virustotal: Detection: 65%
Source: MicrosoftWORD.exe	ReversingLabs: Detection: 52%

Source: MicrosoftWORD.exe

String found in binary or memory: 7XSoftware\Qualys\QualysAgent1.21.11.0Qualys Cloud Security AgentInstallation of Qualys Cloud Agent by double-clicking the executable or installer file is not supported. For installation instructions, refer to 'How to install the Cloud Agent' section in https://www.qualys.com/docs/qualys-cloud-agent-windows-install-guide.pdf

Source: C:\Users\user\Desktop\MicrosoftWORD.exe

File read: C:\Users\user\Desktop\MicrosoftWORD.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\MicrosoftWORD.exe "C:\Users\user\Desktop\MicrosoftWORD.exe"
Source: C:\Users\user\Desktop\MicrosoftWORD.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Source: C:\Users\user\Desktop\MicrosoftWORD.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"	Jump to behavior

Source: C:\Users\user\Desktop\MicrosoftWORD.exe	Section loaded: fugu.dll	Jump to behavior
Source: C:\Users\user\Desktop\MicrosoftWORD.exe	Section loaded: fugu2.dll	Jump to behavior
Source: C:\Users\user\Desktop\MicrosoftWORD.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\MicrosoftWORD.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: MicrosoftWORD.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: MicrosoftWORD.exe

Static file information: File size 7432192 > 1048576

Source: MicrosoftWORD.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x159800
Source: MicrosoftWORD.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x578000

Source: MicrosoftWORD.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: MicrosoftWORD.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: MicrosoftWORD.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: MicrosoftWORD.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: MicrosoftWORD.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: MicrosoftWORD.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: MicrosoftWORD.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: MicrosoftWORD.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: Vxfoecavth.pdb source: csc.exe, 00000003.00000002.2623327581.00000000090E0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1816568083.0000000007EDE000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1816568083.0000000007CFC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: csc.exe, 00000003.00000002.2623721923.0000000009310000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1816568083.0000000008015000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1816568083.0000000007EDE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: csc.exe, 00000003.00000002.2623721923.0000000009310000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1816568083.0000000008015000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1816568083.0000000007EDE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\jenkins_home\workspace\indows-4.5-non-Arxan_release_5.6\CloudAgentInstaller\Release\CloudAgentInstaller.pdb source: MicrosoftWORD.exe, Chrominum_A.exe.0.dr

Data Obfuscation

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\MicrosoftWORD.exe

Unpacked PE file: 0.2.MicrosoftWORD.exe.2890000.2.unpack

Yara detected Costura Assembly Loader

Source: Yara match	File source: 3.2.csc.exe.92b0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.csc.exe.7c86448.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2623673471.00000000092B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2622956360.0000000007C01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2622510013.0000000006A61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: csc.exe PID: 8120, type: MEMORYSTR

Source: C:\Users\user\Desktop\MicrosoftWORD.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Source: C:\Users\user\Desktop\MicrosoftWORD.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"			Jump to behavior

Source: MicrosoftWORD.exe

Static PE information: real checksum: 0x1c8570 should be: 0x726390

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_091E4F58 push edx; retf	3_2_091E4F5E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_09233118 push 840FC085h; retf 0001h	3_2_0923311F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_0923A22C push eax; retf	3_2_0923A22F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_09231FA8 pushfd ; ret	3_2_09231FB0

Source: C:\Users\user\Desktop\MicrosoftWORD.exe

File created: C:\Users\user\Favorites\components\assets\Chrominum_A.exe

Jump to dropped file

Source: C:\Users\user\Desktop\MicrosoftWORD.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Chrominum_A			Jump to behavior
Source: C:\Users\user\Desktop\MicrosoftWORD.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Chrominum_A			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 4C40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 6A60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 6760000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Window / User API: threadDelayed 5991			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Window / User API: threadDelayed 3832			Jump to behavior

Source: C:\Users\user\Desktop\MicrosoftWORD.exe

Dropped PE file which has not been started: C:\Users\user\Favorites\components\assets\Chrominum_A.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -35048813740048126s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -59891s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8176	Thread sleep count: 5991 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8176	Thread sleep count: 3832 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -59781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -59672s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -59563s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -59453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -59344s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -59235s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -59110s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -58985s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -58860s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -58735s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -58610s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -58485s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -58360s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -58201s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -58003s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -57578s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -57360s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -57235s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -57110s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -56985s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -56865s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -56721s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -56594s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -56469s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -56360s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -56235s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -56096s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -55969s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -55859s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -55743s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -55625s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -55516s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -55400s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -55282s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -55157s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -55032s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -54907s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -54782s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -54657s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -54547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -54437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -54328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -54218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -54110s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -53985s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -53860s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -53744s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -53625s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -53515s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 8172	Thread sleep time: -53406s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58201	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58003	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 57578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 57360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 57235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 57110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56865	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56721	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56096	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55743	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55400	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55282	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55157	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55032	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54907	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54782	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54657	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 53985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 53860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 53744	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 53625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 53515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 53406	Jump to behavior

Source: csc.exe, 00000003.00000002.2623949381.0000000009618000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllInstallDatee

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\MicrosoftWORD.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\MicrosoftWORD.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 2E0000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\MicrosoftWORD.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 2E0000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\MicrosoftWORD.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 2E0000			Jump to behavior
Source: C:\Users\user\Desktop\MicrosoftWORD.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 536008			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\MicrosoftWORD.exe

Code function: 0_2_00512345 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00512345

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: csc.exe, 00000003.00000002.2622051250.0000000004CF6000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	131 Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	31 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	11 Disable or Modify Tools	LSASS Memory	131 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	141 Virtualization/Sandbox Evasion	Security Account Manager	141 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	31 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	124 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
MicrosoftWORD.exe	65%	Virustotal		Browse
MicrosoftWORD.exe	53%	ReversingLabs	Win32.Trojan.Leonem

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\Favorites\components\assets\Chrominum_A.exe	5%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://www.newhb.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
newstaticfreepoint24.ddns-ip.net	181.71.216.203	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/mgravell/protobuf-net	csc.exe, 00000003.00000002.2623721923.0000000009310000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1816568083.0000000008015000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1816568083.0000000007EDE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.qualys.com/docs/qualys-cloud-agent-windows-install-guide.pdf	MicrosoftWORD.exe, Chrominum_A.exe.0.dr	false		high
http://www.newhb.com	MicrosoftWORD.exe, Chrominum_A.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://github.com/mgravell/protobuf-neti	csc.exe, 00000003.00000002.2623721923.0000000009310000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1816568083.0000000008015000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1816568083.0000000007EDE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/14436606/23354	csc.exe, 00000003.00000002.2623721923.0000000009310000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000002.2622510013.0000000006A61000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1816568083.0000000008015000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1816568083.0000000007EDE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-netJ	csc.exe, 00000003.00000002.2623721923.0000000009310000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1816568083.0000000008015000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1816568083.0000000007EDE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	csc.exe, 00000003.00000002.2622510013.0000000006A61000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.2622510013.0000000006CB9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/11564914/23354;	csc.exe, 00000003.00000002.2623721923.0000000009310000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1816568083.0000000008015000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1816568083.0000000007EDE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354	csc.exe, 00000003.00000002.2623721923.0000000009310000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1816568083.0000000008015000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1816568083.0000000007EDE000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
181.71.216.203	newstaticfreepoint24.ddns-ip.net	Colombia		27831	ColombiaMovilCO	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587444
Start date and time:	2025-01-10 11:41:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	MicrosoftWORD.exe
Detection:	MAL
Classification:	mal84.evad.winEXE@3/1@1/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 78% Number of executed functions: 106 Number of non-executed functions: 14
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 4.175.87.197
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target MicrosoftWORD.exe, PID 7880 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtProtectVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:42:28	API Interceptor	1215738x Sleep call for process: csc.exe modified
10:42:33	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Chrominum_A C:\Users\user\Favorites\components\assets\Chrominum_A.exe
10:42:41	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Chrominum_A C:\Users\user\Favorites\components\assets\Chrominum_A.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
181.71.216.203	MicrosoftOfficeWord.exe	Get hash	malicious	Unknown	Browse
	AdobePDF.exe	Get hash	malicious	Unknown	Browse
	AdobeReaderPDFonline.exe	Get hash	malicious	Unknown	Browse
	PDFonlineseguro.exe	Get hash	malicious	Unknown	Browse
	AdobePremierPDF.exe	Get hash	malicious	Unknown	Browse
	2LDJIyMl2r.exe	Get hash	malicious	Remcos	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
newstaticfreepoint24.ddns-ip.net	MicrosoftOfficeWord.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	AdobePDF.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	AdobeReaderPDFonline.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	PDFonlineseguro.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	AdobePremierPDF.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	2LDJIyMl2r.exe	Get hash	malicious	Remcos	Browse	181.71.216.203
	SHROsQyiAd.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	4JwhvqLe8n.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	fIPSLgT0lO.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	3XSXmrEOw7.exe	Get hash	malicious	Remcos	Browse	181.131.217.244

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ColombiaMovilCO	MicrosoftOfficeWord.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	AdobePDF.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	AdobeReaderPDFonline.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	PDFonlineseguro.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	AdobePremierPDF.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	1736491685b40eefbc9bdfbc98216071e6ff3a4c19c7e1ab8a144cde35036665da85346b6b949.dat-decoded.exe	Get hash	malicious	Remcos	Browse	179.15.136.6
	6.elf	Get hash	malicious	Unknown	Browse	181.70.170.80
	173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Get hash	malicious	Remcos	Browse	179.15.136.6
	1736348224ad77cf86e491faad27e4b5decf1eb0bb26f16b0527e5ef488389ba353aa3db79582.dat-decoded.exe	Get hash	malicious	Remcos	Browse	179.15.136.6
	17363482247f60133f013d62aae38c531ac95bb55a200a243b0e15fa7cf8e8923b2a10590f952.dat-decoded.exe	Get hash	malicious	Remcos	Browse	179.15.136.6

Process:	C:\Users\user\Desktop\MicrosoftWORD.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	959567321
Entropy (8bit):	0.10403134135261466
Encrypted:	false
SSDEEP:
MD5:	2F50620BC392CD4467AF0774F20F0045
SHA1:	897E76B977A57DAE0E0A7BC32EF8C436248316E5
SHA-256:	BB8B678F7382CE794161786A8E11C10986A6B8F24F55B2F3C9108B9871E266ED
SHA-512:	7B11B49A72AA9157BC0FFDBEA67E03BCEE8741BB307F723856011F94476EAB83C2C6918E3AD3E6227BB2224B0075AD501D18027708AB9E09AE198FC964E06A40
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T...v...v...v...t..v...v.v...w..v.../...v..+(...v..+(..6v..+(..kv.......v..(...v.......v...v..;w..(..;v..(z..v...v...v..(...v..Rich.v..........PE..L....KFf......................[...................@...........................q.....p.....@.................................(\|..x....`....W.............................p...............................@....................z.......................text............................... ..`.rdata..............................@..@.data............V...~..............@....gfids... ...0......................@..@.tls.........P......................@....rsrc.....W..`....W.................@..@........................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.664200167453047
TrID:	Win32 Executable (generic) a (10002005/4) 99.55% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	MicrosoftWORD.exe
File size:	7'432'192 bytes
MD5:	683c5db3796f6ef32a5598a9c442c6b0
SHA1:	39b40a2bb77bc0d46361dec3ecd69d1547b39e6d
SHA256:	cc3f501d414d5bb8fcbb3a4bcfb2b085b9e67a1e7739118f1b727a9336e16f74
SHA512:	d3ff24f43b4043f1cae00c79c6cf7418bc78012e37a2f28f42f96185d31ccc0f2f020e69803c0e29672b7db074fe9aaeade584d7cf4494951a59f60fc3dde261
SSDEEP:	98304:zWmwv0GCAR4IQrOWoqNm2T2Nr0WtpHW+WxUbSj8KSS:zWmwHCAcOWoqNm2E0WtlW+W6bCkS
TLSH:	AE767C71E283CC43E8A220BFE129A5FC51256E35E627C587B3C0FE2A70735D295E561B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T....v...v...v....t..v....v..v....w..v.../...v..+(...v..+(..6v..+(..kv.......v...(...v.......v...v..;w...(..;v...(z..v...v...v.

File Icon


Icon Hash:	3368ccd64c69138e

Static PE Info

General

Entrypoint:	0x5116c7
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66464B85 [Thu May 16 18:08:05 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	667cd4ebeeff36c77bc94683d50504ef

Entrypoint Preview

Instruction
call 00007EFD5889C43Eh
jmp 00007EFD5889B64Ch
push ebp
mov ebp, esp
push 00000000h
call dword ptr [0055B170h]
push dword ptr [ebp+08h]
call dword ptr [0055B2F0h]
push C0000409h
call dword ptr [0055B260h]
push eax
call dword ptr [0055B13Ch]
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 00000324h
push 00000017h
call 00007EFD58887EE8h
test eax, eax
je 00007EFD5889B7C7h
push 00000002h
pop ecx
int 29h
mov dword ptr [0059FD30h], eax
mov dword ptr [0059FD2Ch], ecx
mov dword ptr [0059FD28h], edx
mov dword ptr [0059FD24h], ebx
mov dword ptr [0059FD20h], esi
mov dword ptr [0059FD1Ch], edi
mov word ptr [0059FD48h], ss
mov word ptr [0059FD3Ch], cs
mov word ptr [0059FD18h], ds
mov word ptr [0059FD14h], es
mov word ptr [0059FD10h], fs
mov word ptr [0059FD0Ch], gs
pushfd
pop dword ptr [0059FD40h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [0059FD34h], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [0059FD38h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [0059FD44h], eax
mov eax, dword ptr [ebp-00000324h]
mov dword ptr [0059FC80h], 00010001h

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[RES] VS2015 UPD3 build 24213
[LNK] VS2015 UPD3.1 build 24215

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x197c28	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1a6000	0x577fa0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1bf000	0xdda4	.rsrc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x18a210	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x16acf8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x15b000	0x398	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x197a80	0x80	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x15a000	0x159800	29eab12d8effad8d0b1170fcfb5a3918	False	0.5572596327785818	data	6.661013407705432	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x15b000	0x3f000	0x3e200	eae27ead0dbaa6b546d3ad9e2f2eddf2	False	0.3670853244466801	data	5.085860438856158	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x19a000	0x9000	0x5600	c5bd365bb50e696ac8174b61be590ccd	False	0.2043059593023256	data	4.249683212440647	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.gfids	0x1a3000	0x2000	0x1200	db596309d3c1c15c9fe66b4080be2928	False	0.3784722222222222	data	4.026024095908803	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x1a5000	0x1000	0x200	adb00c88d5919bab3c4b160cbf2abed5	False	0.03515625	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1a6000	0x577fa0	0x578000	65a24c5551dd85360b88203996705aef	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x1a6660	0x7028	Device independent bitmap graphic, 448 x 16 x 32, image size 0			0.3149902479799387
RT_BITMAP	0x1ad688	0x72a24	Device independent bitmap graphic, 500 x 313 x 24, image size 469500, resolution 3780 x 3780 px/m			0.5955807811901009
RT_BITMAP	0x2200ac	0x72a24	Device independent bitmap graphic, 500 x 313 x 24, image size 469500, resolution 3780 x 3780 px/m			0.5876751714443924
RT_BITMAP	0x292ad0	0x72a24	Device independent bitmap graphic, 500 x 313 x 24, image size 469500, resolution 3780 x 3780 px/m			0.4681283809686076
RT_BITMAP	0x3054f4	0x67258	PC bitmap, Windows 3.x format, 52864 x 2 x 54, image size 422942, cbSize 422488, bits offset 54			0.9915003503058075
RT_ICON	0x36c74c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.4716312056737589
RT_ICON	0x36cbb4	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.29174484052532834
RT_ICON	0x36dc5c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.22863070539419086
RT_ICON	0x370204	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.20559754369390648
RT_ICON	0x37442c	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.15386549154146456
RT_STRING	0x384c54	0x6c	data			0.6481481481481481
RT_RCDATA	0x384cc0	0x9d36	PNG image data, 98 x 102, 8-bit/color RGBA, non-interlaced			0.23204790538190131
RT_RCDATA	0x38e9f8	0x7a2b6	data			0.7525569237778924
RT_RCDATA	0x408cb0	0xc32ba	Delphi compiled form 'Tdm'			0.34880500564160427
RT_RCDATA	0x4cbf6c	0x9c27a	Delphi compiled form 'TdmMain'			0.26150935726458313
RT_RCDATA	0x5681e8	0x1cc3e	Delphi compiled form '\017TFanTasticFrame\016FanTasticFrame'			0.4461985028262973
RT_RCDATA	0x584e28	0xf7ece	Delphi compiled form 'TfPNGMessage'			0.1253773995521427
RT_RCDATA	0x67ccf8	0x1ec66	Delphi compiled form 'TfrmMain'			0.16980024433972743
RT_RCDATA	0x69b960	0x5fd99	Delphi compiled form '\023TOperationModeFrame\022OperationModeFrame'			0.6852657023288274
RT_GROUP_ICON	0x6fb6fc	0x4c	data	English	United States	0.75
RT_VERSION	0x6fb748	0x34c	data	English	United States	0.4372037914691943
RT_ANIICON	0x6fba94	0x221a2	PC bitmap, Windows 3.x format, 18288 x 2 x 29, image size 140368, cbSize 139682, bits offset 54			0.9885668876447932
RT_MANIFEST	0x71dc38	0x365	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (809), with CRLF line terminators	English	United States	0.48676639815880324

Imports

DLL	Import
KERNEL32.dll	HeapAlloc, LoadLibraryW, GetSystemInfo, HeapReAlloc, DeleteFileW, DeleteFileA, GetVersionExA, WaitForSingleObjectEx, LoadLibraryA, CreateFileA, FlushViewOfFile, GetFileAttributesExW, GetFileAttributesA, GetDiskFreeSpaceA, FormatMessageW, GetTempPathA, Sleep, MultiByteToWideChar, HeapSize, HeapValidate, UnmapViewOfFile, GetVersionExW, GetFileAttributesW, GetTempPathW, UnlockFileEx, SetEndOfFile, GetFullPathNameA, SetFilePointer, LockFile, OutputDebugStringA, GetDiskFreeSpaceW, InterlockedCompareExchange, GetFullPathNameW, HeapFree, HeapCreate, ReadFile, AreFileApisANSI, RaiseException, GetCurrentThreadId, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, TryEnterCriticalSection, DeleteCriticalSection, SetLastError, GetConsoleCP, GetVersion, VerSetConditionMask, VerifyVersionInfoW, UnlockFile, DebugBreak, FindFirstFileW, CompareFileTime, FindNextFileW, FindClose, TerminateProcess, GetCurrentThread, SetThreadPriority, SetFileAttributesW, GetModuleFileNameW, GetTimeZoneInformation, GetSystemDirectoryW, HeapCompact, GlobalAlloc, GetLocalTime, CreateDirectoryW, GetCurrentDirectoryW, InitializeCriticalSectionAndSpinCount, SetUnhandledExceptionFilter, GetEnvironmentVariableW, SetEnvironmentVariableW, DuplicateHandle, VirtualAlloc, VirtualFree, IsProcessorFeaturePresent, SetThreadAffinityMask, ResumeThread, SetEvent, ResetEvent, ReleaseSemaphore, CreateEventW, CreateSemaphoreW, GetFileTime, GetSystemWow64DirectoryW, GlobalFree, DecodePointer, SetEnvironmentVariableA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetOEMCP, CreateFileMappingA, LocalFree, LockFileEx, GetFileSize, GetCurrentProcessId, GetProcessHeap, SystemTimeToFileTime, FreeLibrary, WideCharToMultiByte, GetSystemTimeAsFileTime, GetSystemTime, FormatMessageA, CreateFileMappingW, MapViewOfFile, QueryPerformanceCounter, GetTickCount, FlushFileBuffers, ReleaseMutex, CopyFileW, CreateMutexW, SetDllDirectoryW, GetExitCodeProcess, WaitForSingleObject, CreateProcessW, ExpandEnvironmentStringsW, IsWow64Process, OutputDebugStringW, GetFileSizeEx, WriteFile, CreateFileW, SizeofResource, LockResource, LoadResource, FindResourceW, CloseHandle, OpenProcess, GetProcAddress, GetModuleHandleW, GetCurrentProcess, GetLastError, SetStdHandle, WriteConsoleW, LoadLibraryExW, HeapDestroy, GetConsoleWindow, IsValidCodePage, FindFirstFileExW, SetFilePointerEx, ReadConsoleW, GetConsoleMode, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetTimeFormatW, GetDateFormatW, GetFileType, GetACP, GetCommandLineW, GetCommandLineA, GetStdHandle, ExitProcess, VirtualProtect, VirtualQuery, LoadLibraryExA, GetStringTypeW, EncodePointer, GetCPInfo, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, CompareStringW, LCMapStringW, GetLocaleInfoW, UnhandledExceptionFilter, IsDebuggerPresent, GetStartupInfoW, InitializeSListHead, CreateTimerQueue, SignalObjectAndWait, SwitchToThread, CreateThread, GetThreadPriority, GetLogicalProcessorInformation, CreateTimerQueueTimer, ChangeTimerQueueTimer, DeleteTimerQueueTimer, GetNumaHighestNodeNumber, GetProcessAffinityMask, RegisterWaitForSingleObject, UnregisterWait, GetThreadTimes, FreeLibraryAndExitThread, GetModuleHandleA, InterlockedPopEntrySList, InterlockedPushEntrySList, InterlockedFlushSList, QueryDepthSList, UnregisterWaitEx, RtlUnwind, ExitThread, GetModuleHandleExW
USER32.dll	ShowWindow, MessageBoxW
ADVAPI32.dll	ControlService, StartServiceW, CloseServiceHandle, QueryServiceStatusEx, OpenServiceW, OpenSCManagerW, GetTokenInformation, CryptReleaseContext, RegDeleteValueW, RegSetValueExW, RegDeleteKeyW, GetSecurityDescriptorDacl, GetSecurityDescriptorGroup, GetSecurityDescriptorOwner, RegCreateKeyExW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, ConvertStringSecurityDescriptorToSecurityDescriptorW, RegCloseKey, RegQueryValueExW, RegOpenKeyExW, TreeResetNamedSecurityInfoW
SHELL32.dll	SHCreateDirectoryExW
SHLWAPI.dll	PathFindFileNameW, PathCombineA, PathAppendW, PathRemoveFileSpecW, PathIsDirectoryW, PathFileExistsW, PathCombineW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 11:42:29.354820967 CET	49881	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:42:29.359671116 CET	30203	49881	181.71.216.203	192.168.2.9
Jan 10, 2025 11:42:29.359791994 CET	49881	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:42:29.396444082 CET	49881	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:42:29.401330948 CET	30203	49881	181.71.216.203	192.168.2.9
Jan 10, 2025 11:42:29.401463985 CET	49881	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:42:29.406385899 CET	30203	49881	181.71.216.203	192.168.2.9
Jan 10, 2025 11:42:50.746136904 CET	30203	49881	181.71.216.203	192.168.2.9
Jan 10, 2025 11:42:50.746577978 CET	49881	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:42:50.759140015 CET	49881	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:42:50.765265942 CET	30203	49881	181.71.216.203	192.168.2.9
Jan 10, 2025 11:42:51.434442997 CET	49973	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:42:51.439441919 CET	30203	49973	181.71.216.203	192.168.2.9
Jan 10, 2025 11:42:51.439519882 CET	49973	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:42:51.440294027 CET	49973	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:42:51.445128918 CET	30203	49973	181.71.216.203	192.168.2.9
Jan 10, 2025 11:42:51.445379019 CET	49973	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:42:51.450223923 CET	30203	49973	181.71.216.203	192.168.2.9
Jan 10, 2025 11:43:12.824845076 CET	30203	49973	181.71.216.203	192.168.2.9
Jan 10, 2025 11:43:12.824925900 CET	49973	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:43:12.825089931 CET	49973	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:43:12.829855919 CET	30203	49973	181.71.216.203	192.168.2.9
Jan 10, 2025 11:43:12.932951927 CET	49975	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:43:12.937918901 CET	30203	49975	181.71.216.203	192.168.2.9
Jan 10, 2025 11:43:12.937999010 CET	49975	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:43:12.938659906 CET	49975	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:43:12.943489075 CET	30203	49975	181.71.216.203	192.168.2.9
Jan 10, 2025 11:43:12.943564892 CET	49975	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:43:12.948399067 CET	30203	49975	181.71.216.203	192.168.2.9
Jan 10, 2025 11:43:34.322165012 CET	30203	49975	181.71.216.203	192.168.2.9
Jan 10, 2025 11:43:34.322244883 CET	49975	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:43:34.322444916 CET	49975	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:43:34.327243090 CET	30203	49975	181.71.216.203	192.168.2.9
Jan 10, 2025 11:43:34.433243990 CET	49976	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:43:34.438285112 CET	30203	49976	181.71.216.203	192.168.2.9
Jan 10, 2025 11:43:34.438369989 CET	49976	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:43:34.439419031 CET	49976	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:43:34.444166899 CET	30203	49976	181.71.216.203	192.168.2.9
Jan 10, 2025 11:43:34.444258928 CET	49976	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:43:34.449079037 CET	30203	49976	181.71.216.203	192.168.2.9
Jan 10, 2025 11:43:55.804559946 CET	30203	49976	181.71.216.203	192.168.2.9
Jan 10, 2025 11:43:55.805633068 CET	49976	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:43:55.805769920 CET	49976	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:43:55.810579062 CET	30203	49976	181.71.216.203	192.168.2.9
Jan 10, 2025 11:43:55.917327881 CET	49977	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:43:55.922456026 CET	30203	49977	181.71.216.203	192.168.2.9
Jan 10, 2025 11:43:55.923232079 CET	49977	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:43:55.923233032 CET	49977	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:43:55.928235054 CET	30203	49977	181.71.216.203	192.168.2.9
Jan 10, 2025 11:43:55.928289890 CET	49977	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:43:55.933435917 CET	30203	49977	181.71.216.203	192.168.2.9
Jan 10, 2025 11:44:11.184221029 CET	49977	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:44:11.189791918 CET	30203	49977	181.71.216.203	192.168.2.9
Jan 10, 2025 11:44:11.189881086 CET	49977	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:44:11.195900917 CET	30203	49977	181.71.216.203	192.168.2.9
Jan 10, 2025 11:44:11.555119991 CET	49977	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:44:11.559984922 CET	30203	49977	181.71.216.203	192.168.2.9
Jan 10, 2025 11:44:11.560039997 CET	49977	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:44:11.564800978 CET	30203	49977	181.71.216.203	192.168.2.9
Jan 10, 2025 11:44:17.291228056 CET	30203	49977	181.71.216.203	192.168.2.9
Jan 10, 2025 11:44:17.291337013 CET	49977	30203	192.168.2.9	181.71.216.203

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 11:42:29.305432081 CET	61454	53	192.168.2.9	1.1.1.1
Jan 10, 2025 11:42:29.351826906 CET	53	61454	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 11:42:29.305432081 CET	192.168.2.9	1.1.1.1	0x823f	Standard query (0)	newstaticfreepoint24.ddns-ip.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 11:42:29.351826906 CET	1.1.1.1	192.168.2.9	0x823f	No error (0)	newstaticfreepoint24.ddns-ip.net		181.71.216.203	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	05:42:04
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\MicrosoftWORD.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\MicrosoftWORD.exe"
Imagebase:	0x400000
File size:	7'432'192 bytes
MD5 hash:	683C5DB3796F6EF32A5598A9C442C6B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:42:24
Start date:	10/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Imagebase:	0x640000
File size:	2'141'552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000003.00000002.2623673471.00000000092B0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000003.00000002.2622956360.0000000007C01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000003.00000002.2622510013.0000000006A61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	32.1%
Total number of Nodes:	28
Total number of Limit Nodes:	4

Executed Functions

Function 0923E090 Relevance: 2.4, Strings: 1, Instructions: 1174COMMON

Download Yara Rule

Strings

4, xrefs: 0923EA65

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: faef27751c53ba578ef012bfd26fcbdd52f49f1727ca31c000dbe917e4883840
Instruction ID: 972d71c0f90df24e89e0618d351ae73e40362ffb903cd52895648cbf9425ae76
Opcode Fuzzy Hash: faef27751c53ba578ef012bfd26fcbdd52f49f1727ca31c000dbe917e4883840
Instruction Fuzzy Hash: A0B21874A10229DFDB14CFA5C984BADB7B6BF88300F558199E505AB3A5CB70EC86CF50

Function 0923E3B7 Relevance: 1.7, Strings: 1, Instructions: 495COMMON

Download Yara Rule

Strings

4, xrefs: 0923EA65

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: ca1898b20937ca502c1698f5fa6b9243f37a0eb712f6869ed4ec3439eddf845c
Instruction ID: 32f4649100c60bc7ccbb0e499717ef47edf92136ee2d547c60316ce05d7db5a8
Opcode Fuzzy Hash: ca1898b20937ca502c1698f5fa6b9243f37a0eb712f6869ed4ec3439eddf845c
Instruction Fuzzy Hash: 7D221C74A10219CFDB24CFA4C994BADB7B2BF48300F5581A9E509AB395DB70ED86CF50

Function 0937FAD8 Relevance: 1.7, APIs: 1, Instructions: 160
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.2623795935.0000000009370000.00000040.00000800.00020000.00000000.sdmp, Offset: 09370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9370000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa4dd5356f5530db1957aaf697ac484ea38e3b94b210f7d53708b95a37925c32
Instruction ID: 8d5a979e225dee4840808186a842d80eed78328662a43e552f420ca1e4b2fb47
Opcode Fuzzy Hash: aa4dd5356f5530db1957aaf697ac484ea38e3b94b210f7d53708b95a37925c32
Instruction Fuzzy Hash: 475181747001409FC348EB78D6A9B7A77E2EBAC300F86916AD12BCB355CE789D46CB51

Function 0937FB0A Relevance: 1.7, APIs: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.2623795935.0000000009370000.00000040.00000800.00020000.00000000.sdmp, Offset: 09370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9370000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeb59fbe8699f027e877cbd30adbdb6387890b27c20b515adccd4ea0ea2e630c
Instruction ID: 4291a8c4e10464bbc68f64cd52553e243d054d09297a52501ea6217d4a4e73ed
Opcode Fuzzy Hash: aeb59fbe8699f027e877cbd30adbdb6387890b27c20b515adccd4ea0ea2e630c
Instruction Fuzzy Hash: A151A3743001409FC348EBB8D6A9B7A73E2EBAC300F46916AD52BCB355DE789D06CB51

Function 0937FB40 Relevance: 1.6, APIs: 1, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 0937FBD6

Memory Dump Source

Source File: 00000003.00000002.2623795935.0000000009370000.00000040.00000800.00020000.00000000.sdmp, Offset: 09370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9370000_csc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: bb5185eebd93647a16dcb6fdd23d5b07dea2a5f15959f4e5305bf029a2410708
Instruction ID: 5f4f5415aa3e29f689a51a5aa89ccbdcf29059071953fae00db7e182e09bb296
Opcode Fuzzy Hash: bb5185eebd93647a16dcb6fdd23d5b07dea2a5f15959f4e5305bf029a2410708
Instruction Fuzzy Hash: 97515F74300140DFC348DBA9D6A9B7A73E2EBAC300F86916AD12BCB355CE789D46CB55

Function 09232220 Relevance: .4, Instructions: 438COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b595589e3d4d9a8394e9dea419d83b4031e01e11477fcd4212485f9e5b55b73f
Instruction ID: 55da120745b03475568ad9cf643fc8774f378b7a30558654ac5093322ccee2ea
Opcode Fuzzy Hash: b595589e3d4d9a8394e9dea419d83b4031e01e11477fcd4212485f9e5b55b73f
Instruction Fuzzy Hash: F4028870A00244DFDB08CFA8D595AA9BBF2FF88304F518569E5169B3A1DB38ED46CF50

Function 09395978 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00b6b6bd9a84a51c3f70b27e06be2ac7edd97d512d63edc81f1fb5aec8578033
Instruction ID: 701782d2f3ed67a8fff83c1e08e29eced4f8d5145368e3fa9a92b0c8f25a8fd1
Opcode Fuzzy Hash: 00b6b6bd9a84a51c3f70b27e06be2ac7edd97d512d63edc81f1fb5aec8578033
Instruction Fuzzy Hash: 12C19131A10208DFEB16DBA8D584BAAB7B7EB85310F10C564F90A9B694DB74DD86CF40

Function 09395988 Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d2223f91f430ec3d00e7cd870cf73dc0853080f05340b9323fab8944afe22b7
Instruction ID: 745021e842734c5cdbaaaf5b51841feb2c591dc150befd25ebd7911609001f4e
Opcode Fuzzy Hash: 7d2223f91f430ec3d00e7cd870cf73dc0853080f05340b9323fab8944afe22b7
Instruction Fuzzy Hash: 72C1A132A10208CFEB16DBA8D584BAAB7B7EB85310F10C564F90A5B694DB74DD86CF40

Function 09394CCA Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 928aa28253cf514fa222b4384200eb905d4523254467a0c61fc0abe677f1705a
Instruction ID: 1bda8bd2bbf2c07021f81d6481cd27243fc8db664bfa805415365fe029107126
Opcode Fuzzy Hash: 928aa28253cf514fa222b4384200eb905d4523254467a0c61fc0abe677f1705a
Instruction Fuzzy Hash: CFD15970B10104CFDF09DF68D649BAA73F6EB88304F608569E4169B761DB38AD86CF91

Function 09394CD8 Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b03094dae21eacab0834e01ed1b42093adcd265427a8531186ecc36a65700200
Instruction ID: 8a477401351a363344da5e8ec019fbdec6cfdeb10010f86b5b0d3a578fe50d38
Opcode Fuzzy Hash: b03094dae21eacab0834e01ed1b42093adcd265427a8531186ecc36a65700200
Instruction Fuzzy Hash: 45C16970B10104CFDF09DF68D649BAA73F6EB88304F608569E4169B761DB38AD86CF91

Function 09397BAE Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a38346640604cfb0a54bae7a59010f579769973d5470fe094ba50570e4cff867
Instruction ID: 04b98dbaf621ab37dc1aa934ea794bcaa1653793d3e48271137deed777b0a198
Opcode Fuzzy Hash: a38346640604cfb0a54bae7a59010f579769973d5470fe094ba50570e4cff867
Instruction Fuzzy Hash: CED13734620104DFDB18CF68D589BAA77F2FF89714F2580A4E506AB7A1C779AD86CF40

Function 093959C8 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baf139bf06dcb7300258d20ba56d74d0dd971314551c8dc8fe887c58fc5d34a3
Instruction ID: eb0d32ecf4f6bf882bc062ade26b192c9d8432d0fc89eb2bc1016caf5c94ebdb
Opcode Fuzzy Hash: baf139bf06dcb7300258d20ba56d74d0dd971314551c8dc8fe887c58fc5d34a3
Instruction Fuzzy Hash: EFC18131A10208CFEB16DBA8D184BAAB7B7EB85310F10C564F90A5B698DB74DD86CF40

Function 093933E0 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3315c33a40325806c2365cb015f404402bad80774d5d0570072925261ff34c2c
Instruction ID: 00bfbbd84b3d8202a2074bb9b1d87fa13de9f832463a29b75e9bf7895b2b6e3b
Opcode Fuzzy Hash: 3315c33a40325806c2365cb015f404402bad80774d5d0570072925261ff34c2c
Instruction Fuzzy Hash: 58B17EB0E10209CFDF14CFA9D8857AEBBF2AF48714F148529E815EB294EB749845CF81

Function 093927C8 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ea027140cfbe501c09547100c01707dbf05e26c9725cb684be6e63ba986db9d
Instruction ID: 02bfc4aaf6fb5e78e1efabaed3fd7d18257cd4ab4b290308b7443887347ecbb5
Opcode Fuzzy Hash: 0ea027140cfbe501c09547100c01707dbf05e26c9725cb684be6e63ba986db9d
Instruction Fuzzy Hash: 9E916E71E10709AFDF20CFA9D8857AEBBF2AF88704F148129E415E7294DB749885CF91

Function 093950ED Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a61d0514bf088e3f39d385110814153e7891098b788150889163c44870cf29c7
Instruction ID: a3f0c5ad3146efc035691d96ee14e1c0951196dcc4bee4d351eec55065ed7a03
Opcode Fuzzy Hash: a61d0514bf088e3f39d385110814153e7891098b788150889163c44870cf29c7
Instruction Fuzzy Hash: 8A914B70E20104CFDF09CF64D548BAAB3B6FB88308F608569E4119B765DB38AD86CF80

Function 09231CA8 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be6048210b6f2e9b1fbabdf8a9a366ee5f55646822f37930440e195616102a83
Instruction ID: 038fc96d1bc0e0b1c27bf32c1e7b6a0552ec38080eff1284d8db475d24e94402
Opcode Fuzzy Hash: be6048210b6f2e9b1fbabdf8a9a366ee5f55646822f37930440e195616102a83
Instruction Fuzzy Hash: 1A8149B0A00248DFCB48CFA8D699BAD77F1FB48304F508569E516DB392DB78A946CF05

Function 04C9CA18 Relevance: 1.6, APIs: 1, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 04C9CA8C

Memory Dump Source

Source File: 00000003.00000002.2621966155.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c90000_csc.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 234aadb3e955c4fa749fc2c31db6041755f354cd4277830261808a669880e88b
Instruction ID: 4566fd963d8cc539be38881b53f75dd4bb5c0c865721e9a05f06f2c78bc519ad
Opcode Fuzzy Hash: 234aadb3e955c4fa749fc2c31db6041755f354cd4277830261808a669880e88b
Instruction Fuzzy Hash: 021124B19003089FDB10DFAAC484BAEFBF5EF48320F14842AD519A7250CB75A940CFA0

Function 0923D5B8 Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

d#, xrefs: 0923D5CF

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID: d#
API String ID: 0-3351330987
Opcode ID: 131b0b97b5502b8b7ca3a8e14f20903f50d4bacde027a1ee1ec190964652591f
Instruction ID: 4021927d387423751236bdf066265bfab1c77157a5c1701763bc7e26642d7e9a
Opcode Fuzzy Hash: 131b0b97b5502b8b7ca3a8e14f20903f50d4bacde027a1ee1ec190964652591f
Instruction Fuzzy Hash: 13419CB1A1021A8FCB14DFA9E9457AFBBB1FF88350F40C12AE419E72A1D734D945CB91

Function 0923D5A7 Relevance: 1.3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

Strings

d#, xrefs: 0923D5CF

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID: d#
API String ID: 0-3351330987
Opcode ID: 58c0d5d3cf9335fedfa55330f5732ddde0dc89bdfca86db1478c0c55c74398c0
Instruction ID: ff8037a8132a58668c65c379051ba324f4da4870c27f1c593ac655895b38373a
Opcode Fuzzy Hash: 58c0d5d3cf9335fedfa55330f5732ddde0dc89bdfca86db1478c0c55c74398c0
Instruction Fuzzy Hash: 1C218BB0A002168FCB14CF69D9456AEBBF1FF88310B41842AE81AD73A1E7349842CB91

Function 04C9CBC8 Relevance: 1.3, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 04C9CC2A

Memory Dump Source

Source File: 00000003.00000002.2621966155.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c90000_csc.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 6bba5d1bfbabc4dba6a3e381ffdbe11df1b77035fd4bd8956e69d43d55e782c7
Instruction ID: 98bf3b535ad218b242234396b2e09178bee3d7ada105f75f65804a70624ada3d
Opcode Fuzzy Hash: 6bba5d1bfbabc4dba6a3e381ffdbe11df1b77035fd4bd8956e69d43d55e782c7
Instruction Fuzzy Hash: 861136B19003488FDB10DFAAC4457EEFBF5EB88324F248429D559A7240CB79A944CBA4

Function 09360078 Relevance: .6, Instructions: 597COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623762506.0000000009360000.00000040.00000800.00020000.00000000.sdmp, Offset: 09360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9360000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6d8f8867b0c1ec175f723ee6069ad313601df84a6159700793856f3a5dde84b
Instruction ID: c229d513079278ed6a5eeea9c94781d5fd64689fb0109e0157fabd6cd5a85561
Opcode Fuzzy Hash: f6d8f8867b0c1ec175f723ee6069ad313601df84a6159700793856f3a5dde84b
Instruction Fuzzy Hash: 3602B431B002158BBB3D5AA7445A33F26DA9BC9751F14C429E907EB36CDE64DC818FA2

Function 09396D50 Relevance: .5, Instructions: 548COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0db74d0bf9a552f8033cc8f88a2166087e2473c00bd538dac121df02fe674823
Instruction ID: dd5ea2a23e64f85909164dc484afa423deda687be48abb9b026eab702aabd71f
Opcode Fuzzy Hash: 0db74d0bf9a552f8033cc8f88a2166087e2473c00bd538dac121df02fe674823
Instruction Fuzzy Hash: F712AD30B106059FDB28DF68C9546AEBBF2FF88710B148569D44ADB790DB34ED02CB95

Function 09360810 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623762506.0000000009360000.00000040.00000800.00020000.00000000.sdmp, Offset: 09360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9360000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6af98ba271d42c1698fc90de48a6e36923354bd6f3ce1207202ce9e2d6a9fcb0
Instruction ID: 8b49e2e99f80e6b4a00908c75634a00a18cacb25cebdf657ad2636bda2e0cca4
Opcode Fuzzy Hash: 6af98ba271d42c1698fc90de48a6e36923354bd6f3ce1207202ce9e2d6a9fcb0
Instruction Fuzzy Hash: 24C19E39B016058B9F1DAB6A906A17EB6F7FFC63403148429E817D7368DF399C468B42

Function 093969A8 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9417452f1f89b498b97b9a50198a499b4e309caf3a586a682412dcaa45f1ebf7
Instruction ID: 533e4c081f2e9d8b5f2fdca16f987d602062bc404a291ee2df49250c5b0a0792
Opcode Fuzzy Hash: 9417452f1f89b498b97b9a50198a499b4e309caf3a586a682412dcaa45f1ebf7
Instruction Fuzzy Hash: 80A153313083019FEB2AAB78985076E7BA7EFC5214B1481AAD406DF391DF35DC06CBA1

Function 093933D4 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0048a75b3e2217a2b36dfd7bf5999d52cf7dd7988e863e73b636bf89e8cce7c
Instruction ID: d5f748667cfb1965983cdb1c1ebe2eb2ab2af21fd49a37fdfc2bcf91602b02bf
Opcode Fuzzy Hash: b0048a75b3e2217a2b36dfd7bf5999d52cf7dd7988e863e73b636bf89e8cce7c
Instruction Fuzzy Hash: 0EB16EB0E10209CFDF14CFA9D8857AEBBF2AF48714F148529E415EB294EB749885CF91

Function 093927BC Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99e4ac428fd7340edae2689efd0c5e1f149842db6c8c10485cf78dd4c48c51c1
Instruction ID: 100eef35f78965d36581f8f8e970c5f885d10ea8911a02d5f3df4c85c0ae0f31
Opcode Fuzzy Hash: 99e4ac428fd7340edae2689efd0c5e1f149842db6c8c10485cf78dd4c48c51c1
Instruction Fuzzy Hash: 26916C71E10609AFDF20CFA9D8857EEBBF2AF48704F148129E815E7294DB749885CF91

Function 0923D108 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 532b478ed293024b43d921c5cf3cc8454b39b9863092c5ff15ac246a2db793d4
Instruction ID: 86034960234991372c6bd437fd241030c5b7a2eb68afafa6617882b618dca3e4
Opcode Fuzzy Hash: 532b478ed293024b43d921c5cf3cc8454b39b9863092c5ff15ac246a2db793d4
Instruction Fuzzy Hash: BB81A975B112498FDB04CFA5D694AADBBF2EF88311F648069E811EB390CB35DD81CB91

Function 09236CD8 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89f7bdc2eadfd0d8ef1aba47fefd2a3199b7ea59b4fb6d5286ff73943cd74c7e
Instruction ID: 15245941d82da468dacea32908b673dd5963a82a71ba633b68dbd64d9b86baa3
Opcode Fuzzy Hash: 89f7bdc2eadfd0d8ef1aba47fefd2a3199b7ea59b4fb6d5286ff73943cd74c7e
Instruction Fuzzy Hash: C981FFB2925A56CFD71EDF20C896B65BBB4FF02319B6880EDD0838F061C736A541CB45

Function 09235D48 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93bd1f83ac71094e0132dc5b1f36c99d6e54c869fec4e50cedc721194e276185
Instruction ID: 6464f103a5549e8f58ca5afa099dd478bb025bfa70f1d41b3760c9b02ff69f43
Opcode Fuzzy Hash: 93bd1f83ac71094e0132dc5b1f36c99d6e54c869fec4e50cedc721194e276185
Instruction Fuzzy Hash: 25718EB022120ACFD718AF24D64CB6A77A2EB54341F90C968F40F8F265EB79DD46CB41

Function 09360CC8 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623762506.0000000009360000.00000040.00000800.00020000.00000000.sdmp, Offset: 09360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9360000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14aa2c72d235d40b80731ad85e3e7a716593c8c26ee7af6e8f1abcde344979ef
Instruction ID: 6c9d14d720e03c76a98b39a09547e81e0a06975da0ebcaa066b3296e2d2074bb
Opcode Fuzzy Hash: 14aa2c72d235d40b80731ad85e3e7a716593c8c26ee7af6e8f1abcde344979ef
Instruction Fuzzy Hash: FA51903170028197EB186ADAD4A872BF6EFDBD5300F90947DB206CB66CDFB19C054B92

Function 092322B2 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 154d515061ccd89cc1a3a909d6381707aafa2bc090940ac6d4b40740fef57fd7
Instruction ID: 12d674700d8aaca94b0b3745faefe0ec426353307d4832fe16e6ab96fa053c35
Opcode Fuzzy Hash: 154d515061ccd89cc1a3a909d6381707aafa2bc090940ac6d4b40740fef57fd7
Instruction Fuzzy Hash: A771AB75610600CFC708CF69D594A59BBF2FF88710B5682A9E416EB361DB30ED46CF90

Function 091EFAE0 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623502449.00000000091E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 091E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_91e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09022c739a18eef2dd3f5e7a961e020b3f452b68c6eb3eca3484921f277d6910
Instruction ID: bb3c658cb70158ff4eb67f470966724c789e1ce2af73d6b475423aa0fadfc143
Opcode Fuzzy Hash: 09022c739a18eef2dd3f5e7a961e020b3f452b68c6eb3eca3484921f277d6910
Instruction Fuzzy Hash: FE51CC34B006059FEB29EF78C554A6E77A7AFC5604B20846CE8069B394CF35EC43CBA1

Function 092322D0 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca86671b993e1025d584e7887e914c6aec6fba954356462994eef2266503ed27
Instruction ID: 07f53975e71b3deb86e4dbe16e483b68735f8bb07f87716a6af3266505856a42
Opcode Fuzzy Hash: ca86671b993e1025d584e7887e914c6aec6fba954356462994eef2266503ed27
Instruction Fuzzy Hash: 88618975A10604CFCB14DF69D684A59BBF2FF88710B52C268E526AB360DB30ED46CF90

Function 09236A39 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 847062b00fe965b0bae26cec13a00319cfa146f5c0c9fbd8fbf60ee6d21b8337
Instruction ID: 121f6b298c37e8bfc6c6c3c5aee3ff2f5bdb65badee6904cf7fb1ecc7fc7a030
Opcode Fuzzy Hash: 847062b00fe965b0bae26cec13a00319cfa146f5c0c9fbd8fbf60ee6d21b8337
Instruction Fuzzy Hash: 2F5102B0720105EFEB08CF64D64ABAA73BBFB88310F94C169D1059B264CB799D86CB44

Function 0923B9D0 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac16c98d20c772d14af56dddbceadce23f3e5623d6455493d97dd44224a77cd3
Instruction ID: 8adb04c32f41bea3132ff388c15e6a6063dfb8cbb5301bbc63f58a77fae04eff
Opcode Fuzzy Hash: ac16c98d20c772d14af56dddbceadce23f3e5623d6455493d97dd44224a77cd3
Instruction Fuzzy Hash: 1A512F76600104EFDB459FA8C905E697BB7FF8D314B1680A8E6059B372DA32DC22EB51

Function 0923F740 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 514ad5a802459ed1aee8be170aed4265b683dff5ea338188934c04a5ffaab40a
Instruction ID: 48f87daec4f737f64611d1454e590a0c527d6af169ebbde9dc92b5cfea3a4976
Opcode Fuzzy Hash: 514ad5a802459ed1aee8be170aed4265b683dff5ea338188934c04a5ffaab40a
Instruction Fuzzy Hash: B4412631A183855FD71ACF78C5249A97FB1EF92300B0541EED885CF2A2CA249C46C791

Function 0923C3E8 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 793e6e05f79272a4900e3d5ff789f82ab048a40550107e7b74f3de66d5844347
Instruction ID: 02b91ddbc496e782ad3cf03201aa06c8088eaf1877b96f14c0a67b516095868c
Opcode Fuzzy Hash: 793e6e05f79272a4900e3d5ff789f82ab048a40550107e7b74f3de66d5844347
Instruction Fuzzy Hash: B54110712147428FE725DF3AC54031ABBE2AF84310F14CA2DD9869B7A0DB74EC4ACB91

Function 093961A8 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffd48559a88aa9e3a232fa3301e66d992a3facfc90d5559db6403990f9c019e6
Instruction ID: 90f4acfdd9a22a667c4a5c9be86a11f445b7d9da5d7d2ed481364ed46b9c81c9
Opcode Fuzzy Hash: ffd48559a88aa9e3a232fa3301e66d992a3facfc90d5559db6403990f9c019e6
Instruction Fuzzy Hash: 79514830A26105CFEF14CF54CA8ABAEB7B6FB8434CF648169E0159B656C778D986CF40

Function 092360DB Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f83555017ed5bc0654bdbc64b7bedac7a13b4105aeff02ec46831d51746843a0
Instruction ID: a77b912e9548381da39c103efeddd02cc8963fdf51bc06fcdc59ab1f0ceb8b58
Opcode Fuzzy Hash: f83555017ed5bc0654bdbc64b7bedac7a13b4105aeff02ec46831d51746843a0
Instruction Fuzzy Hash: EA4139B87125109FDB09AB74E61E26D37E2EBA8702B508069E847C7394DF3C9D47CB46

Function 09398088 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 629f2a87a6fbd1560b1601bf5bcca76857522fb4c4b38ffc3c4f32294c7a3222
Instruction ID: 0b4285ddc84aec75b985b800afeb7e8fabf491fffadaff2e22db312e006c5529
Opcode Fuzzy Hash: 629f2a87a6fbd1560b1601bf5bcca76857522fb4c4b38ffc3c4f32294c7a3222
Instruction Fuzzy Hash: FA417B30A25100CFEF14CF55E948BAAB3A6FBC6304F18C565D4198BB55D738D946CF41

Function 0923C9F0 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd05572f6a1ef4a5c68c4e71944920e1245d90ad2bc384d444d6c66b99901053
Instruction ID: c9d1b8358a230eb29b5c8614ce0c51a59e7ba9faf70e5b89fe2f9ffab9563e37
Opcode Fuzzy Hash: bd05572f6a1ef4a5c68c4e71944920e1245d90ad2bc384d444d6c66b99901053
Instruction Fuzzy Hash: 74419F71A206168FCB04CF58C484A6AFBB5FF89324F55C659D969AB241D730FC52CBC4

Function 0923D428 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 374af6c452e1fc7daf5ab8954034b188c9caa8f535af3fb84845ecf37810bf55
Instruction ID: d4abf37cee163466b8f9128745ef43f1a74bcfb1d7639a30524312fce2c92e7f
Opcode Fuzzy Hash: 374af6c452e1fc7daf5ab8954034b188c9caa8f535af3fb84845ecf37810bf55
Instruction Fuzzy Hash: AB4158B4B10219DFDB24CF69D854BAAB7F2BB88314F54C429E9069B790DB70E845CB90

Function 093965D1 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb5768af886fac072249e1c591f495b12a5806d189765515e10e46c0bff7949d
Instruction ID: a090dd34e486102fa20bf2eaec91809bc43ad5c1127104a3f8e8fbff6aab79d3
Opcode Fuzzy Hash: cb5768af886fac072249e1c591f495b12a5806d189765515e10e46c0bff7949d
Instruction Fuzzy Hash: D3419135A02200CFDB14CF64D996B9ABBB7FB88315F148179D51A8B691CB79EC46CF40

Function 093965E0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbeb2886c9f7c31cc895f73230bdaac5f83b69fb3cbce8ffd65d7e8f37a8286e
Instruction ID: 95d6501273c80fbc12fd56d9f2436ad5eceb891f58c91bafaca7d1eb70c1c807
Opcode Fuzzy Hash: bbeb2886c9f7c31cc895f73230bdaac5f83b69fb3cbce8ffd65d7e8f37a8286e
Instruction Fuzzy Hash: 20418235A01200CFDB14CF64D996B5ABBB7FB88315F148179D51A8B694CB7AEC46CF40

Function 0923C278 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad8b64a84de0bc1b53951fb435fe19a8c79d9b43a45b4ea5e3d2613ef3b72208
Instruction ID: 105ec4d6800935fc403ba220f212bce79f095d72e895377e0f6ea05d72955d94
Opcode Fuzzy Hash: ad8b64a84de0bc1b53951fb435fe19a8c79d9b43a45b4ea5e3d2613ef3b72208
Instruction Fuzzy Hash: F03108367012469FEB189FA9D844AAEBFA7EFC9320F14813AE905D7260CF718C15D790

Function 09390C1C Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 084cf138f7929d073a299ab923ec5bee930913dd99db9f47821d8752c4eba631
Instruction ID: 54faaf34a91c2ac97760df3fd6f4e910dd727514e0f08ab4da9f7b96d2599a4f
Opcode Fuzzy Hash: 084cf138f7929d073a299ab923ec5bee930913dd99db9f47821d8752c4eba631
Instruction Fuzzy Hash: 7041CDB4D103489FDF14DFA9C484BEEBBB5EF48314F248429E809AB254DB75A985CF90

Function 0923E07F Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c00c1c650c278e2f43363da1396e570f81326f50d7cb19300bc5bdf22ee20c19
Instruction ID: 43955dfdad6ea805e3d97fbc1a1c1d7ca4abfaf7f13fc2a5ea921a9c29c86c9f
Opcode Fuzzy Hash: c00c1c650c278e2f43363da1396e570f81326f50d7cb19300bc5bdf22ee20c19
Instruction Fuzzy Hash: E341F674A212288FEB24DF24CD91FA9B7B1BB58710F5181E9E909AB3D1C671ED81CF50

Function 0923C3D9 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37aa7fa33708b851ac8af17dfb98948ca6aee8613b9e123ed430508b251061b7
Instruction ID: a8b6c4890a8e9d8a8c06053841acf89b6ee108cef5c10f5b4314cf15a33035e2
Opcode Fuzzy Hash: 37aa7fa33708b851ac8af17dfb98948ca6aee8613b9e123ed430508b251061b7
Instruction Fuzzy Hash: 3A31C2B1214B418FE330CF76C540356B7F1AF84320F54CA2DE99697AA1EB74E949CB51

Function 09390C28 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2f2d6a7702dc14cf340c9227fc47e1079f4d015b8b952241988b4d4a925ec5d
Instruction ID: 46ccc10d16f580ee588d9b6bc2abb719d5b8d5135203f606624f3d39066374f5
Opcode Fuzzy Hash: c2f2d6a7702dc14cf340c9227fc47e1079f4d015b8b952241988b4d4a925ec5d
Instruction Fuzzy Hash: C541CCB49003489FDF14DFA9C584BDEBBF5EF48314F248029E819AB254DB75A989CF90

Function 09398079 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18a1a1dcbd1a43a4bbe1a027df705a6cf31340817117eefe79587c5324242fee
Instruction ID: 1a30a309d63e6e22616fbba59018067cfc4f1344e6f45d138379c7f2ba33b44b
Opcode Fuzzy Hash: 18a1a1dcbd1a43a4bbe1a027df705a6cf31340817117eefe79587c5324242fee
Instruction Fuzzy Hash: D5318A30A25201CFEF14CF59D949BAAB3B6EBC6304F18C16AD41A8B751D738D9468F42

Function 0923AF80 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 369a0932f942ebf37cb69354fbebb8c5232c6d7d9173b2b6c76ce395827db45a
Instruction ID: 9ed191f63d7f427c269f671098a35e7be2c6e3b1fa08a0e42fb2b2e7728f093d
Opcode Fuzzy Hash: 369a0932f942ebf37cb69354fbebb8c5232c6d7d9173b2b6c76ce395827db45a
Instruction Fuzzy Hash: 1C31E1B0A15149DFDB08CF56D649BBA73F3EB88300F54C075E1029B694DBB98D45CB15

Function 093949E1 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00b614047ed2667128d9267ad0236f32069ed699f6e328cd1f56be985d9fd00e
Instruction ID: 0e866fdc87d76c82139f196db53e7dcbe50ede24fd37a2564b133969fd363797
Opcode Fuzzy Hash: 00b614047ed2667128d9267ad0236f32069ed699f6e328cd1f56be985d9fd00e
Instruction Fuzzy Hash: B831CF70A14298DFDF08CF98D44879D7BF2FB89304F0081A8C005A7621DB399A86CF85

Function 0923AF90 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 491b9137a209d27c4f5c663fc9638113fe4571ccc06f26579d85e42d9426a649
Instruction ID: 6d85714abb4b316f98196334ad23e46352b8f2c70a25e9331c1045d1b832edf5
Opcode Fuzzy Hash: 491b9137a209d27c4f5c663fc9638113fe4571ccc06f26579d85e42d9426a649
Instruction Fuzzy Hash: 193100B0A10009DFDB08CF56D649BBA73F3EB88300F54C075E101AB654CBB59D45CB11

Function 09394132 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68e2e8d49295bc63c4d19fa0089fb2dbfef8615a1ad4d4c9a790b0f3cf6f29ee
Instruction ID: 31dc9c2f500483cdd7ab0fc88d1d0afd76fecbbceec8a55d12114ee308feabff
Opcode Fuzzy Hash: 68e2e8d49295bc63c4d19fa0089fb2dbfef8615a1ad4d4c9a790b0f3cf6f29ee
Instruction Fuzzy Hash: B731BCB0711240EFDB08DB64D699B6937F3AB48300F5181A6E2268F6A1DB78DD458F04

Function 0923B0D4 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0e44d0bd23a484df3211f280f9edcb6bd716479058fd84996810eae427dea28
Instruction ID: 6938d81485ed3ddefe08ed439839eff27b6ab494bd0d0afe5423b340af482fdb
Opcode Fuzzy Hash: b0e44d0bd23a484df3211f280f9edcb6bd716479058fd84996810eae427dea28
Instruction Fuzzy Hash: F7312FB0A29149DFDB04CF96DA89BB973F3FB88300F94C0A5D005AB664C7B88D45CB01

Function 0939810E Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5c8bd6c95f1d9d2161d89baec0336718a52807ef05843494251b62b37603307
Instruction ID: 409b2ae7ac153fce179aefb122548f011840947f51c48acc8d2ffe6fb86e0557
Opcode Fuzzy Hash: e5c8bd6c95f1d9d2161d89baec0336718a52807ef05843494251b62b37603307
Instruction Fuzzy Hash: BC31AD30B24101DFEF14CF55D948BAAB3A6FBC6348F08C165E41A8B750C738D846CE01

Function 09398247 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0080ecd52824a07582705b6710f2a3afdfa1968b9d12ae7ca4905d74c64ced8c
Instruction ID: 3038fddd8a197fb297c8343d15e82ff0cae956a72d27d3519b00fa62c3424f53
Opcode Fuzzy Hash: 0080ecd52824a07582705b6710f2a3afdfa1968b9d12ae7ca4905d74c64ced8c
Instruction Fuzzy Hash: FC317A30B25101DFEF14CF55EA48BAAB3AAFBC6345F18C165E41A8B754D738D856CE02

Function 09236855 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7a0a97e7a9cc69afbfe2d43eba7ee73afa64557cfd1ae1905ff3b2bc28fe08f
Instruction ID: 806bc9d319789ea3f1a08ff8c03c9e1435742395c145550df2cbd46f023d072e
Opcode Fuzzy Hash: d7a0a97e7a9cc69afbfe2d43eba7ee73afa64557cfd1ae1905ff3b2bc28fe08f
Instruction Fuzzy Hash: 2C3158B0A10205EFDB08DF69C549BAEBBF5BF4C304F248169E416AB3A0DB759D45CB90

Function 0923F8F0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a171501c51360c1485b62b87efd2d00327a0d4d45a50019f3bb95b2fa0e48ca
Instruction ID: fdfc6ead2ce7cd544a71871ab9da6da7fa008d6dcfcbbe85cc620ef2d43d807f
Opcode Fuzzy Hash: 9a171501c51360c1485b62b87efd2d00327a0d4d45a50019f3bb95b2fa0e48ca
Instruction Fuzzy Hash: 60213BB1E20209AFEB10DF78EA047EEBBB4AB44350F90C066E555DB250E774CA50DB91

Function 0923C180 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10a7dc0c715fb3b7e4cf1de617100347fe42c162e9d4c8dde0e1997bbcc579f1
Instruction ID: 466a4d7b2cd48185549e902565df4a0d6167cef09a5aea92dbb5bd4bbf12a725
Opcode Fuzzy Hash: 10a7dc0c715fb3b7e4cf1de617100347fe42c162e9d4c8dde0e1997bbcc579f1
Instruction Fuzzy Hash: 3B213B31A00249DFDB19DFA9C4549DEBBB6FB88320F148129E811B7394DB719C81CF91

Function 0923B700 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cc9c1dbe0d268d7531cd8632ee853072888bf0a157ba020ead09814dcc0b500
Instruction ID: 14c57df6eb512c37e9c24b6176b4958fbecba14a2c18f003369ac7c159d45c23
Opcode Fuzzy Hash: 5cc9c1dbe0d268d7531cd8632ee853072888bf0a157ba020ead09814dcc0b500
Instruction Fuzzy Hash: 7221CF71710305CFEB19ABB4E8453AE77EAEB88314F008538D44ADB685DFB19D468BD2

Function 0923C190 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89af78919c6773967c03badad04555d5af5fe9195a86f893773b856f8806242b
Instruction ID: ba5f8576b96200576d687fd25ab4c49765717b7f5ae016b56bbbda8f5b13afd3
Opcode Fuzzy Hash: 89af78919c6773967c03badad04555d5af5fe9195a86f893773b856f8806242b
Instruction Fuzzy Hash: C9211835A00249DFDB15DFA9C8549DEBBB6EB8C320F148129E815B7394DB719C81CBA1

Function 0923CB31 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b33a618290a7424f5b1e101622bf9c4057ab63ff2df86edefa618520992bf1de
Instruction ID: c8c80a6683e19e2398356708c7fbb7000a59c576c2d061c5d4b98b1fc90a44c1
Opcode Fuzzy Hash: b33a618290a7424f5b1e101622bf9c4057ab63ff2df86edefa618520992bf1de
Instruction Fuzzy Hash: CD11B675B102459FCB14DFB99814BAE7BF6AB88710F108425E946E7380DE71C941CB91

Function 0923C8A9 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a21e962407bba19625f57b8f8927f6c87264cd1db43aecded8ab3267b0a2d9a
Instruction ID: b958f84bab6d4abbd62a026fbfb3c8685638f06d4566cffaa0fc27259f44dc15
Opcode Fuzzy Hash: 4a21e962407bba19625f57b8f8927f6c87264cd1db43aecded8ab3267b0a2d9a
Instruction Fuzzy Hash: 83216F79B52259EFDB04CFA8E594AADB7F2BF49300F614158F802AB361CB30AD41CB50

Function 0923C77A Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bce78d44430d5029cff41a84ceca540e9e822e7b28800b0bc7c476cc048165b9
Instruction ID: d896af40161d7986d11abb373a04d59c50be49869286d160c848888921b8e4f9
Opcode Fuzzy Hash: bce78d44430d5029cff41a84ceca540e9e822e7b28800b0bc7c476cc048165b9
Instruction Fuzzy Hash: 11119676340255AFDB14CF58EC84FAE7BA9EFC9721F10806AFA05DB291C7B1D9008B50

Function 093982F0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7661f71bb128df6a61478952e97c5a470e4e54a7e3edcf97b26922382c7da9a
Instruction ID: 97daa9143aeed6dbb5988fda96f33dff17db59f9f3baf8a19b56574fd2c5a35a
Opcode Fuzzy Hash: e7661f71bb128df6a61478952e97c5a470e4e54a7e3edcf97b26922382c7da9a
Instruction Fuzzy Hash: D811AC34A21101DFDB05DF28C598BAE77B6EB86345F48807AC509CB680DB75D947CF81

Function 09395850 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9adefec060e72ccda4aaaf48ebff11f872b366b4dc08b17444a657b64bb46d03
Instruction ID: 0ce165cac6c17048856b39da4b39b88f3d4b62497d82bc0b886f78279e8f7fd7
Opcode Fuzzy Hash: 9adefec060e72ccda4aaaf48ebff11f872b366b4dc08b17444a657b64bb46d03
Instruction Fuzzy Hash: 5F018F307023609FDB263B78840432E3BA65F85611B1408BDD4568B382EE2A88638385

Function 09396900 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc968459f0807e261daa8897f2079f81f4a66c2eed4a742e000f20d5fdd939f6
Instruction ID: 58c337861fc84ee227bdc7a3b30b8a783138fad1cad5aa68717066098d6c2bd7
Opcode Fuzzy Hash: cc968459f0807e261daa8897f2079f81f4a66c2eed4a742e000f20d5fdd939f6
Instruction Fuzzy Hash: 0001A131A14208ABDB15AF68D459AAEBBF7EF88710F104469E802A7354CF754D05CF92

Function 09398300 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ecf6aa39f052910df3821b49ef2d0288a4c759d297ac8c6d6a4db2594e6eb56
Instruction ID: 6088e5c4bc6b99cbae095f9ea0053923e005d2ab2e023a9c28152fad98d51990
Opcode Fuzzy Hash: 9ecf6aa39f052910df3821b49ef2d0288a4c759d297ac8c6d6a4db2594e6eb56
Instruction Fuzzy Hash: DB018C34A21101DFDB049F28C598BAE77E6EB86385F88807AD509C7640DB7AD946CF81

Function 093938D0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e243c8528e74a73de2cfa5bff274cacfd90ecbca96ca5c13c2331f44812b218e
Instruction ID: 43e6f8dff1950042c6ab07e6ab15da96089564e264f4fa36e1b429e83daef792
Opcode Fuzzy Hash: e243c8528e74a73de2cfa5bff274cacfd90ecbca96ca5c13c2331f44812b218e
Instruction Fuzzy Hash: B501F172D04209CFDF10DBA9D4083EEFBF1EB84320F048469D55A93251DB78954ACF81

Function 09395860 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5e3da4ebe4a52c30005ecade93927873feda14703e9b583e95d2879121bf1b9
Instruction ID: 6905fed1c1f3a28a5fec09db8b86a00efea86186daaf74ca9760029d750a200e
Opcode Fuzzy Hash: b5e3da4ebe4a52c30005ecade93927873feda14703e9b583e95d2879121bf1b9
Instruction Fuzzy Hash: EBF06231B42360AFDB163778441432F3BD65FC9611B2408BDD5468B382EF3AC8639795

Function 09396910 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cee260d8e917585839205548d3b6809ec849865652a05112990d8e2f55a96781
Instruction ID: 4d4e2724f3672618ae18b16413d52ec83e00048ff6f8de773754a9e23790ad96
Opcode Fuzzy Hash: cee260d8e917585839205548d3b6809ec849865652a05112990d8e2f55a96781
Instruction Fuzzy Hash: 0A017131610218ABDF25AF69D818AAEBBF7EF8C711F104429E902A7354CFB55D01CF92

Function 091E6D3C Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623502449.00000000091E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 091E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_91e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c81ae5045c669af0b6959fda2dbde324a7236ec764f5fecd20e60d1c0c808206
Instruction ID: 98489ba84917d695f5b167dd35b38ab28b116dc0c9242bb69dbb383c1adf114c
Opcode Fuzzy Hash: c81ae5045c669af0b6959fda2dbde324a7236ec764f5fecd20e60d1c0c808206
Instruction Fuzzy Hash: 8811D674A00258CFC714CF64C494AADBBF5BF48325F5591A9E90AA7351C734ED81CF50

Function 0923BBB2 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2263f7bb2314ef278cc93256ca4122ed8bb42044549bede0f249d935a3bedaac
Instruction ID: 52ae39a020713be75ef5e0acbdb6276ee8cfa9191c1dd9b86a51a65cf1fd6d25
Opcode Fuzzy Hash: 2263f7bb2314ef278cc93256ca4122ed8bb42044549bede0f249d935a3bedaac
Instruction Fuzzy Hash: 18F04C76B083915FE7198E189814B7EF7A5EBC8710F08843AE4069B351CFA1DC41C380

Function 091E1071 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623502449.00000000091E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 091E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_91e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16e77fc51db383e36223c755899fce9c8b82b4c7b1e82cd7b7395d37785536f5
Instruction ID: 9f1b0e9b7b35b58a3ef8f5b62e6a5d529c1e4800246712748dfa36834b39a61d
Opcode Fuzzy Hash: 16e77fc51db383e36223c755899fce9c8b82b4c7b1e82cd7b7395d37785536f5
Instruction Fuzzy Hash: E5F02B33F0C1ACBBD7058AB6D8257AEBBA69BC5714F0DC07AD409D3200E7348D424A82

Function 09396D40 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff72bbfd2998e5090bdfeb880051e47866e33f38403d598e6d52509a23234238
Instruction ID: ff6e6864149fc0b9bfcda4325ef644026f74c179ae88f2f84e003ac5e89cb9bf
Opcode Fuzzy Hash: ff72bbfd2998e5090bdfeb880051e47866e33f38403d598e6d52509a23234238
Instruction Fuzzy Hash: 02014B30E01605AFCF24CFA9D4456DDBBF1EF49714F0482AAD4A9D7651D330A946CF80

Function 09238A83 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4739c06636f73e85b1c9d9478cc984cc661dc4e629a3651c77331538b2e6d6ab
Instruction ID: e8689753e7fd40dc3f596fca1c8b05502e6193acb6c0c7c3817ba765ac014f36
Opcode Fuzzy Hash: 4739c06636f73e85b1c9d9478cc984cc661dc4e629a3651c77331538b2e6d6ab
Instruction Fuzzy Hash: 48F0AF70B11010DFEB14BB38D5597A973EAEF99350B818069E84BD7390CE34ED46CB96

Function 0923BC18 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2669856ff1e840847b43abb8e804c9a9ad9b0de7b211d6afb071563333a87ca9
Instruction ID: fb4201e4adb4fcdbb1278fab1819c3dced14a4d5b12486935a0698150d9e7d89
Opcode Fuzzy Hash: 2669856ff1e840847b43abb8e804c9a9ad9b0de7b211d6afb071563333a87ca9
Instruction Fuzzy Hash: 86F02EA6F1D3914FF3160E646C64379AB62DBC5710F44C8BBD4469F2A5DE86DC42C381

Function 09232F51 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acc9d279a2f6ee563203da6bda952b32f525df3fbab4e1c54466ac99c813be3a
Instruction ID: ac4ac7d003fb350ad0fac3fa10032236108bc9c893b561d017a5f4830426bb7d
Opcode Fuzzy Hash: acc9d279a2f6ee563203da6bda952b32f525df3fbab4e1c54466ac99c813be3a
Instruction Fuzzy Hash: 62016DB1E34726CBEB30DF64CA447A9B775AF04380F82C0A4DA1AA3250D774AD84DB91

Function 091E1080 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623502449.00000000091E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 091E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_91e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5467343fbc3c0ff50e0e29759dff742bcf83f352577b925aa5675e5a543f243b
Instruction ID: 7edba4c128d871be5e0e58c181b43fd503c96760bf90dcf06a4a787a0a40a04c
Opcode Fuzzy Hash: 5467343fbc3c0ff50e0e29759dff742bcf83f352577b925aa5675e5a543f243b
Instruction Fuzzy Hash: D9F08932F0C564B7C714CA7A941566EB7969BC5755F09C07AD819D3100E7748C414A82

Function 093949F0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64ac90fb953464befbbc55c3b114e3bbed282e6d668e3c9bfadc05f3b88b784b
Instruction ID: b5f9ee3048197c2657292371ce0f23f9770e664568ea309313ed709284ccb601
Opcode Fuzzy Hash: 64ac90fb953464befbbc55c3b114e3bbed282e6d668e3c9bfadc05f3b88b784b
Instruction Fuzzy Hash: 82F05E31B001289FDF10DBA8D8587DE77E5EF8D715F400064D105AB760DB34A9068B9A

Function 0923ACC0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81968d0c36ff0d94f26acf75e5db9f7dbb8ab08910fa92a4ccddfecb5327af9d
Instruction ID: 8e93333fe3a1d50077f45f4c37477fa12fddce210acd6513ab98fd77d92eec01
Opcode Fuzzy Hash: 81968d0c36ff0d94f26acf75e5db9f7dbb8ab08910fa92a4ccddfecb5327af9d
Instruction Fuzzy Hash: B0E09B7005F7454FCB1667B0A4521903FBCD743615749C0FBE44ECE663D01A18075755

Function 09232620 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcc8677cc8febb26ab0f6ab0f368ad511b52d4e1bf8c2d24c0b4fa69e6966d22
Instruction ID: 225cbee250c62eb506421f20669a110b5638d8737a6a6a814e97445d03c84557
Opcode Fuzzy Hash: fcc8677cc8febb26ab0f6ab0f368ad511b52d4e1bf8c2d24c0b4fa69e6966d22
Instruction Fuzzy Hash: 01E0122130121867F71865AB6C54B7BA68EEBC5694F15803EA50DDB395CC629C0243E5

Function 09394BB0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7001edb729c7c83f9e382da3e121d018d7e2db8b89e5d717371e27284f5cd698
Instruction ID: aedd461691945991ca212a542c3c453a20d5961ec1151685825fdfa52107c760
Opcode Fuzzy Hash: 7001edb729c7c83f9e382da3e121d018d7e2db8b89e5d717371e27284f5cd698
Instruction Fuzzy Hash: EEF08C71A20645EFCF08AF78D01C7AF77B5EB84205F018878D5258B291EB398A57CF92

Function 091E1332 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623502449.00000000091E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 091E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_91e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7cc270b5cb78596236c8b89920d5983e96a867a473cafc0e3f09f6c24538201
Instruction ID: 1000e7fee2c2dbfbe2df7441af6e872df61c9795ed8df4b5c1908f580c9bec47
Opcode Fuzzy Hash: f7cc270b5cb78596236c8b89920d5983e96a867a473cafc0e3f09f6c24538201
Instruction Fuzzy Hash: B4F04930F0CA65ABDB059BE4C9407BCB7B1AB08798F064464D906AB201DB30EC868A41

Function 0923DF80 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f9a1a6d48cef5e1521f281d0ee7122c3cdd89a1f82dfea4ac0cdb9ed6abb869
Instruction ID: 606534b50d7e302e81d8ec28027a420233d6eb244e86b4c2556ac534739364c6
Opcode Fuzzy Hash: 2f9a1a6d48cef5e1521f281d0ee7122c3cdd89a1f82dfea4ac0cdb9ed6abb869
Instruction Fuzzy Hash: 91F08271E04258AFDB0ACF68D088BECBFB2EB84210F04C599F046E32A5D7740A85CB85

Function 09394BC0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c10955b86e456bc7d4bfad93b1db06b90b343d25cd5ca08a0fc9dc7de31d643
Instruction ID: b90ad69d9500fd9e6f7cc00f5200c802195a673918e0b4b2daad66f8915f0c59
Opcode Fuzzy Hash: 7c10955b86e456bc7d4bfad93b1db06b90b343d25cd5ca08a0fc9dc7de31d643
Instruction Fuzzy Hash: 34F06D30A10249EFCF04AB79C4187AF73B99B84305F008878D5259B251EB399957CF92

Function 09395929 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0ebf1094b172ad3923ae6af3bb3ca40025e7a27df298fc1ee1d8c7e39afe28e
Instruction ID: be10faa1accb9092a925a77404d1353c853fa528592de00e38837663c778072b
Opcode Fuzzy Hash: d0ebf1094b172ad3923ae6af3bb3ca40025e7a27df298fc1ee1d8c7e39afe28e
Instruction Fuzzy Hash: 4AE06831206202ABC7069B68D5087CD7BF2EF81214B050071D004CB520CF384C53C7C1

Function 09236A08 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ad68d3b99434f7d74867aaef1390ce09c7c545a752079dc461a7b898e841b19
Instruction ID: 834b2c1b129bbf00e617595c3059eb5ff949a8002c5fd0b60e87fcc9ea6a973e
Opcode Fuzzy Hash: 8ad68d3b99434f7d74867aaef1390ce09c7c545a752079dc461a7b898e841b19
Instruction Fuzzy Hash: FBD017B2A2120CABCB10DEB4EA054AAB7ACDB09211B1045E9AD0DC3240EA36DE109790

Function 09395938 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9500f4a1ac4aabda10a35ce9594f66ddbb74e017a2b6eca87b912c3761054980
Instruction ID: 4bf8ff3aff222713e455f86dba714aa442fdcb6e93e6da10c7256d5de00d0f53
Opcode Fuzzy Hash: 9500f4a1ac4aabda10a35ce9594f66ddbb74e017a2b6eca87b912c3761054980
Instruction Fuzzy Hash: 77E02B31305204E7D719A76ED608B9E33DBABC0225F054035E1088B650CF789C16C7D1

Function 0923B651 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55e0a40373e62fc2ee41315f88892ff88b8adf92879c6f814bd675f58a76ca7f
Instruction ID: 89b2839769071d14f12f590d7ff99f563addca97ff4858cf34c02f690c51c04a
Opcode Fuzzy Hash: 55e0a40373e62fc2ee41315f88892ff88b8adf92879c6f814bd675f58a76ca7f
Instruction Fuzzy Hash: E6E04F35B04108EFDB55DFB8E5015EE77F5EB98304F1081AAD80AD3250DA315E519B91

Function 093938E0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82d4dc6259d50175b763c6759af723c47042317eda64fc2d53684db53e0b0d3e
Instruction ID: 1be349935d8fe41347791fdb4d1a04b385d0c2dd0425cbe33e7e48cc38cb3181
Opcode Fuzzy Hash: 82d4dc6259d50175b763c6759af723c47042317eda64fc2d53684db53e0b0d3e
Instruction Fuzzy Hash: 01E08C71D0420ADBCF00EA99C60A7AAB3BAEB48321F004071EA1593201DB78652A8F82

Function 0923B6A0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d488145c9769161b4d477f944cfb6a38fdbf1c941294de5f7d2ef4408f84b520
Instruction ID: 1222557100802ef0397a19c20ddb56af3bcd6c8161038beb637bba9344a188a0
Opcode Fuzzy Hash: d488145c9769161b4d477f944cfb6a38fdbf1c941294de5f7d2ef4408f84b520
Instruction Fuzzy Hash: 7BE01274B0120CEFDB04DFB5E9517AD77BAEB45204F509598D90597240DA716F0197C1

Function 093968D0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0de944e019418cd34cb0544836a4e0cc8b1073f982f1ddc07c9b5a7b455c2493
Instruction ID: 0a49c1448fa77ac4728a8c4299f255b6ec24cff3092bbde2d760a9be599e4cfd
Opcode Fuzzy Hash: 0de944e019418cd34cb0544836a4e0cc8b1073f982f1ddc07c9b5a7b455c2493
Instruction Fuzzy Hash: 04E0C234B583D0DEE3078B385012B92BF62AFD2610F09809EE0824B05ADB240982C786

Function 091E8D0A Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623502449.00000000091E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 091E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_91e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e58e02fd261696c20addf440cf16b85bf48d8069b0dd2ce1af8c45a67ca4febb
Instruction ID: 8be57bdf8f50e33ba1dd185cf01523c436e2b44b9074492a1baaa7a9dfa0370c
Opcode Fuzzy Hash: e58e02fd261696c20addf440cf16b85bf48d8069b0dd2ce1af8c45a67ca4febb
Instruction Fuzzy Hash: CAF09278A00618CFD754CF28C584A98BBB1BF4D314F1141E9E80AA7361C730AE81CF00

Function 0923B658 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b066eb1be45817579c76b7ebc2353ca1ad921ba81128982534c71b739ea8203c
Instruction ID: a70155157d9a92185fbb934429d40cacd581db7185cbc285c371822f76b34ae6
Opcode Fuzzy Hash: b066eb1be45817579c76b7ebc2353ca1ad921ba81128982534c71b739ea8203c
Instruction Fuzzy Hash: D0E01275B0410CEFDB00DFA8EA006AD77F9EB54204F104199D809D3340DA716F4197D1

Function 092378CC Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37910842b75db55b02958c8d73a20adee0b85c18ec10f3c3028f2b717a12d3f5
Instruction ID: e6c5fa7c6326e43f6c2630d3c7bd2548a0c973b729c6db908fc090b5e53ad958
Opcode Fuzzy Hash: 37910842b75db55b02958c8d73a20adee0b85c18ec10f3c3028f2b717a12d3f5
Instruction Fuzzy Hash: 60D05EF0B2425ECBDF049A60D986735335E7BD4B89BA4C326D0025B544DE398A42FBC6

Function 09232D08 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3775f3b512eba766fb0a025502e07dcd9616fc2585c14b3b81ccc567865380f
Instruction ID: a31a6fcf11a220adefd23ed4c7c72b5af175e2253dd5cf83bbc5ada7d7c356f4
Opcode Fuzzy Hash: e3775f3b512eba766fb0a025502e07dcd9616fc2585c14b3b81ccc567865380f
Instruction Fuzzy Hash: 3FE08C74E25624CFEB60DF24C880B99B775BF08340F4181E8CA0AA3320C730AD40CF81

Function 09395E52 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da229e165902ce8bdcfa5422437fba62a727c0ff0e089b6f546567ef4cc8bab5
Instruction ID: 3db3a268ca90dad32f0e51959075582c49df1629e9e2e1b34119390da455fd14
Opcode Fuzzy Hash: da229e165902ce8bdcfa5422437fba62a727c0ff0e089b6f546567ef4cc8bab5
Instruction Fuzzy Hash: 57D05E30A1A204CFEB16DF5AE5853AD73ABFBD9362F188074F50285464CB3688D2DE02

Function 09396D18 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca8e725fa186672c3ac442c356e13561df16e73432121a4113c71bf7c2edb8cb
Instruction ID: 057076fc614a460151ce53108cf05a4d8d5973b8cce4c15a66e6a1ad90f0dea4
Opcode Fuzzy Hash: ca8e725fa186672c3ac442c356e13561df16e73432121a4113c71bf7c2edb8cb
Instruction Fuzzy Hash: 38D0127465D1C05FE305DB3085A6640FF619F42208B08C4DED4998B113C626D457D754

Function 0923CB10 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ae0e96512d846170e2cc49395a7ba946ab025c27c6e1384d6b8bde58f53be96
Instruction ID: ff59dbf961a75e9c40e36d6a9627336611ffd0b1358d3ce178a39a1d4cc339e0
Opcode Fuzzy Hash: 4ae0e96512d846170e2cc49395a7ba946ab025c27c6e1384d6b8bde58f53be96
Instruction Fuzzy Hash: 2CC08C306583C50FDB0A8B6188099407E20AB12700B0542CB8084CE0938A6181448B82

Function 09233C5C Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40760e5f33b5a468eda42c276b03d38ac272202d91f1ae61ba3a4e6ac8010f5b
Instruction ID: 59eadec2328f03f1821e2137f9e1b078052ccd85d9e8a90b102be014fd523b85
Opcode Fuzzy Hash: 40760e5f33b5a468eda42c276b03d38ac272202d91f1ae61ba3a4e6ac8010f5b
Instruction Fuzzy Hash: 3ED01234C20228CBCB21CB20CC00B9ABB73AB04302F9080E9C84D63381CB324E85DFA1

Function 092369AF Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e8c416ca2e2eb0127002bb5fba69521195f6040fe587c7cdc0b17b097726e3b
Instruction ID: 5697327a3ac23f0f054cc12dbe78def68474e406601ce3de3b035cbbde80a68e
Opcode Fuzzy Hash: 7e8c416ca2e2eb0127002bb5fba69521195f6040fe587c7cdc0b17b097726e3b
Instruction Fuzzy Hash: D4B0923BA0001986CA10D689E8404DCBB31EA94232F008032C200620008625157A8660

Function 09238FCE Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee02b0d4709f512d5d0435c459864fc740242cba5245487bb5ae150793ddc32c
Instruction ID: c9d187f94cefa399e8fe66cc921dfbabc8dd684fb980befb08696080e2707b70
Opcode Fuzzy Hash: ee02b0d4709f512d5d0435c459864fc740242cba5245487bb5ae150793ddc32c
Instruction Fuzzy Hash: 77C09271916159CBEB04EB20E859B983332BB50310F81C2A0940E671909E785F87CFC1

Function 0923ACF0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad416157b6f5c54490a1fd93021f2c5de50eca94cec5399e91da3e0c1422b616
Instruction ID: 8dac7ebb7989e9f8c067a4e1734509874914f1229be7a854301d1afc0da722c8
Opcode Fuzzy Hash: ad416157b6f5c54490a1fd93021f2c5de50eca94cec5399e91da3e0c1422b616
Instruction Fuzzy Hash: 16900231045E1C8B464027A57C095557B5CF5555257C40051A54F415815A6A78129595

Function 091E1C48 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623502449.00000000091E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 091E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_91e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d50b6f6b3af469c92672bc0a4b7cca09c38c6ce82fe6351b87ecb6396f882431
Instruction ID: 9596f4e3d3afff3564904d3a580480a9fe41b830d68e4446d4879e3cb4c9af73
Opcode Fuzzy Hash: d50b6f6b3af469c92672bc0a4b7cca09c38c6ce82fe6351b87ecb6396f882431
Instruction Fuzzy Hash: 3EB01234B0C0848FD7054640C00C7AC7621AB88320F0940218C0733788467C8C81C952

Non-executed Functions

Function 0937E508 Relevance: .5, Instructions: 456COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623795935.0000000009370000.00000040.00000800.00020000.00000000.sdmp, Offset: 09370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9370000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20e5307f6aa031048f7bf2824bd03c49a8201ab6e11d71673d7d37431dbba57e
Instruction ID: 4133c6a98f2a75829ef7b79a5b70e10517a3c909efa13196d809bec2e976d225
Opcode Fuzzy Hash: 20e5307f6aa031048f7bf2824bd03c49a8201ab6e11d71673d7d37431dbba57e
Instruction Fuzzy Hash: 57023775B0031A9FDB69DFA9C4A467EFBF2BB88300F248529D55697350CB38A941CB81

Function 0923F0B0 Relevance: .4, Instructions: 367COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 022627774f2d2244272825a5346308afb08ae0d212ab80ae1f4475c6eb30bbd0
Instruction ID: 116232a35cc07c1cf5934ce79254bcafb4d2d0cca12874eacd9fd917c087ef83
Opcode Fuzzy Hash: 022627774f2d2244272825a5346308afb08ae0d212ab80ae1f4475c6eb30bbd0
Instruction Fuzzy Hash: 03E15D74A10205CFEB14CF69D684AAEB7F2BF88310FA5C499E9059B361DB30EC45CB50

Function 09392B10 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4261669ae0ed4acd921fe577cd7e4703b80a36dae40f1dbaba49fa662dcfdef8
Instruction ID: 7524d2cfd64d0f979a54beae98a18f7ba70ab826b9e0e1c91ece3a722eb4cacf
Opcode Fuzzy Hash: 4261669ae0ed4acd921fe577cd7e4703b80a36dae40f1dbaba49fa662dcfdef8
Instruction Fuzzy Hash: 28B17C70E10609DFDF10CFA9D8857AEBBF2AF88704F148529E825E7294EB749841CF91

Function 09397BF6 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 336d8766dfacffaf60c33662f68b8c3dfd4a38759242527c3cdc61aa4ab4d1ba
Instruction ID: 8ec5fcae19cd59f66b4c8312fde37d0448bd58b166f7e20728b9ded2521b2bd1
Opcode Fuzzy Hash: 336d8766dfacffaf60c33662f68b8c3dfd4a38759242527c3cdc61aa4ab4d1ba
Instruction Fuzzy Hash: DBB13634A20100DFDB18CF68D599BAA77F3FB89314F2580A4E5069B7A5C779AD86CF40

Function 092320C3 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca6142ed545b4c0189be03e42c5eff9bd9d6ae57df9f8107dfbca775793c42e6
Instruction ID: 1987bae3e29e957f615505245ab96c2c9bac3b1cd247b804848982a63370cb67
Opcode Fuzzy Hash: ca6142ed545b4c0189be03e42c5eff9bd9d6ae57df9f8107dfbca775793c42e6
Instruction Fuzzy Hash: 738148B0A00248DFDB48CFA8D599BAD77F2FB48304F508569D516DB352DB78A94ACF04

Function 093939A1 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fec01297f8cd5fbefc9736c41ffaf70aa56507517f43d8d7450ac3db4328f58
Instruction ID: e001eb7eb4c79cbfbdb82da6eb89229d09b795cff1912367fc6d73a896673cf4
Opcode Fuzzy Hash: 2fec01297f8cd5fbefc9736c41ffaf70aa56507517f43d8d7450ac3db4328f58
Instruction Fuzzy Hash: 0261ADB1A10144DFDB18CF69C585BAA77F3FB88340F248079E0069B6A4DB799D86CF46

Function 093939B0 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623840647.0000000009390000.00000040.00000800.00020000.00000000.sdmp, Offset: 09390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9390000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f00a97df6ba523069d041d157b8be49679ade219901828bda71294b0b2d31798
Instruction ID: 7bce9fac8852aa7678c7e84687a57a7bd81af5142a1d9216d8185548e6c1ccfe
Opcode Fuzzy Hash: f00a97df6ba523069d041d157b8be49679ade219901828bda71294b0b2d31798
Instruction Fuzzy Hash: 4361BBB1A10144CFDB18CF69C585BAA77F3FB88340F2480B9E0069B694DB799D86CF42

Function 09232024 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96595c514fb2186ad0252547f2a5c0287ce4efeec845dd1c21670f78df03f9d8
Instruction ID: 29fe8a6fcc8ac54a70ea3103f74eb0d0338da0a8697c639e92c3b9bd9d32ca57
Opcode Fuzzy Hash: 96595c514fb2186ad0252547f2a5c0287ce4efeec845dd1c21670f78df03f9d8
Instruction Fuzzy Hash: 698147B0A00248DFCB48CFB8D599BAD77F1FB58304F508569D5169B392DB78A94ACF04

Function 09232141 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6748502c77befdfe001df56e2760a4d2698c00e355e1a54410bfa9e748c143ab
Instruction ID: 7572f1fda6dae2e2acae6d5f8c59487a90cc69278662881812036e1e18def179
Opcode Fuzzy Hash: 6748502c77befdfe001df56e2760a4d2698c00e355e1a54410bfa9e748c143ab
Instruction Fuzzy Hash: A07159B0A00248DFDB48CFB8D599BAD77F1FB48304F508569D5169B352CB78A94ACF05

Function 09231FDF Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d791ecc8d31481f143724d2966a9445ec52128e60e93520cdc81059a24828734
Instruction ID: fdaa6ab780051aea8c13672b25abc9b102fadb031a982ddfb18becca4b5f5697
Opcode Fuzzy Hash: d791ecc8d31481f143724d2966a9445ec52128e60e93520cdc81059a24828734
Instruction Fuzzy Hash: 507178B0A00248DFDB48CFA8D599B9D7BF2FF49304F408569D516AB352CB78A94ACF05

Function 09231C10 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f48a0ea35eb8f377eb9f1c50cca7e036e557419d5a80a456f57596ae04405b
Instruction ID: f1d5c79d341f7320908a36e58314faf5d2babbca9fef881a4879eef658492d92
Opcode Fuzzy Hash: d8f48a0ea35eb8f377eb9f1c50cca7e036e557419d5a80a456f57596ae04405b
Instruction Fuzzy Hash: 54618AB0A00248DFDB48CFB8D199B9D7BF1FB48304F508569D5169B342CB78A94ACF05

Function 04C944A3 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621966155.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ed38b60518575a948a36647dc0525dcd3d7195bb4e3d23f5e63e536684ad655
Instruction ID: 84932cdbd524ff92fd27dcbb1b4aba57bcbc678f6888065d472e8f782c2dd756
Opcode Fuzzy Hash: 9ed38b60518575a948a36647dc0525dcd3d7195bb4e3d23f5e63e536684ad655
Instruction Fuzzy Hash: CC514A75A05684CFE708DFAAE95169ABBE3FBC8704F04C239C8059B264EF785907CB51

Function 04C944B0 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2621966155.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c90000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 612be9e806712255bf7d4ef02219519aabe9cba81471bcd288eacab92955dbb3
Instruction ID: b81347531756bf92047954cb8b2dff05bcac14fa0153540d5f229323e4f27bef
Opcode Fuzzy Hash: 612be9e806712255bf7d4ef02219519aabe9cba81471bcd288eacab92955dbb3
Instruction Fuzzy Hash: AF513975A05684CFE708DFAAE95169ABBE3FBD8600F04C239C4059B264EF785907CB51

Function 09232099 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2623649289.0000000009230000.00000040.00000800.00020000.00000000.sdmp, Offset: 09230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9230000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60e8ec978a929d969277f49fa01c0001f17a863eb69fd128b703d3c7c5261651
Instruction ID: d652caff71fe0d17ac749099828f808f4b0a16ec48e0d962415b442ff71dbc16
Opcode Fuzzy Hash: 60e8ec978a929d969277f49fa01c0001f17a863eb69fd128b703d3c7c5261651
Instruction Fuzzy Hash: 4A6157B0A00248DFDB48CFA8D199BAD7BF2FB48304F508569D5169B352CB7CA94ACF05

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report MicrosoftWORD.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\Favorites\components\assets\Chrominum_A.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
MicrosoftWORD.exe

Function 0937FAD8 Relevance: 1.7, APIs: 1, Instructions: 160
COMMON

Function 0937FB0A Relevance: 1.7, APIs: 1, Instructions: 159
COMMON

Function 0937FB40 Relevance: 1.6, APIs: 1, Instructions: 143
COMMON

Function 04C9CA18 Relevance: 1.6, APIs: 1, Instructions: 56
memoryCOMMON