Edit tour

Windows Analysis Report
PDFONLINE.exe

Overview

General Information

Sample name:	PDFONLINE.exe
Analysis ID:	1587451
MD5:	8268f8ad872d9ca06152019676fbe0bf
SHA1:	4ad8baab93a10ced110b768a4c4cfa054262293e
SHA256:	423612aa03d476e3a3d7b21d7daf3fae2a9a5d7b6c2097961ca2df5e38958e79
Tags:	exeuser-zhuzhu0009
Infos:

Detection

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Allocates memory in foreign processes

Drops large PE files

Injects a PE file into a foreign processes

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Writes to foreign memory regions

Yara detected Costura Assembly Loader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

PDFONLINE.exe (PID: 7416 cmdline: "C:\Users\user\Desktop\PDFONLINE.exe" MD5: 8268F8AD872D9CA06152019676FBE0BF)

csc.exe (PID: 7644 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.2619681545.000000000A070000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000003.00000002.2619242179.0000000008AA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000003.00000002.2618808786.0000000007901000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: csc.exe PID: 7644	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.csc.exe.a070000.3.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
3.2.csc.exe.8b26728.1.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\Favorites\StormyFierce\Bin\Enchanted.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\PDFONLINE.exe, ProcessId: 7416, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StormyFierce

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: PDFONLINE.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: PDFONLINE.exe	Virustotal: Detection: 63%			Perma Link
Source: PDFONLINE.exe	ReversingLabs: Detection: 65%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: PDFONLINE.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source:	Binary string: Dsicg.pdb source: csc.exe, 00000003.00000002.2619506837.0000000009F40000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1791689761.0000000008B9C000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1791689761.0000000008D7E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: csc.exe, 00000003.00000003.1791689761.0000000008EB5000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.2619748451.000000000A0D0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1791689761.0000000008D7E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: csc.exe, 00000003.00000003.1791689761.0000000008EB5000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.2619748451.000000000A0D0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1791689761.0000000008D7E000.00000004.00000800.00020000.00000000.sdmp

Source: global traffic

TCP traffic: 192.168.2.9:49864 -> 181.71.216.203:30203

Source: global traffic

TCP traffic: 192.168.2.9:60925 -> 162.159.36.2:53

Source: Joe Sandbox View

IP Address: 181.71.216.203 181.71.216.203

Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: newstaticfreepoint24.ddns-ip.net
Source: global traffic	DNS traffic detected: DNS query: 171.39.242.20.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: 53.210.109.20.in-addr.arpa

Source: csc.exe, 00000003.00000002.2618808786.0000000007901000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.2618808786.0000000007B59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: csc.exe, 00000003.00000003.1791689761.0000000008EB5000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.2619748451.000000000A0D0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1791689761.0000000008D7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: csc.exe, 00000003.00000003.1791689761.0000000008EB5000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.2619748451.000000000A0D0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1791689761.0000000008D7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: csc.exe, 00000003.00000003.1791689761.0000000008EB5000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.2619748451.000000000A0D0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1791689761.0000000008D7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: csc.exe, 00000003.00000003.1791689761.0000000008EB5000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.2619748451.000000000A0D0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1791689761.0000000008D7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: csc.exe, 00000003.00000003.1791689761.0000000008EB5000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.2618808786.0000000007901000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.2619748451.000000000A0D0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1791689761.0000000008D7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: csc.exe, 00000003.00000003.1791689761.0000000008EB5000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.2619748451.000000000A0D0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1791689761.0000000008D7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

Source: PDFONLINE.exe

Binary or memory string: GetRawInputData

System Summary

Drops large PE files

Source: C:\Users\user\Desktop\PDFONLINE.exe

File dump: Enchanted.exe.0.dr 959567731

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05AE3C88	3_2_05AE3C88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05AE3C7C	3_2_05AE3C7C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_076D0990	3_2_076D0990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_076DF078	3_2_076DF078
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_076D24F8	3_2_076D24F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_076DDAB2	3_2_076DDAB2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_076DF008	3_2_076DF008
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_076E0F08	3_2_076E0F08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_076E55E0	3_2_076E55E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_076ED28F	3_2_076ED28F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_076E0F43	3_2_076E0F43
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_076E570C	3_2_076E570C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_076E0FB4	3_2_076E0FB4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_076E0EF7	3_2_076E0EF7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_076ED5C7	3_2_076ED5C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_076E55D1	3_2_076E55D1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_076E1474	3_2_076E1474
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_076EE338	3_2_076EE338
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_076E4BE8	3_2_076E4BE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_076E13FF	3_2_076E13FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_076E4BD9	3_2_076E4BD9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_076E138C	3_2_076E138C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_076E123C	3_2_076E123C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_076E12C2	3_2_076E12C2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_076E10C0	3_2_076E10C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_0A704148	3_2_0A704148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_0A7027F8	3_2_0A7027F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_0A701BE0	3_2_0A701BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_0A706FA0	3_2_0A706FA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_0A7042E7	3_2_0A7042E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_0A70413B	3_2_0A70413B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_0A701F28	3_2_0A701F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_0A7073F2	3_2_0A7073F2

Source: PDFONLINE.exe, 00000000.00000002.1590828318.0000000000FFC000.00000040.00001000.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameTwseeloebf.exe" vs PDFONLINE.exe

Source: PDFONLINE.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: classification engine

Classification label: mal84.evad.winEXE@3/1@4/1

Source: C:\Users\user\Desktop\PDFONLINE.exe

File created: C:\Users\user\Favorites\StormyFierce

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Mutant created: \Sessions\1\BaseNamedObjects\mono1234

Source: PDFONLINE.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\PDFONLINE.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PDFONLINE.exe	Virustotal: Detection: 63%
Source: PDFONLINE.exe	ReversingLabs: Detection: 65%

Source: PDFONLINE.exe	String found in binary or memory: Transmit Start/Stop
Source: PDFONLINE.exe	String found in binary or memory: Transmit Start/Stop
Source: PDFONLINE.exe	String found in binary or memory: Application Launch Contacts/Addressbook

Source: C:\Users\user\Desktop\PDFONLINE.exe

File read: C:\Users\user\Desktop\PDFONLINE.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PDFONLINE.exe "C:\Users\user\Desktop\PDFONLINE.exe"
Source: C:\Users\user\Desktop\PDFONLINE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Source: C:\Users\user\Desktop\PDFONLINE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PDFONLINE.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDFONLINE.exe	Section loaded: crowdstrikeceoisextragay.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDFONLINE.exe	Section loaded: sentinelisabadedrtrynexttimemaybe.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDFONLINE.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PDFONLINE.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: PDFONLINE.exe

Static file information: File size 4623872 > 1048576

Source: PDFONLINE.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x3c9000

Source:	Binary string: Dsicg.pdb source: csc.exe, 00000003.00000002.2619506837.0000000009F40000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1791689761.0000000008B9C000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000003.1791689761.0000000008D7E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: csc.exe, 00000003.00000003.1791689761.0000000008EB5000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.2619748451.000000000A0D0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1791689761.0000000008D7E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: csc.exe, 00000003.00000003.1791689761.0000000008EB5000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.2619748451.000000000A0D0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1791689761.0000000008D7E000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Yara detected Costura Assembly Loader

Source: Yara match	File source: 3.2.csc.exe.a070000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.csc.exe.8b26728.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2619681545.000000000A070000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2619242179.0000000008AA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2618808786.0000000007901000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: csc.exe PID: 7644, type: MEMORYSTR

Source: C:\Users\user\Desktop\PDFONLINE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Source: C:\Users\user\Desktop\PDFONLINE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"			Jump to behavior

Source: PDFONLINE.exe

Static PE information: real checksum: 0xe0dfb should be: 0x46b46e

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05AE4069 push 0005DA91h; retf	3_2_05AE4075
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05AE6D28 pushfd ; ret	3_2_05AE6D29
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_076956F0 push E8076426h; iretd	3_2_076956F5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_0769742F pushad ; retf	3_2_07697437
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_076DCA70 pushad ; iretd	3_2_076DCA71
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_076E9EBF push eax; retf	3_2_076E9ECD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_076E9509 push es; retf	3_2_076E9517
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_076E4BA0 push 5D6A93D1h; ret	3_2_076E4BB9

Source: C:\Users\user\Desktop\PDFONLINE.exe

File created: C:\Users\user\Favorites\StormyFierce\Bin\Enchanted.exe

Jump to dropped file

Source: C:\Users\user\Desktop\PDFONLINE.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run StormyFierce			Jump to behavior
Source: C:\Users\user\Desktop\PDFONLINE.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run StormyFierce			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 5AE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 7900000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 7560000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Window / User API: threadDelayed 4101			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Window / User API: threadDelayed 5728			Jump to behavior

Source: C:\Users\user\Desktop\PDFONLINE.exe

Dropped PE file which has not been started: C:\Users\user\Favorites\StormyFierce\Bin\Enchanted.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -29514790517935264s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -59875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7712	Thread sleep count: 4101 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7712	Thread sleep count: 5728 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -59766s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -59656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -59547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -59437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -59309s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -59203s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -59094s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -58981s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -58875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -58765s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -58656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -58544s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -58437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -58282s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -58109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -57656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -57422s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -57312s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -57203s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -57094s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -56984s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -56875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -56766s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -56656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -56547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -56431s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -56327s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -56183s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -56074s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -55969s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -55844s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -55734s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -55625s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -55516s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -55402s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -55297s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -55180s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -54992s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -54734s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -54497s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -54390s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -54281s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -54171s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -54062s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -53953s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -53844s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -53712s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -53609s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -53500s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -53391s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -53281s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -53172s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7708	Thread sleep time: -53062s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59309	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 59094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58981	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58544	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58282	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 58109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 57656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 57422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 57312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 57203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 57094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56431	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56327	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56183	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 56074	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55402	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 55180	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54992	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54497	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54171	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 54062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 53953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 53844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 53712	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 53609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 53500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 53391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 53281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 53172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Thread delayed: delay time: 53062	Jump to behavior

Source: csc.exe, 00000003.00000002.2619974672.000000000A380000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Code function: 3_2_076DF388 LdrInitializeThunk,

3_2_076DF388

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\PDFONLINE.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\PDFONLINE.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 52B0000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\PDFONLINE.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 52B0000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\PDFONLINE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 52B0000			Jump to behavior
Source: C:\Users\user\Desktop\PDFONLINE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 54ED008			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe VolumeInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: csc.exe, 00000003.00000002.2617676467.0000000005909000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	131 Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	31 Process Injection	1 Masquerading	11 Input Capture	131 Security Software Discovery	Remote Services	11 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	11 Disable or Modify Tools	LSASS Memory	141 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	141 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	31 Process Injection	NTDS	123 System Information Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PDFONLINE.exe	64%	Virustotal		Browse
PDFONLINE.exe	66%	ReversingLabs	Win32.Trojan.Leonem
PDFONLINE.exe	100%	Avira	HEUR/AGEN.1356008

Name	IP	Active	Malicious	Reputation
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
newstaticfreepoint24.ddns-ip.net	181.71.216.203	true	false	high
53.210.109.20.in-addr.arpa	unknown	unknown	false	unknown
171.39.242.20.in-addr.arpa	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://github.com/mgravell/protobuf-net	csc.exe, 00000003.00000003.1791689761.0000000008EB5000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.2619748451.000000000A0D0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1791689761.0000000008D7E000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/mgravell/protobuf-neti	csc.exe, 00000003.00000003.1791689761.0000000008EB5000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.2619748451.000000000A0D0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1791689761.0000000008D7E000.00000004.00000800.00020000.00000000.sdmp	false	high
https://stackoverflow.com/q/14436606/23354	csc.exe, 00000003.00000003.1791689761.0000000008EB5000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.2618808786.0000000007901000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.2619748451.000000000A0D0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1791689761.0000000008D7E000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/mgravell/protobuf-netJ	csc.exe, 00000003.00000003.1791689761.0000000008EB5000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.2619748451.000000000A0D0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1791689761.0000000008D7E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	csc.exe, 00000003.00000002.2618808786.0000000007901000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.2618808786.0000000007B59000.00000004.00000800.00020000.00000000.sdmp	false	high
https://stackoverflow.com/q/11564914/23354;	csc.exe, 00000003.00000003.1791689761.0000000008EB5000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.2619748451.000000000A0D0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1791689761.0000000008D7E000.00000004.00000800.00020000.00000000.sdmp	false	high
https://stackoverflow.com/q/2152978/23354	csc.exe, 00000003.00000003.1791689761.0000000008EB5000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000003.00000002.2619748451.000000000A0D0000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000003.00000003.1791689761.0000000008D7E000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
181.71.216.203	newstaticfreepoint24.ddns-ip.net	Colombia		27831	ColombiaMovilCO	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587451
Start date and time:	2025-01-10 11:53:36 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PDFONLINE.exe
Detection:	MAL
Classification:	mal84.evad.winEXE@3/1@4/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 79% Number of executed functions: 152 Number of non-executed functions: 6
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 172.202.163.200, 20.242.39.171, 20.109.210.53, 52.149.20.212
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target PDFONLINE.exe, PID 7416 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtProtectVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:54:51	API Interceptor	1311561x Sleep call for process: csc.exe modified
10:54:57	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run StormyFierce C:\Users\user\Favorites\StormyFierce\Bin\Enchanted.exe
10:55:06	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run StormyFierce C:\Users\user\Favorites\StormyFierce\Bin\Enchanted.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
181.71.216.203	ReaderPDFadobe.exe	Get hash	malicious	Unknown	Browse
	MicrosoftWORD.exe	Get hash	malicious	Unknown	Browse
	MicrosoftOfficeWord.exe	Get hash	malicious	Unknown	Browse
	AdobePDF.exe	Get hash	malicious	Unknown	Browse
	AdobeReaderPDFonline.exe	Get hash	malicious	Unknown	Browse
	MicrosoftWORD.exe	Get hash	malicious	Unknown	Browse
	PDFonlineseguro.exe	Get hash	malicious	Unknown	Browse
	MicrosoftOfficeWord.exe	Get hash	malicious	Unknown	Browse
	AdobePDF.exe	Get hash	malicious	Unknown	Browse
	AdobeReaderPDFonline.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	Quarantined Messages(3).zip	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	PortugalForum_nopump.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	filename.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	https://form.fillout.com/t/emEtLm993dus	Get hash	malicious	Unknown	Browse	13.107.246.45
	Invoice_R6GPN23V_TransactionSuccess.html.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://email.analystratings.net/ls/click?upn=u001.WeKo-2BCuHku2kJmVIsYmGxteRO-2BqdkFdZns7E8OZ0trgZRhaAY0f4dRd5bGXo8w1-2B5SPZj6mt6bkINmYNA1f4blf-2F2qp6pSrdQgqdtKPVZlFfsGiBd9L9S-2BVNmfUTaZ-2Bp0zWbjdQ23pm6OHkVsvPYDi1myQ0pU4BHbfSebmhjQAIDDVMgAvG7Znw7Pr8RLFA8HEKUDF6j4JiiZ3slfATgGRu3-2BdlWbffHNdZW8UBc7QW6Nxd08b90zhz6-2FhInZrSp1J-2Fh9yU6gsolKI10c6pp1uA-2FrYRI2h9aMn65O5NvFrP-2Fc-2BjlCyvznYBIXNfkBGEguSmRbREbgogGbx0CjJc9kfZpcF-2F4T3W7floa7RxJ5-2BKjbFDYD7FnGxTCmOAt-2BDLn5J0y5KvJMT3qFWKyQo5DJ5ru0B7ksJyMiI6L18xz5XP2GRtxbC7dwfszL4xopys7uMk6wzOFXTrTU9jYi2ZvQxqCtOzUddy1WGVe8msfQF8x3k3Ejw4p6mGzrKR8wOZXnO3uVw5n8j0tNkc31-2F1y7FsWAGygTmAHNV4DJiUXG3-2Foq61jCXRLG1PMMCZ97ToDeMjE9XjfX-2Bb4NXrzqR3tgw-3D-3DwyWG_tUVFAbhJxF44ufbifaYzyYApcQooCC4WsuZoiwe419Oh5WFVYobMs1ROnIPWGGcLQ6-2Bsxhj60Ehn0XDEyVD6MCEZ1gioYU2lwgwkCuP2dHRX-2FYdZnQ31dEdwKW37GtXYj9HmZ1F0YrZWwSELmaO5K7noqwYAhu2QGcGqOtQYdjShoJMVTWOe6BTzZXQxib8Y6rd4SX-2BUwZMt-2BbgPIpal6PcS8i4PCSiFy8RF-2Ftt22Wpj713n23BIU6an4375YDP3	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://email.analystratings.net/ls/click?upn=u001.WeKo-2BCuHku2kJmVIsYmGxteRO-2BqdkFdZns7E8OZ0trgZRhaAY0f4dRd5bGXo8w1-2B5SPZj6mt6bkINmYNA1f4blf-2F2qp6pSrdQgqdtKPVZlFfsGiBd9L9S-2BVNmfUTaZ-2BpuOeo6wXhYyQnN5Dmhl9EwD4jJy2QucAxD5PJ8TFaAtq5-2Fa2JLywFyD22uAsFmhYjQLp65IuicFXReMolU22hvgQ-2B1S2bacC3gnzhuRxI8SAkOsPFFxOcYEiSSZTqVyp3m1OxPmLRrTi1o5-2FZom3YCyV1EUto77Rrvablg0dLCkGGW0ncnt-2B7IgK6LBBZRD7ITvGmpDjZtTYsz0I1qKiLzZdNfmubxarfJC5-2BcEqOw-2Ft-2FbdrugnVMUWHAHioUxjwvqr4QWKZSVt-2BeoNRvP2Adsk-2FRWXyTy-2FNsOG5tm8W5iiSHTNAe6b2ve-2F-2FMif4OPRLC2jk2zIHDBodMQqimJe7S-2B0c0a6VcurrTf-2BSSIJw1siTQylKaBjy96o6v7aWNACMPOJmDH5ybp8Hfg60OUEGx1ZLebRMpxX9k9AP7u40PlQ7YN0etELZUsiTbXY4PcX2P96RfnnTH8k4gdprbyM68BwIDNXqkSpWupXgXawXvLifC6eFYgMzHs5EFbgb5u6HEHo2__tUVFAbhJxF44ufbifaYzyYApcQooCC4WsuZoiwe419Oh5WFVYobMs1ROnIPWGGcL7zwYzcSR3guHWoKhXDu5EQ7SXJZpci4hCmpp1REa7W1YXEAS6JqnE9LrlFK998LZ271LMIRubQetxBOsHxh3FfsHQej0U45DqU0JnGYKUA9waD6Ny-2BL9vchurlVMDvBupSQHaqHAKs87lmzkMbvNLGI-2BMPx7o1UJrTBuhk-2BVx-2FdFVsZL4Uf2HUcBJTS73hyi	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://email.analystratings.net/ls/click?upn=u001.WeKo-2BCuHku2kJmVIsYmGxteRO-2BqdkFdZns7E8OZ0trgZRhaAY0f4dRd5bGXo8w1-2B5SPZj6mt6bkINmYNA1f4blf-2F2qp6pSrdQgqdtKPVZlFfsGiBd9L9S-2BVNmfUTaZ-2Bp0zWbjdQ23pm6OHkVsvPYDi1myQ0pU4BHbfSebmhjQAIDDVMgAvG7Znw7Pr8RLFA8HEKUDF6j4JiiZ3slfATgGRu3-2BdlWbffHNdZW8UBc7QW6Nxd08b90zhz6-2FhInZrSp1J-2Fh9yU6gsolKI10c6pp1uA-2FrYRI2h9aMn65O5NvFrP-2Fc-2BjlCyvznYBIXNfkBGEguSmRbREbgogGbx0CjJc9kfZpcF-2F4T3W7floa7RxJ5-2BKjbFDYD7FnGxTCmOAt-2BDLn5J0y5KvJMT3qFWKyQo5DJ5ru0B7ksJyMiI6L18xz5XP2GRtxbC7dwfszL4xopys7uMk6wzOFXTrTU9jYi2ZvQxqCtOzUddy1WGVe8msfQF8x3k3Ejw4p6mGzrKR8wOZXnO3uVw5n8j0tNkc31-2F1y7FsWAGygTmAHNV4DJiUXG3-2Foq61jCXRLG1PMMCZ97ToDeMjE9XjfX-2Bb4NXrzqR3tgw-3D-3DrgFz_tUVFAbhJxF44ufbifaYzyYApcQooCC4WsuZoiwe419Oh5WFVYobMs1ROnIPWGGcLui8UPBZcrEcBQ64UpH2s9-2FDpSu9qfcgYFRQKTYsD5OOP7p7kgdevUOf60UO0BtzRorOOVdIMlEbf0g38VGeCmtkP8At2J-2BxKEtoZ2O48KqLdUMGUmxH4Esb-2BPRc25uZJoq4Qo0YWw9j31285luIdhLwnz-2B9RfofSABy36tB5aPmDcVeLn5C5N5AJkqjfepa6	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://email.analystratings.net/ls/click?upn=u001.WeKo-2BCuHku2kJmVIsYmGxteRO-2BqdkFdZns7E8OZ0trgBe3vvPhUi3NCctiT7ICCnQ-2FY8o5rhg4URlGJ-2FvsNaBLrMZH2YOUKWM-2BCE-2FXqUBn4SuSDNO43ZHONlcfV0u69WPaY48i3uh3m8lqIzkUcMcKGiml1g6PtP2N9Fq73ADmecSkBDQ1wDesGGu-2Bg3LC1PY31AnFBjTo5itfBoUzfV1y-2FNuV7ub4JBfgFfFwbfDCVw04z2QHPGmvaTuYBRiOw1Tpn5jhya1bpe-2FZKFIvw6DpoIa015fiQnAkr21qCIGDz3kcWaHiPPoAcEbgrIJQtXRwdHoKOAHjnLbHeTfYxioE2jQ-2BKzgO6L-2FLiLt79tmJXX2KYx8D6DTv7nI91sFKT8dXMJM0DazaslrneD4lIUneNyaGARqqUVvrSB7-2BzgxAL-2FuXFyd1qjf-2FnnaV5h661BgCBEWKyZBkPjSGhvc635VlrPtfR5g3T0pDVRqQ8o-2Fg4-3DfYwI_tUVFAbhJxF44ufbifaYzyYApcQooCC4WsuZoiwe419PER4av1iPHZIu7rMCH4g59O-2FpVm-2BPXLGfx0fQIDbM830SEyalx7CL7LS5G2wzbNPhsJ2FagkVeT-2FvL4PXhjlJE5YFKw59He2Ja9QVSEHwhUEJm-2BBDxFee6A4QFWAIxMlxI8kis-2B4bFFLDszJAKx313jD-2F4FRd82vUXuacU2lSKZ4Ah2gmv6sbaeoxYrNwq4bbw0e0DJ7EzH1nxfqSXJpTz	Get hash	malicious	Unknown	Browse	13.107.246.45
	http://api.myuhchvision.com/	Get hash	malicious	Unknown	Browse	13.107.246.45
newstaticfreepoint24.ddns-ip.net	ReaderPDFadobe.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	MicrosoftWORD.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	MicrosoftOfficeWord.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	AdobePDF.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	AdobeReaderPDFonline.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	MicrosoftWORD.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	PDFonlineseguro.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	MicrosoftOfficeWord.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	AdobePDF.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	AdobeReaderPDFonline.exe	Get hash	malicious	Unknown	Browse	181.71.216.203

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ColombiaMovilCO	ReaderPDFadobe.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	MicrosoftWORD.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	MicrosoftOfficeWord.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	AdobePDF.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	AdobeReaderPDFonline.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	MicrosoftWORD.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	PDFonlineseguro.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	MicrosoftOfficeWord.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	AdobePDF.exe	Get hash	malicious	Unknown	Browse	181.71.216.203
	AdobeReaderPDFonline.exe	Get hash	malicious	Unknown	Browse	181.71.216.203

Process:	C:\Users\user\Desktop\PDFONLINE.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	959567731
Entropy (8bit):	0.0652813896429866
Encrypted:	false
SSDEEP:
MD5:	F56CC7221C1047EE75D1F3B5564C2532
SHA1:	1DF2E795FEA113FAA56489893F1F0759E3C60282
SHA-256:	597AC5A2438E6E81D6605055FC4264689BFBFABC684322571C3B8980C26F4410
SHA-512:	F3A197684EA2E7FD74BDAE825A0F6EDAE3D23E893BA066FBDEEB8B44CE7C833A1F9FB9221C08EAB2A89A85E58EB6C02CA2C7FE2800CA538D4776EB904C326044
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...9Y J...............8......F..v................@..........................0Q............... ..............................p...".......<.............@............................................................................................text...............................`.P`.data...l...........................@.`..rdata..@...........................@.`@.bss.....t............................@..idata..."...p...$..................@.0..rsrc....<.......<.................@.0.................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.298308694296775
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00%
File name:	PDFONLINE.exe
File size:	4'623'872 bytes
MD5:	8268f8ad872d9ca06152019676fbe0bf
SHA1:	4ad8baab93a10ced110b768a4c4cfa054262293e
SHA256:	423612aa03d476e3a3d7b21d7daf3fae2a9a5d7b6c2097961ca2df5e38958e79
SHA512:	6f61224c28cd91735dafd8e24a65497c3cfef2c42742318defc5f1cf1f596128c43dc903741b0aa595fd660c06bb8f899afdc67c56b1cfc88a97b615e9b3a546
SSDEEP:	49152:B02lJK8pPNTM7Pn8keVBA8gDzh1WCrkpVgrZk1eDPPzxRjRz:/tRM7cBezWskp2rO1eD9RjRz
TLSH:	552639B5D443CC06D86B09BFE02AE8FC51163EB5E01BA53B6689FE1F727329110D8997
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...9Y J...............8......F..v................@..........................0Q............... ............................

File Icon


Icon Hash:	0316165c38300009

Static PE Info

General

Entrypoint:	0x4012a0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:
Time Stamp:	0x4A205939 [Fri May 29 21:52:57 2009 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f539b8cfd7163416a01a457780573bcc

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 08h
mov dword ptr [esp], 00000002h
inc eax
inc ebx
call 00007F2B20BE4181h
cwde

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x147000	0x22a8	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x14a000	0x3c8ed8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xd9c00	0xd40	.bss
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2fba4	0x2fc00	f3a19dd5351a46ffd4a68fd24142272c	False	0.5039164757853403	data	6.419425852354698	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x31000	0x1be6c	0x1c000	2573c1642aa463c4bc52f58b5f546e74	False	0.23196847098214285	data	3.5614541661296633	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x4d000	0x51840	0x51a00	88526616148575c822f3e50ea377b0a0	False	0.35188253732771824	data	5.692765508385372	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x9f000	0xa7498	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x147000	0x22a8	0x2400	4fade12cc973756fc00928df13bc15b5	False	0.3541666666666667	data	5.3115523582028406	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x14a000	0x3c8ed8	0x3c9000	d0a75d3fa91d5dc4368cb201edca1889	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x14a900	0x25ac	data			0.24865201161343842
RT_CURSOR	0x14ceac	0x2ec	data			0.5133689839572193
RT_BITMAP	0x14d198	0x4a6c	PC bitmap, Windows 3.x format, 3157 x 2 x 39, image size 19635, cbSize 19052, bits offset 54			0.9246798236405627
RT_BITMAP	0x151c04	0x23f28	Device independent bitmap graphic, 920 x 40 x 32, image size 147200, resolution 3503 x 3503 px/m			0.22595082857919044
RT_BITMAP	0x175b2c	0x19f98	Device independent bitmap graphic, 782 x 34 x 32, image size 106352, resolution 3543 x 3543 px/m			0.17136626814046169
RT_BITMAP	0x18fac4	0x84800	PC bitmap, Windows 3.x format, 67983 x 2 x 38, image size 542879, cbSize 542720, bits offset 54			0.9938955630896227
RT_BITMAP	0x2142c4	0x3106e	Device independent bitmap graphic, 571 x 117 x 24, image size 200774, resolution 2834 x 2834 px/m	English	United States	0.10916569561883135
RT_ICON	0x245334	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584			0.10497752277298
RT_ICON	0x255b5c	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 0			0.33982306121845135
RT_ICON	0x297b84	0x1ae8	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9520905923344948
RT_ICON	0x29966c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.16130705394190872
RT_ICON	0x29bc14	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.21177298311444653
RT_ICON	0x29ccbc	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	English	United States	0.3168032786885246
RT_ICON	0x29d644	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.4175531914893617
RT_ICON	0x29daac	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.21083489681050657
RT_ICON	0x29eb54	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	English	United States	0.34672131147540985
RT_ICON	0x29f4dc	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.38652482269503546
RT_MENU	0x29f944	0xd62	data			0.4349095154699358
RT_MENU	0x2a06a8	0x7e	data	English	United States	0.6746031746031746
RT_DIALOG	0x2a0728	0x3e8	data			0.714
RT_DIALOG	0x2a0b10	0x336	data			0.6545012165450121
RT_DIALOG	0x2a0e48	0x118	data	English	United States	0.6392857142857142
RT_DIALOG	0x2a0f60	0x2f0	data	English	United States	0.4747340425531915
RT_DIALOG	0x2a1250	0x146	data	English	United States	0.6533742331288344
RT_RCDATA	0x2a1398	0x9c27a	Delphi compiled form 'TdmMain'			0.24911274057628868
RT_RCDATA	0x33d614	0x46d3b	Delphi compiled form 'TfHint'			0.2587700400197169
RT_RCDATA	0x384350	0xf7ece	Delphi compiled form 'TfPNGMessage'			0.11165807649812605
RT_RCDATA	0x47c220	0x136fe	Delphi compiled form '\016TfrmAutoTuning'			0.6008490968925063
RT_RCDATA	0x48f920	0x20b55	Delphi compiled form 'TMainForm'			0.4496726952445642
RT_RCDATA	0x4b0478	0x5fd99	Delphi compiled form '\023TOperationModeFrame\022OperationModeFrame'			0.5496929452548516
RT_MESSAGETABLE	0x510214	0x2840	data			0.31570263975155277
RT_GROUP_ICON	0x512a54	0x4c	data	English	United States	0.7894736842105263
RT_GROUP_ICON	0x512aa0	0x30	data	English	United States	0.9583333333333334
RT_VERSION	0x512ad0	0x284	data	English	United States	0.4549689440993789
RT_MANIFEST	0x512d54	0x181	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.6623376623376623

Imports

DLL	Import
ADVAPI32.DLL	CloseServiceHandle, ControlService, CreateServiceA, DeleteService, InitializeSecurityDescriptor, OpenSCManagerA, OpenServiceA, QueryServiceStatus, RegCloseKey, RegCreateKeyA, RegDeleteKeyA, RegOpenKeyA, RegQueryValueExA, RegSetValueExA, SetSecurityDescriptorDacl, StartServiceA
COMCTL32.DLL	InitCommonControlsEx
GDI32.dll	BitBlt, CombineRgn, CreateCompatibleDC, CreateDCA, CreateDIBSection, CreateFontA, CreateRectRgn, CreateSolidBrush, DeleteDC, DeleteObject, ExtCreateRegion, GdiFlush, GetDIBits, GetObjectA, GetRegionData, SelectObject, SetBkColor, SetBkMode, SetDIBits, SetTextColor
IMAGEHLP.DLL	ImageLoad, ImageUnload, ReBaseImage
KERNEL32.dll	AddAtomA, AddVectoredExceptionHandler, CloseHandle, CreateFileA, CreateFileMappingA, CreateMutexA, CreateProcessA, CreateThread, CreateToolhelp32Snapshot, DeviceIoControl, ExitProcess, FindAtomA, FindClose, FindFirstFileA, FindNextFileA, FormatMessageA, FreeLibrary, GetAtomNameA, GetComputerNameA, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetDllDirectoryA, GetFileSize, GetLastError, GetModuleFileNameA, GetModuleHandleA, GetProcAddress, GetSystemTime, GetSystemTimes, GetVersionExA, GlobalAlloc, GlobalLock, GlobalMemoryStatus, GlobalUnlock, LoadLibraryA, LoadLibraryExA, MapViewOfFile, Module32First, Module32Next, MultiByteToWideChar, OpenFileMappingA, OpenMutexA, OpenProcess, Process32First, Process32Next, ReadFile, ReadProcessMemory, RemoveVectoredExceptionHandler, ResumeThread, SetDllDirectoryA, SetEnvironmentVariableA, SetLastError, SetUnhandledExceptionFilter, Sleep, SuspendThread, TerminateThread, Thread32First, Thread32Next, UnmapViewOfFile, VirtualQuery, WaitForSingleObject, WideCharToMultiByte
OLE32.dll	CoCreateInstance, CoInitialize, CoUninitialize, CreateStreamOnHGlobal, OleInitialize, OleUninitialize
OLEAUT32.DLL	SysAllocString, SysFreeString
SHELL32.DLL	SHGetFolderPathA, Shell_NotifyIconA
SHLWAPI.DLL	UrlUnescapeA
USER32.dll	BeginDeferWindowPos, BeginPaint, CallNextHookEx, ClientToScreen, CopyIcon, CreateDialogParamA, CreateWindowExA, DefWindowProcA, DeferWindowPos, DestroyMenu, DestroyWindow, DispatchMessageA, DrawTextExA, EnableWindow, EndDeferWindowPos, EndDialog, EndPaint, EnumChildWindows, EnumDisplayDevicesA, EnumDisplayMonitors, FindWindowA, GetAsyncKeyState, GetClassNameA, GetClientRect, GetCursorPos, GetDC, GetDlgItem, GetIconInfo, GetMessageA, GetMonitorInfoA, GetRawInputData, GetRawInputDeviceInfoA, GetRawInputDeviceList, GetRegisteredRawInputDevices, GetSubMenu, GetSystemMetrics, GetWindow, GetWindowLongA, GetWindowRect, GetWindowTextA, IntersectRect, IsDialogMessageA, IsWindow, IsWindowUnicode, LoadCursorFromFileA, LoadIconA, LoadImageA, LoadMenuA, MessageBoxA, MonitorFromRect, PeekMessageA, PostMessageA, PostMessageW, RegisterClassA, RegisterClassExA, RegisterHotKey, RegisterRawInputDevices, RegisterWindowMessageA, ReleaseDC, ScreenToClient, SendInput, SendMessageA, SendMessageW, SetCursorPos, SetForegroundWindow, SetLayeredWindowAttributes, SetSystemCursor, SetWindowLongA, SetWindowPos, SetWindowRgn, SetWindowTextA, SetWindowsHookExA, ShowWindow, SystemParametersInfoA, TrackPopupMenu, TranslateMessage, UnhookWindowsHookEx, UnregisterClassA, UpdateLayeredWindow
WS2_32.DLL	WSAAsyncSelect, WSACleanup, WSAGetLastError, WSAStartup, accept, bind, closesocket, connect, gethostbyname, getsockname, htons, inet_ntoa, listen, ntohs, recv, send, setsockopt, socket

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 11:54:52.532896996 CET	49864	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:54:52.538670063 CET	30203	49864	181.71.216.203	192.168.2.9
Jan 10, 2025 11:54:52.538748026 CET	49864	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:54:52.590078115 CET	49864	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:54:52.594897032 CET	30203	49864	181.71.216.203	192.168.2.9
Jan 10, 2025 11:54:52.594974041 CET	49864	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:54:52.599909067 CET	30203	49864	181.71.216.203	192.168.2.9
Jan 10, 2025 11:55:06.091767073 CET	60925	53	192.168.2.9	162.159.36.2
Jan 10, 2025 11:55:06.096596003 CET	53	60925	162.159.36.2	192.168.2.9
Jan 10, 2025 11:55:06.097450018 CET	60925	53	192.168.2.9	162.159.36.2
Jan 10, 2025 11:55:06.102294922 CET	53	60925	162.159.36.2	192.168.2.9
Jan 10, 2025 11:55:06.593044043 CET	60925	53	192.168.2.9	162.159.36.2
Jan 10, 2025 11:55:06.598027945 CET	53	60925	162.159.36.2	192.168.2.9
Jan 10, 2025 11:55:06.598107100 CET	60925	53	192.168.2.9	162.159.36.2
Jan 10, 2025 11:55:13.914653063 CET	30203	49864	181.71.216.203	192.168.2.9
Jan 10, 2025 11:55:13.915406942 CET	49864	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:55:13.922895908 CET	49864	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:55:13.927726030 CET	30203	49864	181.71.216.203	192.168.2.9
Jan 10, 2025 11:55:14.164055109 CET	60964	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:55:14.168853045 CET	30203	60964	181.71.216.203	192.168.2.9
Jan 10, 2025 11:55:14.168991089 CET	60964	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:55:14.169857979 CET	60964	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:55:14.174628973 CET	30203	60964	181.71.216.203	192.168.2.9
Jan 10, 2025 11:55:14.174767971 CET	60964	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:55:14.179569006 CET	30203	60964	181.71.216.203	192.168.2.9
Jan 10, 2025 11:55:35.536966085 CET	30203	60964	181.71.216.203	192.168.2.9
Jan 10, 2025 11:55:35.537125111 CET	60964	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:55:35.537348032 CET	60964	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:55:35.542185068 CET	30203	60964	181.71.216.203	192.168.2.9
Jan 10, 2025 11:55:35.648099899 CET	60965	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:55:35.653539896 CET	30203	60965	181.71.216.203	192.168.2.9
Jan 10, 2025 11:55:35.653634071 CET	60965	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:55:35.654340029 CET	60965	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:55:35.659084082 CET	30203	60965	181.71.216.203	192.168.2.9
Jan 10, 2025 11:55:35.659169912 CET	60965	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:55:35.663961887 CET	30203	60965	181.71.216.203	192.168.2.9
Jan 10, 2025 11:55:57.058604002 CET	30203	60965	181.71.216.203	192.168.2.9
Jan 10, 2025 11:55:57.058670998 CET	60965	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:55:57.058841944 CET	60965	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:55:57.063607931 CET	30203	60965	181.71.216.203	192.168.2.9
Jan 10, 2025 11:55:57.163501978 CET	60966	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:55:57.168348074 CET	30203	60966	181.71.216.203	192.168.2.9
Jan 10, 2025 11:55:57.168451071 CET	60966	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:55:57.169116020 CET	60966	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:55:57.173934937 CET	30203	60966	181.71.216.203	192.168.2.9
Jan 10, 2025 11:55:57.174005985 CET	60966	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:55:57.178812027 CET	30203	60966	181.71.216.203	192.168.2.9
Jan 10, 2025 11:56:18.542574883 CET	30203	60966	181.71.216.203	192.168.2.9
Jan 10, 2025 11:56:18.542674065 CET	60966	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:56:18.542778015 CET	60966	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:56:18.547581911 CET	30203	60966	181.71.216.203	192.168.2.9
Jan 10, 2025 11:56:18.648184061 CET	60967	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:56:18.653328896 CET	30203	60967	181.71.216.203	192.168.2.9
Jan 10, 2025 11:56:18.653403044 CET	60967	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:56:18.654208899 CET	60967	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:56:18.662364006 CET	30203	60967	181.71.216.203	192.168.2.9
Jan 10, 2025 11:56:18.664446115 CET	60967	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:56:18.669210911 CET	30203	60967	181.71.216.203	192.168.2.9
Jan 10, 2025 11:56:30.523996115 CET	60967	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:56:30.528887033 CET	30203	60967	181.71.216.203	192.168.2.9
Jan 10, 2025 11:56:30.528959990 CET	60967	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:56:30.533754110 CET	30203	60967	181.71.216.203	192.168.2.9
Jan 10, 2025 11:56:33.820437908 CET	60967	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:56:33.825417995 CET	30203	60967	181.71.216.203	192.168.2.9
Jan 10, 2025 11:56:33.825608969 CET	60967	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:56:33.830507994 CET	30203	60967	181.71.216.203	192.168.2.9
Jan 10, 2025 11:56:36.826651096 CET	60967	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:56:36.831537008 CET	30203	60967	181.71.216.203	192.168.2.9
Jan 10, 2025 11:56:36.831607103 CET	60967	30203	192.168.2.9	181.71.216.203
Jan 10, 2025 11:56:36.836420059 CET	30203	60967	181.71.216.203	192.168.2.9
Jan 10, 2025 11:56:40.028099060 CET	30203	60967	181.71.216.203	192.168.2.9
Jan 10, 2025 11:56:40.028181076 CET	60967	30203	192.168.2.9	181.71.216.203

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 11:54:52.499445915 CET	63645	53	192.168.2.9	1.1.1.1
Jan 10, 2025 11:54:52.529359102 CET	53	63645	1.1.1.1	192.168.2.9
Jan 10, 2025 11:55:06.061768055 CET	53	50427	162.159.36.2	192.168.2.9
Jan 10, 2025 11:55:06.691771984 CET	62873	53	192.168.2.9	1.1.1.1
Jan 10, 2025 11:55:06.699726105 CET	53	62873	1.1.1.1	192.168.2.9
Jan 10, 2025 11:55:08.099780083 CET	55008	53	192.168.2.9	1.1.1.1
Jan 10, 2025 11:55:08.115267992 CET	53	55008	1.1.1.1	192.168.2.9
Jan 10, 2025 11:55:14.119262934 CET	50460	53	192.168.2.9	1.1.1.1
Jan 10, 2025 11:55:14.163132906 CET	53	50460	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 11:54:52.499445915 CET	192.168.2.9	1.1.1.1	0xd944	Standard query (0)	newstaticfreepoint24.ddns-ip.net	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:55:06.691771984 CET	192.168.2.9	1.1.1.1	0xcf53	Standard query (0)	171.39.242.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Jan 10, 2025 11:55:08.099780083 CET	192.168.2.9	1.1.1.1	0xf58e	Standard query (0)	53.210.109.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Jan 10, 2025 11:55:14.119262934 CET	192.168.2.9	1.1.1.1	0x1908	Standard query (0)	newstaticfreepoint24.ddns-ip.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 11:54:25.822184086 CET	1.1.1.1	192.168.2.9	0x3c3a	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 11:54:25.822184086 CET	1.1.1.1	192.168.2.9	0x3c3a	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:54:52.529359102 CET	1.1.1.1	192.168.2.9	0xd944	No error (0)	newstaticfreepoint24.ddns-ip.net		181.71.216.203	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:55:06.699726105 CET	1.1.1.1	192.168.2.9	0xcf53	Name error (3)	171.39.242.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Jan 10, 2025 11:55:08.115267992 CET	1.1.1.1	192.168.2.9	0xf58e	Name error (3)	53.210.109.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Jan 10, 2025 11:55:14.163132906 CET	1.1.1.1	192.168.2.9	0x1908	No error (0)	newstaticfreepoint24.ddns-ip.net		181.71.216.203	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	05:54:29
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\PDFONLINE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PDFONLINE.exe"
Imagebase:	0x400000
File size:	4'623'872 bytes
MD5 hash:	8268F8AD872D9CA06152019676FBE0BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:54:48
Start date:	10/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Imagebase:	0x1000000
File size:	2'141'552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000003.00000002.2619681545.000000000A070000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000003.00000002.2619242179.0000000008AA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000003.00000002.2618808786.0000000007901000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Function 004012A0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1589527542.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1589506145.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589556913.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589556913.0000000000449000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589607352.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589607352.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589607352.0000000000454000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589607352.000000000049C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589717076.0000000000547000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589755774.000000000054A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589774734.000000000054B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589797628.000000000054D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589825496.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589845201.000000000055B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589845201.0000000000577000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589893938.000000000057B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589916651.000000000057F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589916651.0000000000647000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590032085.000000000064B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590057977.0000000000652000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590057977.0000000000656000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590057977.0000000000695000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590057977.00000000006AB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590057977.00000000006BF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590214841.00000000006F4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590256634.000000000071A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590256634.0000000000754000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590256634.0000000000757000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590357962.000000000076A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590390172.0000000000784000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590390172.00000000007EC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1590390172.000000000081B000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PDFONLINE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b891f53d95835a12b9091d7e9df3d300cb2fae0ce7b337f1cc81d3f3ecba0f64
Instruction ID: a7d070fd37f96f7c44c702c407d5d7541a915b717c9ed70eb8648bb24fb8929d
Opcode Fuzzy Hash: b891f53d95835a12b9091d7e9df3d300cb2fae0ce7b337f1cc81d3f3ecba0f64
Instruction Fuzzy Hash: 4DB0121441430402D1003635480731879DC970134AF40153898D211183D57C50070296

Analysis Process: csc.exePID: 7644, Parent PID: 7416COMMON

Execution Graph

Execution Coverage:	6.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	29.6%
Total number of Nodes:	27
Total number of Limit Nodes:	5

Executed Functions

Function 076E138C Relevance: 2.6, Strings: 2, Instructions: 125
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

M*^;, xrefs: 076E117D
0F<l, xrefs: 076E13B4

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID: 0F<l$M*^;
API String ID: 0-3404287229
Opcode ID: 39d5c9f68bc1a5c5dbea66bf2cb738ba62b93a1aef46e32fe0e018d9e341411c
Instruction ID: 92c9c0bd0de286f8012bb63fca2f579ab18a90cfa21f1c4e9f5e75069aa6e308
Opcode Fuzzy Hash: 39d5c9f68bc1a5c5dbea66bf2cb738ba62b93a1aef46e32fe0e018d9e341411c
Instruction Fuzzy Hash: 25510770A04244CFCB48DF68D5A6A6977F5EB4C305F50806EE91BDB352DB35A849CF18

Function 076ED28F Relevance: 2.4, Strings: 1, Instructions: 1146COMMON

Download Yara Rule

Strings

4, xrefs: 076EDC75

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: e9e42e692346754e480bd725f2fabac78e35f13bd93bdf0c48c91fda9eaab937
Instruction ID: 0225e9fba54c05adbb70c11caa630581c00578b76a34aad3a06d0802b046a326
Opcode Fuzzy Hash: e9e42e692346754e480bd725f2fabac78e35f13bd93bdf0c48c91fda9eaab937
Instruction Fuzzy Hash: B9B226B4B01219DFDB14DFA4C894BADB7B6BF48700F148199E506AB3A5DB71AC81CF60

Function 076ED5C7 Relevance: 1.7, Strings: 1, Instructions: 495COMMON

Download Yara Rule

Strings

4, xrefs: 076EDC75

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: 1112387e6ff13cde74a531e4c01f64b4015bbf9ec8cc8b4bd248fa9a6d2fee1e
Instruction ID: 618addc00a9b371001b809038716ccd9959e673434563d64cf29bd75ba9d0fa7
Opcode Fuzzy Hash: 1112387e6ff13cde74a531e4c01f64b4015bbf9ec8cc8b4bd248fa9a6d2fee1e
Instruction Fuzzy Hash: B0221AB4B01219DFDB24DFA4C994BADB7B6BF48300F1481A9D50AAB391DB719D81CF60

Function 076DF008 Relevance: 1.7, APIs: 1, Instructions: 164
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 076DF131

Memory Dump Source

Source File: 00000003.00000002.2618727233.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76d0000_csc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: f6b8a97003b14713eeb174f6da249c92710317800128c9767bc8ed98e245ed69
Instruction ID: 43b2fdfff0ec5a54838da6728a0831d79e5bf07749b48d64c4ae3bd58f9f0689
Opcode Fuzzy Hash: f6b8a97003b14713eeb174f6da249c92710317800128c9767bc8ed98e245ed69
Instruction Fuzzy Hash: 07514CB57080048FC349EB78D195B7937E6EB8E304B4550ADD51BCB382DE349C46CB6A

Function 076DF078 Relevance: 1.6, APIs: 1, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 076DF131

Memory Dump Source

Source File: 00000003.00000002.2618727233.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76d0000_csc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: b3e32295073a0ea95914bfdbdb77665334bf49e57a9f6fc42715b420485f1d9b
Instruction ID: faf4a49a8bd9d5397f27be1d7d6b9c08c17609ef9b8e4dc50ef4f3bfc555da74
Opcode Fuzzy Hash: b3e32295073a0ea95914bfdbdb77665334bf49e57a9f6fc42715b420485f1d9b
Instruction Fuzzy Hash: 14512AB47040048FC349EB7CD194B7A33E6EB8E704B95506D951BCB386DE34AC46CB6A

Function 0A701BE0 Relevance: 1.5, Strings: 1, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Vwn, xrefs: 0A701E2B

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID: \Vwn
API String ID: 0-47881834
Opcode ID: ea743f7f9324a53fbc0ea3c1e5b42c76f8f50bee53a3531e6d74965f18b6d468
Instruction ID: bb0d9969197a5bc12c7e52625a77c63cf1e2fd0d6bdb0c3a5230547fed9cc26c
Opcode Fuzzy Hash: ea743f7f9324a53fbc0ea3c1e5b42c76f8f50bee53a3531e6d74965f18b6d468
Instruction Fuzzy Hash: A1915D71E10209DFDF10CFA9C985BAEBBF2AF88304F54C629D415A7294EB749849CF91

Function 076E12C2 Relevance: 1.4, Strings: 1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

M*^;, xrefs: 076E117D

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID: M*^;
API String ID: 0-3906143540
Opcode ID: e35645c38a6243f314068da3e2c6df62d0a2cabd76c42fa0ecb3d418fe30733f
Instruction ID: 4831a38b8e23bc57f46acc418e24b33f6032279c0ee52a4a31f45ae2140953ff
Opcode Fuzzy Hash: e35645c38a6243f314068da3e2c6df62d0a2cabd76c42fa0ecb3d418fe30733f
Instruction Fuzzy Hash: 45512770A04208CFCB48DF68D5A6A6D77F6FB49305F10806EE81ADB391DB349949CF18

Function 076E0F43 Relevance: 1.4, Strings: 1, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

M*^;, xrefs: 076E117D

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID: M*^;
API String ID: 0-3906143540
Opcode ID: 9c073726796b75fdc90f0e27d8842962930ee6808f96a745240f7347ed188474
Instruction ID: bcfe5434f05b239a68b2016971dd9611b92cbacd0bb171d84e5a89336133fbab
Opcode Fuzzy Hash: 9c073726796b75fdc90f0e27d8842962930ee6808f96a745240f7347ed188474
Instruction Fuzzy Hash: BD51F870A04204CFCB48DF68D5A6AA977F6FB4D305F10806EE91ADB391DB35A949CF18

Function 076E123C Relevance: 1.4, Strings: 1, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

M*^;, xrefs: 076E117D

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID: M*^;
API String ID: 0-3906143540
Opcode ID: 55079a6bce8c418e2756396ccb1920f17136bd87f1e495c0962e3d9fe2afa578
Instruction ID: 3bfe072fc99a4caed9091d6dc94560effa00f58e46a59cb34d6556e834325995
Opcode Fuzzy Hash: 55079a6bce8c418e2756396ccb1920f17136bd87f1e495c0962e3d9fe2afa578
Instruction Fuzzy Hash: 40511870A14204CFCB48DF68D5A6AAD77F6FB49305F10806EE91ADB391DB35A949CF08

Function 076E1474 Relevance: 1.4, Strings: 1, Instructions: 125
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

M*^;, xrefs: 076E117D

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID: M*^;
API String ID: 0-3906143540
Opcode ID: 0f672823919880f79cba4957a4c1dd3a1af05e845c11a2fc4a8a8fc317e4c4fa
Instruction ID: 3e00b643fe280ee7585f67f3754e37e23e87c2cb9a61cd77e852e41b7eb88912
Opcode Fuzzy Hash: 0f672823919880f79cba4957a4c1dd3a1af05e845c11a2fc4a8a8fc317e4c4fa
Instruction Fuzzy Hash: C1510670A04208CFCB44DFA8D5A6BA977F6FB48305F10806EE91ADB351DB34A948CF04

Function 076E0FB4 Relevance: 1.4, Strings: 1, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

M*^;, xrefs: 076E117D

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID: M*^;
API String ID: 0-3906143540
Opcode ID: 9b1719fbbc2854df4f765ee6572edecbd93068926b68e94ec30ee5373c974c16
Instruction ID: c6851bc2a259850f35b8614e30ec7171e2bbba37f17ae86884abfa72e6386962
Opcode Fuzzy Hash: 9b1719fbbc2854df4f765ee6572edecbd93068926b68e94ec30ee5373c974c16
Instruction Fuzzy Hash: 4151F770A04208CFCB58DFA8D5A6AAD77F6FB49305F10806EE91ADB351DB34A949CF14

Function 076E13FF Relevance: 1.4, Strings: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

M*^;, xrefs: 076E117D

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID: M*^;
API String ID: 0-3906143540
Opcode ID: f3479dc309ae0ecba19383822a239cddd158b0afeaa2b3e7f6617e6b7ba35dc9
Instruction ID: e8b016a234b168193e59163ba1d753730f8ea3f1a80a22ef8d8e0bf7bd499320
Opcode Fuzzy Hash: f3479dc309ae0ecba19383822a239cddd158b0afeaa2b3e7f6617e6b7ba35dc9
Instruction Fuzzy Hash: 9A510C70A04248CFCB44DFA8D4A5AADB7F6FB49305F10806EE91ADB351DB749949CF14

Function 076E0EF7 Relevance: 1.4, Strings: 1, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

M*^;, xrefs: 076E117D

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID: M*^;
API String ID: 0-3906143540
Opcode ID: 000a97b743114f487934fb6729ab65941e6e5bfe6d80486440cfb0804dfbe143
Instruction ID: a5977c9525e79dbb62d6c9511a4a56d672fcf874299261129d6b790d112e8bda
Opcode Fuzzy Hash: 000a97b743114f487934fb6729ab65941e6e5bfe6d80486440cfb0804dfbe143
Instruction Fuzzy Hash: B9512A70A04244CFCB44DFB8D5A6AADBBF5EB49305F10806EE81ADB392DB349949CF14

Function 076E10C0 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

M*^;, xrefs: 076E117D

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID: M*^;
API String ID: 0-3906143540
Opcode ID: 9e43f998aef839adad600420a852f4540d3c2658b33fbf380654704837fd653c
Instruction ID: 54a6b420bbd501d9357822c2969a50890640f37a2e5f15f4c6ffed394182fb5b
Opcode Fuzzy Hash: 9e43f998aef839adad600420a852f4540d3c2658b33fbf380654704837fd653c
Instruction Fuzzy Hash: 9B51E770A04248CFCB44DFA8D4A5AAD77F6EB49305F10806EE91ADB351DB749949CF18

Function 076E0F08 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

M*^;, xrefs: 076E117D

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID: M*^;
API String ID: 0-3906143540
Opcode ID: eed5fcee0eb9efdae87109386b138129691a9dc31c9b5a96c3044aacb0ba1c71
Instruction ID: 75ea8edfdcb9871d8cf20073ed44834a370e4d2accb692151d43fea4800eeb0e
Opcode Fuzzy Hash: eed5fcee0eb9efdae87109386b138129691a9dc31c9b5a96c3044aacb0ba1c71
Instruction Fuzzy Hash: F6511970A04248CFCB44DFA8D5A6AADB7F5EB49305F10806EE91BDB391DB34A949CF14

Function 076D0990 Relevance: .6, Instructions: 552COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618727233.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76d0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae4c0c0ffaeacabab57dad11f1c9373f751b83ff8f6a3bf1f039767985add080
Instruction ID: 261b5fd7ed820b697819df0ec376b2fa1f9240fad67a67a0218ca9e89e949b30
Opcode Fuzzy Hash: ae4c0c0ffaeacabab57dad11f1c9373f751b83ff8f6a3bf1f039767985add080
Instruction Fuzzy Hash: 412236B4B10205CFDB14DF69C484AAABBF6BF89310F2584A9E506DB361DB71EC41CB61

Function 0A706FA0 Relevance: .4, Instructions: 367COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01f99eb9ecc820b358956443f29877c1f9f002f26d8d60426d837bcee31fafe1
Instruction ID: 1e2020d5d6afafa2f1ae392e4b7a1880b86c2ad81b75144c89934110c6ce0281
Opcode Fuzzy Hash: 01f99eb9ecc820b358956443f29877c1f9f002f26d8d60426d837bcee31fafe1
Instruction Fuzzy Hash: 70F16934A04504DFD758CB28D588FAABBF2FB89314F15C0A9E5059B7A2CB74AC89CF44

Function 0A70413B Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2649dd40176dd9757a122ae81fe96c10c038fe77f1a3370943cfce3d2975250
Instruction ID: 0d2ba7b23c32360b9eb757ff980cd532c9015bf6a46e952cf6a2358b925ec56a
Opcode Fuzzy Hash: a2649dd40176dd9757a122ae81fe96c10c038fe77f1a3370943cfce3d2975250
Instruction Fuzzy Hash: D4C17878B04204CFD758DBA9D654BAE77F2FB89304F11C068D206AB695DB34AC89CF49

Function 0A7073F2 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a33f7bdba8629916a5c5a5a41c48f7bf9e1dcad2bdb83d8ff93cbeed82d0b829
Instruction ID: 2d242be9a9374fdce44a865eeeee13e6aacb231afe18446f680bea9719a6f049
Opcode Fuzzy Hash: a33f7bdba8629916a5c5a5a41c48f7bf9e1dcad2bdb83d8ff93cbeed82d0b829
Instruction Fuzzy Hash: 17D11734A04504DFD758CB24D588FAABBF2FB88314F25D0A8E5059B7A6CB75AC89CF44

Function 0A704148 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d50093cb7e482efb7948d6c2e45793f62206470a6c2c7ef868012b5b8cd49238
Instruction ID: fde5be9ca3721b781b682dfe668f4825a94de13acc04e3d01854c0293b21004d
Opcode Fuzzy Hash: d50093cb7e482efb7948d6c2e45793f62206470a6c2c7ef868012b5b8cd49238
Instruction Fuzzy Hash: E9B15878B04208CFD718EBA9D554BAD77F2FB89304F118069D2069B695DB34AC89CF4D

Function 0A7027F8 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa9efc78f38b1ee098c5d75287c30d16f633754b39bf07546ed8e2ba2a93ecab
Instruction ID: c343c677d33d76066fee53206624a26e3eb40917c7850f3c0029c29cb49320d6
Opcode Fuzzy Hash: aa9efc78f38b1ee098c5d75287c30d16f633754b39bf07546ed8e2ba2a93ecab
Instruction Fuzzy Hash: 39B14C71E10209DFDB10CFA9C889BDEBBF2AB88314F14C129D955A7295EB749849CF81

Function 076E55D1 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 963b979ce58febc4ac90ea413f3c166d6b771dc93330694e7923888acff03677
Instruction ID: bd61fb68ba53593eb9a255968a6478a855fb6b1f0e3d0717c902ccb2f861dbb7
Opcode Fuzzy Hash: 963b979ce58febc4ac90ea413f3c166d6b771dc93330694e7923888acff03677
Instruction Fuzzy Hash: 9291E4B0A05105CFEB14CF64D944BAEB7FBFB84318F548026C403AB2A2DB3499A5CF64

Function 0A7042E7 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2f8fc26c44cdfe4c2bb5622bd5d8bbc3ec6715e24620f8d2819c125d2ee96bf
Instruction ID: 71abfec65f947f36ab84f016d70a589feb51cf415d0eab1b8c089f5b53b91c3b
Opcode Fuzzy Hash: c2f8fc26c44cdfe4c2bb5622bd5d8bbc3ec6715e24620f8d2819c125d2ee96bf
Instruction Fuzzy Hash: 55913778B04204DFDB64DBA5D554FA9B7F2FB88304F21C069D202AB695DB34AD89CF48

Function 076E55E0 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94980498c25d5f95793b11f0a1dbd80ead0c1343c6eeabb940404fb5309cc525
Instruction ID: da7fd89acbf9a9d52ea480451c8e053d397526b54c4a1de916d5e9718f8949da
Opcode Fuzzy Hash: 94980498c25d5f95793b11f0a1dbd80ead0c1343c6eeabb940404fb5309cc525
Instruction Fuzzy Hash: 4A91D2B0A05115CFEB10CF64D944BAAB7FBFB84318F548026D403AB266DB749C95CF64

Function 076E570C Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bc5288280e206163b9d72818beaade4b198acb1676ade257a286f401ca32205
Instruction ID: 2bf10fbf2cc5ed632dec14abaa59ccceb5ee5dc752cf85b90bd956879e08f04f
Opcode Fuzzy Hash: 7bc5288280e206163b9d72818beaade4b198acb1676ade257a286f401ca32205
Instruction Fuzzy Hash: 2181B1B0A06115CFEB10CF64D944BAAB7F7FB84318F548026D403AB267DB749996CF64

Function 05AE3C7C Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618140776.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5ae0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73a752674e13b430bcb63e2d1cc0c4e17000aacc0b904c5120dbe7a210dd7972
Instruction ID: 17058b62ad01035858bf9eb50b5bdf183971b9b2c7652437c99ebec9ae98a630
Opcode Fuzzy Hash: 73a752674e13b430bcb63e2d1cc0c4e17000aacc0b904c5120dbe7a210dd7972
Instruction Fuzzy Hash: F8513B70A147448FE708EF7AE8416AABBF3FBC8204F24C529D904DB265DF316805AF56

Function 05AE3C88 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618140776.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5ae0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e109d64786bb459f6c85a81ad1c9c335aae135b5cc07369152682ec4ccb85012
Instruction ID: c1c311486bff55f9e4003fab87b84ace50fc5a5cf24e961939da35f7b4b3dad7
Opcode Fuzzy Hash: e109d64786bb459f6c85a81ad1c9c335aae135b5cc07369152682ec4ccb85012
Instruction Fuzzy Hash: 4F513A70A147448FE708EF7AE84169ABBF3FBC8204F14C529D904EB265DF716805AF56

Function 076DF388 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618727233.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76d0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea3bc6bfa042b39714784e95f09c4d3ceaab742f1ff33a5a14e61510557e4986
Instruction ID: 4cfd1c3c5aa3cde591fad16b2998c208222d73295b3436b1d7eed040fc4725df
Opcode Fuzzy Hash: ea3bc6bfa042b39714784e95f09c4d3ceaab742f1ff33a5a14e61510557e4986
Instruction Fuzzy Hash: A0417CB0E28106CFDB14DF64E648BE933B3EB49315F268068D12396265CBB49D8ACB45

Function 0A701BD4 Relevance: 2.7, Strings: 2, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

V, xrefs: 0A701C43
\Vwn, xrefs: 0A701E2B

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID: V$\Vwn
API String ID: 0-2093646587
Opcode ID: a7f3f580d54508a97d9beeb800249b731e30625e8fc8408169b4e26a34af0b7c
Instruction ID: 854aa03b69edebbd4fedf6ff01f73ba020ed9663ec7b81807a8afa9363658598
Opcode Fuzzy Hash: a7f3f580d54508a97d9beeb800249b731e30625e8fc8408169b4e26a34af0b7c
Instruction Fuzzy Hash: 82815071E10209DFDF10CFA8D995BEEBBF1AF88314F548628D405A7290EB749889CF51

Function 05AEC198 Relevance: 1.6, APIs: 1, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 05AEC20C

Memory Dump Source

Source File: 00000003.00000002.2618140776.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5ae0000_csc.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 3475318ed83cf960a398df80beca5d71232d5a4d656a7d3e35fafd14d2d4c4f9
Instruction ID: dd9c89593fcb63676dcf04f6b7b12895fb96d6c33afab5ecaf02817fcb447f03
Opcode Fuzzy Hash: 3475318ed83cf960a398df80beca5d71232d5a4d656a7d3e35fafd14d2d4c4f9
Instruction Fuzzy Hash: 9E11F4B1D003099FDB10DFAAC484BEEFBF4EF48220F14842AD469A7240D779A944CFA1

Function 0A701BD7 Relevance: 1.5, Strings: 1, Instructions: 235
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Vwn, xrefs: 0A701E2B

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID: \Vwn
API String ID: 0-47881834
Opcode ID: 8cc0b08d18187aeefa5e01ec369221a316f4e71cc74b22c68b0d2c514d5ce5ff
Instruction ID: cf159f49b27132692bbfaa0fedd510de9620534400e8673680e1a681866084de
Opcode Fuzzy Hash: 8cc0b08d18187aeefa5e01ec369221a316f4e71cc74b22c68b0d2c514d5ce5ff
Instruction Fuzzy Hash: 2F915D70E10209DFDF20CFA8C985BDEBBF1AF88314F548629E415A7294EB749849CF91

Function 05AEC348 Relevance: 1.3, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 05AEC3AA

Memory Dump Source

Source File: 00000003.00000002.2618140776.0000000005AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5ae0000_csc.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 2129836efcff518ee65d7712fc1d2ae2a0deddb9ccebf4529509a73027010089
Instruction ID: ccd224e6327bf70d86da1ab85a0e8d6d1e91ef13c11a28d17b5ed760b1dc6bbb
Opcode Fuzzy Hash: 2129836efcff518ee65d7712fc1d2ae2a0deddb9ccebf4529509a73027010089
Instruction Fuzzy Hash: D8113AB1D003498FDB10DFAAC4457DEFBF4EF88224F148419D559A7240C7796944CBA4

Function 076E67AD Relevance: .8, Instructions: 800COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dc322ec9cc7b3c91ecc8aecb370fb558851e4b68139869309c6b783f6b9af82
Instruction ID: 4675d59f0810d554afce4735074b71466383d32caeee980be8237c1fa5e6ce4c
Opcode Fuzzy Hash: 0dc322ec9cc7b3c91ecc8aecb370fb558851e4b68139869309c6b783f6b9af82
Instruction Fuzzy Hash: 122209B71067914AC721DE28FF051DAFFA4BE01670714465FC2D75BA63CA21B3868BE2

Function 0A120078 Relevance: .6, Instructions: 597COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2619846772.000000000A120000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a120000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce1c27778622adbba06a1c0c2fdba2d96edabf51aba9f3236cfbf302bbac7cee
Instruction ID: 4b399e040b08c433ce3964bcbbe09c81afada9019b6c3eb7c4eac6793beecd6a
Opcode Fuzzy Hash: ce1c27778622adbba06a1c0c2fdba2d96edabf51aba9f3236cfbf302bbac7cee
Instruction Fuzzy Hash: 7602B530B102349BEB7D6665585833F26E7EBCC661B46422ADE47C7384DF34CC598BA2

Function 076EF751 Relevance: .5, Instructions: 527COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cc73df502a444b1607d9e4b444f3067392414413c46289b5ad85284f10b6af7
Instruction ID: 09b2b96c587b0920f198e29994f6c4eee0db53152a997d28f00f71ad1e0b1b50
Opcode Fuzzy Hash: 4cc73df502a444b1607d9e4b444f3067392414413c46289b5ad85284f10b6af7
Instruction Fuzzy Hash: D8228D75A0121ADFCB05DFA4D854AEEBBB6FF48700F148019E852AB391DB349D42CF61

Function 0A120810 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2619846772.000000000A120000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a120000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a49e935339e21ac0ace4f085eb9ea12c5597705852e4e80db473cf5773b7a3b6
Instruction ID: 279950a32f241cd40370ff8e9679854730cddc30558038ddfe70bd2204ed3b65
Opcode Fuzzy Hash: a49e935339e21ac0ace4f085eb9ea12c5597705852e4e80db473cf5773b7a3b6
Instruction Fuzzy Hash: ADC19338B002248B9F6E6B68905913D7AA3FFCD261715452EEC07D3784DF3ADC568B42

Function 076E14F8 Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d25d3c543601f13045672f823fdbd1f1819bd2ad4ba0a4369d6ece48720ddba4
Instruction ID: 15e26a08fd93f6080a48d8b520c2a4b64abc5172a68fb616a4c110f65c2d683d
Opcode Fuzzy Hash: d25d3c543601f13045672f823fdbd1f1819bd2ad4ba0a4369d6ece48720ddba4
Instruction Fuzzy Hash: 07C1E2756013588FC709EF68D554A9ABBF6FF8A710F1584A9D406AB362CB30EC01DFA1

Function 0A705E60 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b01978e282d67fa340c185464ce4ffff1c9c6da12a6cd19c3288521990d433e2
Instruction ID: 59098f92e5f61de0221ec87317a75e17d1c3c6f6738b0d5da310d138164618c9
Opcode Fuzzy Hash: b01978e282d67fa340c185464ce4ffff1c9c6da12a6cd19c3288521990d433e2
Instruction Fuzzy Hash: 729147717083409FD716AF789860A6E7BE6DFC6210B14846AD50ACF3C2DE75DC06C7A6

Function 0A7027EC Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7abfca33632f9adb93fe6d166de8ba6525ff74608b2e40c914b6fabb1d0bf24
Instruction ID: 28d8239693a2207bbd1b7566d08c6a17bea1c1e2309693e05fd745056930f823
Opcode Fuzzy Hash: a7abfca33632f9adb93fe6d166de8ba6525ff74608b2e40c914b6fabb1d0bf24
Instruction Fuzzy Hash: B3B14A72E10209DFDB10CFA9D889BDEBBF1AF48314F148129D958E7295EB749849CF81

Function 076EC318 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12058ba8314a92b2fb8011470669182db5afdd8d5d3c8edb9c8460b25dacdf24
Instruction ID: 71fbb6c42aee5d4222b780dcc0d983d4264e65e30314f0f43bab87f59cf19e07
Opcode Fuzzy Hash: 12058ba8314a92b2fb8011470669182db5afdd8d5d3c8edb9c8460b25dacdf24
Instruction Fuzzy Hash: 618188B5A02205DFCB06CFA8D455AADBBF6EF89211F148069E812EB390DB35CD41CB74

Function 0A7064A8 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef7102cf62ee0484fa5f09e6a6e374eee81266429ba852f2d1b27daed3f0d724
Instruction ID: 66a25283255ec32958ba0c5ae65766bcbd712ec9db9d31ead37fb07b68f1ba6c
Opcode Fuzzy Hash: ef7102cf62ee0484fa5f09e6a6e374eee81266429ba852f2d1b27daed3f0d724
Instruction Fuzzy Hash: CC711F31B046049FD759DF28C4A8A6EBBF6FF8A200B14896DD44ADB781DA34EC41CB95

Function 076E4FE0 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9df7a5a2728f0c7c35f431e4dff57cde6fe1efd4e69d8b60d6aa5b47cd2e2b67
Instruction ID: 14e5031088085fddcddae8507387f0bf8b8fb8796b1c458b6ff6d331182d25cc
Opcode Fuzzy Hash: 9df7a5a2728f0c7c35f431e4dff57cde6fe1efd4e69d8b60d6aa5b47cd2e2b67
Instruction Fuzzy Hash: 8581BF70215202CFD715AF38C9487797BBAEB45309F10496AE807CB342FB39A895CFA5

Function 076E4FF0 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fad62e4041aa08b66778563bd815e465f18f6486b13b218f9998d46e7d3ed216
Instruction ID: d856c396fd3d00698ffb4ab04d19e6c09ffcb2af264e78a0074e410c24feefd3
Opcode Fuzzy Hash: fad62e4041aa08b66778563bd815e465f18f6486b13b218f9998d46e7d3ed216
Instruction Fuzzy Hash: 0B719C70215201CFD715AF38C9487797BBAEB45309F10496AE807CB382FB79A895CFA5

Function 0A120CC8 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2619846772.000000000A120000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a120000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 717cdfdc16dbdcf02a1f518ab0bf01f8f2c934b599c473c88423f89a26aa071b
Instruction ID: b62924d7fd4d2eb6c71601d7faf957551375d641925cd01972c18f15635478a9
Opcode Fuzzy Hash: 717cdfdc16dbdcf02a1f518ab0bf01f8f2c934b599c473c88423f89a26aa071b
Instruction Fuzzy Hash: E751A7323002115BE3185AA9D4A873BF2FBDFD9601F55413EA706CB698CFB5CC9547A1

Function 076EF030 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39eca0cfc97787b3147f9034581d48a8c6c1253a2be1fe617e452771a6cbdf98
Instruction ID: f95a72e9393f177c9bed0959870a1dc0578e27b07c35ec9ec60c085d8a1ad13a
Opcode Fuzzy Hash: 39eca0cfc97787b3147f9034581d48a8c6c1253a2be1fe617e452771a6cbdf98
Instruction Fuzzy Hash: 3751AE70B006049FD756AF78C4546AE77B6EFC9240B24496CD8079B3A4CF35EC42CBA6

Function 076E1548 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90f2dca34593b2c81c7c19f83b0840fb9151da8bc897994d7f17e7e0e0f4496f
Instruction ID: 47eae7584af5b9712238c16d71052fc45564d7722e4723eec1c83341ef884753
Opcode Fuzzy Hash: 90f2dca34593b2c81c7c19f83b0840fb9151da8bc897994d7f17e7e0e0f4496f
Instruction Fuzzy Hash: D16198B4A00608CFCB18EF29D584959BBF6FF89310B158569E806AB361DB30EC01DFA5

Function 076EABE0 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df45cab33c6a9deb00b26bedb799feea7b179547616b5eef3ed5227b6409c2e9
Instruction ID: 48fc24f6e71aeef8bee12b9da9acb5eca4952dd3d9ba28ab690e9f362374542a
Opcode Fuzzy Hash: df45cab33c6a9deb00b26bedb799feea7b179547616b5eef3ed5227b6409c2e9
Instruction Fuzzy Hash: 85513A76600105EFDB4A9FA8C904E69BBB7FF8D3147158098E6099B372DB32DC21EB51

Function 076E5CF8 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd743951f4e1a03a961d6b8bfddcfd912cd59eebcb05b9c228f151c91dfd94c7
Instruction ID: c553ee39e07df4c06d8edb5a49075c51bf5f2a897bf5c4b1f94e1013cfbcf236
Opcode Fuzzy Hash: fd743951f4e1a03a961d6b8bfddcfd912cd59eebcb05b9c228f151c91dfd94c7
Instruction Fuzzy Hash: 1451F370705101CFD704CB29D948BA977EBFB89319F18506AD503DB7A2CB749C96CB28

Function 076EB5F8 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff43bf743b48042384d3d0ccbc3c800864bdb549173b4f294befa60712218346
Instruction ID: a422e305c1b195f2576619a6d8ebd3f2a9298c196fc3d4eeb14fd6771d3f3f70
Opcode Fuzzy Hash: ff43bf743b48042384d3d0ccbc3c800864bdb549173b4f294befa60712218346
Instruction Fuzzy Hash: B44123B12057018FE721DF3AC45075A7BF6AF85310F148A2ED44B8B7A1DB74EC458BA2

Function 076E53AB Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b21d218b3ef0a448ddd0c53cf68ece70df9b2a841861a98581e4eb110f15e8f9
Instruction ID: 161b44df16113854e16ac4090abe1a87527909fe09ead5fcac0d1f5bccabd343
Opcode Fuzzy Hash: b21d218b3ef0a448ddd0c53cf68ece70df9b2a841861a98581e4eb110f15e8f9
Instruction Fuzzy Hash: 154108747142108FCB096B38E51E23D3EE7EB89312B20446AED07C7392DF39AD468B56

Function 076E55B3 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fc83e21925c09446bd307809a4adeaa6a710339bb3ec6f0ad39d987bf608679
Instruction ID: 81e294005f308ee78ca6eb62b24a802c974a29b1c48d87377d2fb3646fc8c688
Opcode Fuzzy Hash: 5fc83e21925c09446bd307809a4adeaa6a710339bb3ec6f0ad39d987bf608679
Instruction Fuzzy Hash: 4D4108747201108FCB096B38E55E23D3EA7EB89716B20442AFD07C7392DF39AD468B56

Function 0A705A81 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 573212f5bb99d2cf46a8d0e2a14dbadb81cd5ac26157286ccc85ca2636b490d4
Instruction ID: 4d9cf22f9ace2903d7041f495a2638d556d72a0a9c91b58d7e112e4a85dbd005
Opcode Fuzzy Hash: 573212f5bb99d2cf46a8d0e2a14dbadb81cd5ac26157286ccc85ca2636b490d4
Instruction Fuzzy Hash: AE41B075608240DFC721CF68C998B6ABFF2FB49314F14C0AAD5068B6D2CB75A849CF10

Function 0A707548 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f839ae7ce790c39c2e1fb07744fe0be28bb7563b0c16db1e098578323a1426bb
Instruction ID: 84c327d505e17f8a415fe96e7d8b592681858115735773fa985bf4d2ae96a1c1
Opcode Fuzzy Hash: f839ae7ce790c39c2e1fb07744fe0be28bb7563b0c16db1e098578323a1426bb
Instruction Fuzzy Hash: 8A416C30A04901DFDB68CB28D554FAA7BE2EB88300F15C179D516CB2D6E738E94ACB15

Function 076EC638 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c564c4584a97463917f4ce27ad4267127a8f7a7fe552babe4f7d7f43512a2d7
Instruction ID: f084ceb8ba99f0bb8e809232a4fde710f68d38d205cedb3246e7ed1bc54abb9a
Opcode Fuzzy Hash: 5c564c4584a97463917f4ce27ad4267127a8f7a7fe552babe4f7d7f43512a2d7
Instruction Fuzzy Hash: A84159B5B01309DFDB14DF68D854BAAB7F6EB88714F14C429E806AB340DB75E841CB60

Function 076EB483 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b93a6115da44390da6b8c34aebc44712661273305184503d74dc588d17f97d8
Instruction ID: e4fef87b9a39740a5f4b775ca5db389d56fb23ca30ca55c6c4c765953405f11b
Opcode Fuzzy Hash: 6b93a6115da44390da6b8c34aebc44712661273305184503d74dc588d17f97d8
Instruction Fuzzy Hash: FF3149763052016FDB155F69E8409EF7F66EFC9220B14403AE909CB351CE768C0587E1

Function 0A70001F Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad8dd3f8f4e3de77e7396dca09b115fdd92e6fd43fcf766f65982514a12aca41
Instruction ID: f326eb1b44781d1fafd580554edbadaf591f729ec103cce59a78c6ad34a9af5c
Opcode Fuzzy Hash: ad8dd3f8f4e3de77e7396dca09b115fdd92e6fd43fcf766f65982514a12aca41
Instruction Fuzzy Hash: B2411270D04389DFDB11CFA9C894ADEBFF0BF09310F14806AE449AB250DB75994ACB91

Function 076EC7C8 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4af1ac6485e4b065482abbbbd27755b16bd95cdf510a5b2c2fea06125e8bf95
Instruction ID: 4b428b2686f475967b71be33c5dfc0f0a3c8db5f26af427a00291cb3dd02cf7f
Opcode Fuzzy Hash: b4af1ac6485e4b065482abbbbd27755b16bd95cdf510a5b2c2fea06125e8bf95
Instruction Fuzzy Hash: 5E4177B5A012168FDB15CFA5CA44ABFBBB5FF88310F00802AE806E7391D735D945CBA0

Function 0A705AB0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bfd02326981bea8458eea7e127caf6107bf022a70425d710c16c4f43003d251
Instruction ID: 179b254379a7b99e5c9b5fc8573f1bcf2705eff9db2ebfb19d8851d6f3f5727b
Opcode Fuzzy Hash: 2bfd02326981bea8458eea7e127caf6107bf022a70425d710c16c4f43003d251
Instruction Fuzzy Hash: 1A416B75604200DFD720CF69C588B5BBBF2EB88325F24C169E5158B6D1CB75AC85CF00

Function 0A7050D4 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf97d58c8c040253b25c3dc10049f9b583c7ed093a167287c2603bb69f569092
Instruction ID: 9c898d10f3ea4295e34a427b3500fd0a6d5d313a063926cad6fe6ab33c4f0ad9
Opcode Fuzzy Hash: bf97d58c8c040253b25c3dc10049f9b583c7ed093a167287c2603bb69f569092
Instruction Fuzzy Hash: EE415D30A00209DBCB05EBA4E558AADBBB2FF84301F54C568D542A7394DF746C8ACF59

Function 0A704ECE Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e687188f09063114a6d03703087cf09c405bd7a9765210dfdeac127cb451569
Instruction ID: 2750c49498bf0e08b979d02873b60c09523f4ebf7b942046bdbabc7db2750aad
Opcode Fuzzy Hash: 8e687188f09063114a6d03703087cf09c405bd7a9765210dfdeac127cb451569
Instruction Fuzzy Hash: B4413D30A00209DFDB15DF94E588BADBBB2FF84311F14C664E6516B294DB74A88ACF49

Function 0A704E42 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37b04542242ec16b6e69a9568de64685accb50d177da07a356c5df3491c47c4f
Instruction ID: 826681fa88e1d846d38526186c91f83c98d2a6ee063d9ddd5f5a6ab58445a31e
Opcode Fuzzy Hash: 37b04542242ec16b6e69a9568de64685accb50d177da07a356c5df3491c47c4f
Instruction Fuzzy Hash: B2313930A00209DBCB05EBA4E598AADBBB2FF84301F54C568D542A7394DF746D8ACF59

Function 076EB5E9 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99857f4f8153ae2ccbc30d50d36912e7d24cc19182829cd5881dc52c080e8fd0
Instruction ID: 53e6ae813ad77fa1d6b800ad6d5df754f2ebff4d359b6c6717cd5392955133e5
Opcode Fuzzy Hash: 99857f4f8153ae2ccbc30d50d36912e7d24cc19182829cd5881dc52c080e8fd0
Instruction Fuzzy Hash: DE31A2F1201B418FD731CF3AD484B56BBF5AF84310F148A2DD49B87AA0DB74E8458B61

Function 0A700040 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cffc26fc0c8f8c6405faba27a2489778bc7de0aa47c891edf8ffb0afdaee0ba7
Instruction ID: 5d4aa3d8eec40e8287dbca185ac32f05024511129f3075e10137cd25526bfc63
Opcode Fuzzy Hash: cffc26fc0c8f8c6405faba27a2489778bc7de0aa47c891edf8ffb0afdaee0ba7
Instruction Fuzzy Hash: 5141DEB5D00349DFDB10CF99C884ADEBBF5BF48310F148029E819AB254DB75A94ACB90

Function 0A704DEB Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b69be6452f9bce96a04685b38da910ca66a32a6db1c60071ffd752f710ee6fbc
Instruction ID: a107c1ab8b420252609882e63e6228c2a805c03d5f881b09fcd8673b3578ee89
Opcode Fuzzy Hash: b69be6452f9bce96a04685b38da910ca66a32a6db1c60071ffd752f710ee6fbc
Instruction Fuzzy Hash: 22317A30E00209DBCB05EFA4E498AAEFBB6FF85300F04C568E941A7394DB74984ACB45

Function 076EF020 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b95fc0bb62789c85ec097d5eb6ae4bfdd9c9520434bb22580a648901c58da8be
Instruction ID: cdeff9f7a49843e72bb09614ff54a7d3463c10f6b6de4bd82ead613dc7f3b957
Opcode Fuzzy Hash: b95fc0bb62789c85ec097d5eb6ae4bfdd9c9520434bb22580a648901c58da8be
Instruction Fuzzy Hash: 32319E70701709DFD726AF34C8545AEBBBAEF85210B14496DE8538B361CB36EC46CBA1

Function 0A704DF8 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18596ba8291e82395dcd04a708ba38cb5b70fedc22d62b510b34142e4873a297
Instruction ID: d31ac0da8456a6a7009f6d61f4a60b6284da9cb24aeb82296317ced70735d1e0
Opcode Fuzzy Hash: 18596ba8291e82395dcd04a708ba38cb5b70fedc22d62b510b34142e4873a297
Instruction Fuzzy Hash: 1F313830A10209DBCB15EFA4E898AAEFBB6FF85300F14C528E941A7394DA746849CB55

Function 0A704FA5 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1210ada5fef0f33f7ceaca1069580e0be1b19e6a3a647917a151750017ade359
Instruction ID: 73295f3fa94e080e4fa66e9dddef5af39652070406984273d4b9fa2ce9c5ec0e
Opcode Fuzzy Hash: 1210ada5fef0f33f7ceaca1069580e0be1b19e6a3a647917a151750017ade359
Instruction Fuzzy Hash: 35313D30A00209DBCB05EBA4E558AADBBB2FF84301F54C558D542A7394DF746889CF55

Function 0A704FE5 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b2fc434f9658c0e92c1c4499aee7fe9a8d89ae1705593c348c13c7d1e972e4f
Instruction ID: cd6a0fda3862b2edce2d27075b95b156c188462fe2b0984045f04d350e66d747
Opcode Fuzzy Hash: 7b2fc434f9658c0e92c1c4499aee7fe9a8d89ae1705593c348c13c7d1e972e4f
Instruction Fuzzy Hash: 03313C30A00209DFCB15DFA4E588BADFBB2FF44305F54C564D641AB294DB74A889CF45

Function 0A7051C8 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 880b291759d1be21d780aee816f7b57e2cb89f6974a107ee87e625b5b8edc9d0
Instruction ID: c6e3159b41f5c15fa5d3b1730983002601e7500f98d78e143dc8fb3ef8010557
Opcode Fuzzy Hash: 880b291759d1be21d780aee816f7b57e2cb89f6974a107ee87e625b5b8edc9d0
Instruction Fuzzy Hash: 03318A30E00209DFCB05EFA4E588BADBBB2FF84304F54C664E641A7294DB74988ACF55

Function 0A705126 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2df2d0520462591a66fc04e6bfb7a7f721908359185dd88b15a1f148def260b
Instruction ID: fe9de63f5135580c046b8bee46de634566c83d89779b47f2f6523f9a7be3da83
Opcode Fuzzy Hash: d2df2d0520462591a66fc04e6bfb7a7f721908359185dd88b15a1f148def260b
Instruction Fuzzy Hash: 1D315B30A00209DFCB15DFA4E588BADBBB2FF44305F54C564E541AB394DB74A88ACF45

Function 076EA1A0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd5da0a1b9184e769b99090e2cd0a7b19e49caef9b1790d8c1181aa7a23cb8a2
Instruction ID: a4d7e1e4d5c50e7d0c7ef27825ed60f8a9f4134c4e4ca2c3b57a7315b9bb2962
Opcode Fuzzy Hash: cd5da0a1b9184e769b99090e2cd0a7b19e49caef9b1790d8c1181aa7a23cb8a2
Instruction Fuzzy Hash: 3431EDB0A05105CFDB05CFA8E6097B973B7FB88301F18C169D502BB795CB7A9885CB64

Function 0A7050F2 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1166b082a25b6a6f38a6bd46f0a9a0d6b6d60c913fe95309ace1a09a568fb61e
Instruction ID: a798dac3628dca04baf620bb393aa3fea64f9d0c03158055484c49e3af33db59
Opcode Fuzzy Hash: 1166b082a25b6a6f38a6bd46f0a9a0d6b6d60c913fe95309ace1a09a568fb61e
Instruction Fuzzy Hash: DF315930A00209DFCB05DFA4E588AADBBB2FF84304F14C564E541A7294DB34988ACF55

Function 0A70517C Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bcc85e3fd5bad4c377b2b3038eae813151fd27ba2a2dfda5f9bc001107acd6d
Instruction ID: ed207421075075a71e2b7293ddb23551adba2a124a84527876f80ff224503751
Opcode Fuzzy Hash: 6bcc85e3fd5bad4c377b2b3038eae813151fd27ba2a2dfda5f9bc001107acd6d
Instruction Fuzzy Hash: D8312A30A00209DFCB05DFA4E588AADBBB6FF84305F54C564E541A7294DB74A88ACF55

Function 076EEAE1 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c77d48e836fed59e1b20562fac941a9d0d683a9f39bf76307fdfefb3a90d4e58
Instruction ID: fcb5ed90cd8996efb9a397591b9c28efe7b0dd5ce67d812d60d1487bbc6bc5cd
Opcode Fuzzy Hash: c77d48e836fed59e1b20562fac941a9d0d683a9f39bf76307fdfefb3a90d4e58
Instruction Fuzzy Hash: C1219CB1E1120ACFEB10DEB4DA447EEBBB8AF05350F048266D497D7291E335CA41CBA1

Function 076EE9F8 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 909bcaa4cc623a50b3c09535ba96dcf7a7613c26e4834579453403145e8321e0
Instruction ID: 27fd7c086d47ea81d461855917651defbbbe9bef6f77be43adc2345e4d5b10b8
Opcode Fuzzy Hash: 909bcaa4cc623a50b3c09535ba96dcf7a7613c26e4834579453403145e8321e0
Instruction Fuzzy Hash: 6421802190D3D45FCB039B7488755E9BFB0AF43204B1944DBD9C99B5A3C9395D09CB62

Function 076EA1B0 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f501e8fcb5cb8b228901953cd5389c583329313e6810efe44757b5d9e629f1ac
Instruction ID: 30d0676ca74435f93727f71c52e83330d1885a2075751e585fca40a8673a8a74
Opcode Fuzzy Hash: f501e8fcb5cb8b228901953cd5389c583329313e6810efe44757b5d9e629f1ac
Instruction Fuzzy Hash: 55318FB0A05109CFDB04CFA8D949BB973B7FB88301F18C069D506BB795CB7A9885CB64

Function 0A707648 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6c7e063db0811db6193a2ae7da5e04d2f53c2b67820ee2be4fa63432e71ab95
Instruction ID: 731e6db7b2305631db1436fa5885c99a24bfb703611da28e84949f4e5b46abf4
Opcode Fuzzy Hash: f6c7e063db0811db6193a2ae7da5e04d2f53c2b67820ee2be4fa63432e71ab95
Instruction Fuzzy Hash: 03313A30A08901DFDB28CB19D658FAA7BE2EB84304F09C165D516CB6D1EB34F889CF19

Function 0A7076EF Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b1533770a29c84dc5a109af027d5e095116f82f678ed018db972ce185b490e8
Instruction ID: 191e4207eb4354f707d0914e59c64cb2ab1dd3d130d7295aea36f1bb50f1aa29
Opcode Fuzzy Hash: 5b1533770a29c84dc5a109af027d5e095116f82f678ed018db972ce185b490e8
Instruction Fuzzy Hash: 30312930A08901DFDB68CB19D658FAA7BE2EB84304F09C165D516DB6D1EB34F889CF19

Function 0A704E9C Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 195d7fe0e856c0999ae45a0f69b9a0faac1e0d734a81dcf5c65736c9cb92810c
Instruction ID: 87cc4554a8427745907df728c1bd234c750f652567392f030afef4bbe8e3b581
Opcode Fuzzy Hash: 195d7fe0e856c0999ae45a0f69b9a0faac1e0d734a81dcf5c65736c9cb92810c
Instruction Fuzzy Hash: 64313A30A00209DFCB15DFA4E588AADFBB2FF84311F14C664E551A73A4DB74A88ACF55

Function 076E5B08 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06a9f4d1320901df10b08358aa3bcab637d14acc57a0fb60f9e8f061d7bf4b39
Instruction ID: 21a355de8c9450883658c7bf7dc394efedf78c57f4771e6fda52c470cc4f072c
Opcode Fuzzy Hash: 06a9f4d1320901df10b08358aa3bcab637d14acc57a0fb60f9e8f061d7bf4b39
Instruction Fuzzy Hash: ED317EB4A01206CFCB08CF68C954BADBBF5BF48314F144069D407AB3A1DB319955CF60

Function 0A704FB7 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31911072e9b8f149d82b1b62000a7d87f3adbf950d114bfe77aa4e3e1cd60652
Instruction ID: 84fd49bf7520de27ea19f8aba7230c7b34d9bcbd1b933aee188462082e698387
Opcode Fuzzy Hash: 31911072e9b8f149d82b1b62000a7d87f3adbf950d114bfe77aa4e3e1cd60652
Instruction Fuzzy Hash: EF311830A0020DDBDB05EFA4E598AADBBB2FF84301F14C664D541A7298DB74A88ACF55

Function 076EF687 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20e9f7e93ead956fcfec14e499488ceb5d0447bf3eb1fdc0461d0ec95f0ad7d3
Instruction ID: 9ea8b91d43e8c146cc9a0e99f3dc21fd430f06e29b03e0e9b8866e6985ecc4e0
Opcode Fuzzy Hash: 20e9f7e93ead956fcfec14e499488ceb5d0447bf3eb1fdc0461d0ec95f0ad7d3
Instruction Fuzzy Hash: A5218EB13052459FCB01CF2AD844AEA7BEAEF8E210B1540A6F955DB371CA31DC51CB70

Function 0A7051B4 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7774246bdbb4a501a03e7bbf94a4db931edc2b0315717109bea23854e67938a0
Instruction ID: 5f94451fd7fa9d612cdb350da3a694cd9817aeb8036b020e82f1794d51c78801
Opcode Fuzzy Hash: 7774246bdbb4a501a03e7bbf94a4db931edc2b0315717109bea23854e67938a0
Instruction Fuzzy Hash: 76314A30E0020DDBCB15EFA4E598BADBBB2FF84305F14C564E54267294DB74A88ACF55

Function 0A705073 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc57a9641d22d5cf0d93cdbe8436fd8024ea838a27de6b2eb6438f30fd711f41
Instruction ID: efc2bb21c5e16873789b6cee75809b3ec521d8691587db14747e999ec1788d1d
Opcode Fuzzy Hash: cc57a9641d22d5cf0d93cdbe8436fd8024ea838a27de6b2eb6438f30fd711f41
Instruction Fuzzy Hash: A7313830A00209DFCB05EFA4E588AADBBB2FF84301F14C654D541A7298DB74A889CF55

Function 0A705053 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5659b05dc2be307358322cbbdf0426302e37c581c379a7fcafdac16b65e57dc
Instruction ID: bfc0f1f2b205229ed61b971f51c6c161b6d42f62d64160beaf77bdd01d81c3fa
Opcode Fuzzy Hash: f5659b05dc2be307358322cbbdf0426302e37c581c379a7fcafdac16b65e57dc
Instruction Fuzzy Hash: 8F312830A00209DBCB05EFA4E588AADFBB2FF84305F14C564E541A7298DB74588ACF55

Function 0A705214 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b967618d5de114434a45a244a38d7acc74a11acd422d414d6fc11717a10cc1f
Instruction ID: a4a3db447dfb7acfe49e06a32aaa4c44836556dc4b8418efd7f363c079bb3c59
Opcode Fuzzy Hash: 5b967618d5de114434a45a244a38d7acc74a11acd422d414d6fc11717a10cc1f
Instruction Fuzzy Hash: 47312A30A00209DFCB05EFA4E588AADBBB2FF84305F54C664E541A7298DB74A989CF55

Function 0A705033 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a14d283b0f7afb11270b1894941c57fe70340def780112ffccd97f3a774fda2
Instruction ID: e1492793bcae03ca32d0be168ad3a3104e7c54acfc00e3c13ae38880a848d5bf
Opcode Fuzzy Hash: 5a14d283b0f7afb11270b1894941c57fe70340def780112ffccd97f3a774fda2
Instruction Fuzzy Hash: 8A311630A00209DFCB05EFA4E588AADFBB2FF85305F14C664E541A7294DB74A989CF55

Function 076E9F20 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d1f35e44ccfaeeb77a9e36821b02907991215c9f150e75970e1b0d29b163de7
Instruction ID: 5fe868a2570cbe46300fc26670e3643c3c8d1a460a1a838d917f3b0f1ec5212b
Opcode Fuzzy Hash: 6d1f35e44ccfaeeb77a9e36821b02907991215c9f150e75970e1b0d29b163de7
Instruction Fuzzy Hash: 4421E7717083855FE706E7B88C64B6A6BAAAF8A204F1944AEA409DF3D7CD24DC018761

Function 076EB390 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed5f7946274c9ac579a29624af64964f7014117a7990c5af678d103322ae474d
Instruction ID: f486422b959dd993beede60b1d06ab755dcf6894544baaab77996be5f789f520
Opcode Fuzzy Hash: ed5f7946274c9ac579a29624af64964f7014117a7990c5af678d103322ae474d
Instruction Fuzzy Hash: 21217F75A00219DFCF158F68C4549EEBBB6FF8C320F189229E816A73A4DB359845CF90

Function 076EF698 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 639d25823599ceefa926edcb3430a8963297dbe1654f05319cbb6ccf88beaeb1
Instruction ID: 850b4e90ef0d53fcc2204c6875fece103a3ac709d5825e54d7166d3e01f08e11
Opcode Fuzzy Hash: 639d25823599ceefa926edcb3430a8963297dbe1654f05319cbb6ccf88beaeb1
Instruction Fuzzy Hash: FE2168B03011459FCB01CF2AC880AAA7BEAAF8A300B0840A6FC56DB3B0C631DC51CB30

Function 076EA911 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 035904620fa59e24eac061497cc2078846fb30055eb1b691d352538bbdbfae72
Instruction ID: b64320727e31937aace34912bb246f1c049b8ca22390e8a217bfdfacf0e6edd9
Opcode Fuzzy Hash: 035904620fa59e24eac061497cc2078846fb30055eb1b691d352538bbdbfae72
Instruction Fuzzy Hash: 3521C2707013059FDB05EB68D8457AEBBEAEF88304F108528D40BC7B41DFBA990587E2

Function 076EB3A0 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96dece74e3cb58c990eceb2c18c780be54426ab45211d996fa742fd9d81d1dc9
Instruction ID: b8d506b5d8fb4083790126e477e4dc32d541b3dc7311725c30fb62b2dddf9000
Opcode Fuzzy Hash: 96dece74e3cb58c990eceb2c18c780be54426ab45211d996fa742fd9d81d1dc9
Instruction Fuzzy Hash: 32217C75A00218DFCF15CFA8C4489DEBBB6FB8C320F149129E816A73A4DB759845CFA0

Function 076E5D6B Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06d4f643d9f100c6963e248072ad803e7a5cdf0ba99987a450f2baebf2ed0077
Instruction ID: 0bc7ef96735ed8adc0829a9b751e40527570b60bb0bb2f3f0e8887608564cacc
Opcode Fuzzy Hash: 06d4f643d9f100c6963e248072ad803e7a5cdf0ba99987a450f2baebf2ed0077
Instruction Fuzzy Hash: 3421B0B0609101CFD704CB14DD4DBA93BBBFB4930DF188065E1139B6A7CB785896CB28

Function 0A120CAC Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2619846772.000000000A120000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a120000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e10fc80421bbc235383e1794772ce427fafda175f98eb89b03606def26a8616
Instruction ID: 5368a69d5b5b40bdc040df4aacf12128341ef249d4482235ec9b7cdc7f645bbf
Opcode Fuzzy Hash: 4e10fc80421bbc235383e1794772ce427fafda175f98eb89b03606def26a8616
Instruction Fuzzy Hash: AB116F323092515FE3290A598864627FBB9EFCB311B09417BD205CB296CF65CC9587A1

Function 0A703548 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76249b25120f5f5f24305e6e70950cd0e87ac8d510c27b535906ff07d5f5fd46
Instruction ID: 781f9519a455b7e372e0179b3331072b7bea14699833d7391b90eb5e8340eaf3
Opcode Fuzzy Hash: 76249b25120f5f5f24305e6e70950cd0e87ac8d510c27b535906ff07d5f5fd46
Instruction Fuzzy Hash: FB217CB0605104DFD719EBA8D254F6937E2AB4E300F5590A9E107CF6D2DB349C89CB1D

Function 076EA01F Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c4e12b8fc2f44cdba67240b07bb400d73d028f3f84101a06d19fadf9e300c66
Instruction ID: 2f035172fccd66c25224f1e7662a6dc5f9fb5185ab7da3ebc7015e7df041680f
Opcode Fuzzy Hash: 4c4e12b8fc2f44cdba67240b07bb400d73d028f3f84101a06d19fadf9e300c66
Instruction Fuzzy Hash: 9911D3713081018FD344CAA9D844B62B7EBFBC9308F15C06AD10ACB3A6D779EC86CB14

Function 0A707791 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de7d70d681f5254f059247c01937ae0e3bb2c9b91dc38b8b00377cf289069e47
Instruction ID: 4b72fac3e426f8d0e3d5a1a863e1c8adc30d344f5dc7702eb2bbe98a4687d993
Opcode Fuzzy Hash: de7d70d681f5254f059247c01937ae0e3bb2c9b91dc38b8b00377cf289069e47
Instruction Fuzzy Hash: 1611EF30A04641DFCB58DA28C148FAABFF2EB84351F54D1B9C505CB6C2D778A84ACB85

Function 076EBD41 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfc3b4f25aec5d32c33b973b131b00f6a2aae996ca5a108f9232721bded72f51
Instruction ID: ebcf97ce9b5c76917e0d5d1b79f6c40c21318eae9661337715aa704000ae3bde
Opcode Fuzzy Hash: cfc3b4f25aec5d32c33b973b131b00f6a2aae996ca5a108f9232721bded72f51
Instruction Fuzzy Hash: C311A0B57012159FCB659F789841BEA7BF6AF88610F04452AE94ADB380DA75C841CFB0

Function 076EA030 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5ce5eddf331733701adaabb2e92dae3c86b49716aaa3c5deee4790885a1d290
Instruction ID: 87315f92bc0ba07251ad80ebfeb187be623b1ca21af7d3935003b4ed6f9b7d88
Opcode Fuzzy Hash: d5ce5eddf331733701adaabb2e92dae3c86b49716aaa3c5deee4790885a1d290
Instruction Fuzzy Hash: 8E119E713081058FD354CAAAD844B63B3EBFBC9318F25C069E50A8B765DB79AC86CA54

Function 076EBD50 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fc4231732b37fffaab17424bd5ce65011ed36db67b93f1b6e405dc36c0c80d1
Instruction ID: f3be2106771b54b1668d50bdcaa1477d101bff73a249b6d4ead612f73bd7acd1
Opcode Fuzzy Hash: 0fc4231732b37fffaab17424bd5ce65011ed36db67b93f1b6e405dc36c0c80d1
Instruction Fuzzy Hash: F311CEB5B002059FDB65DF789845BAA7BF6AF88300F048029E90BDB380DA74C801CFB0

Function 076EBAC1 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40a0e22fba7a3fd34eb07f8cef3e26971d801cec06862e9c9badda754d23efc8
Instruction ID: 74e3794ddd474da5b2da0f7bac34c2efef0d7f830fe45204b151f2c4842f2886
Opcode Fuzzy Hash: 40a0e22fba7a3fd34eb07f8cef3e26971d801cec06862e9c9badda754d23efc8
Instruction Fuzzy Hash: B72150B8A02219AFDB04CF68D594EADB7F2BF49700F144158E806AB365CB34AD45CB64

Function 076EB993 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cc61a7b52ee69a4a7421150b41a7f1b675f4b024cc81ca2dccc3193b653f332
Instruction ID: 94c5f5fc6ab1d0090abf27c61aeec1bb2f0548b364f379542dee08850cdbb903
Opcode Fuzzy Hash: 5cc61a7b52ee69a4a7421150b41a7f1b675f4b024cc81ca2dccc3193b653f332
Instruction Fuzzy Hash: 46018475344355AFDB128E19EC95FAA7BA9EF89720F10406BFA05CB291C671DC108B50

Function 076E5F78 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cebd7377d46b61081338a9b9dda8b016140cb0c4439deb6d097a852eea41f74e
Instruction ID: 0340a2d4e689135c547fdf8f256924a85bbc20481d4248f5193198e1d5068c03
Opcode Fuzzy Hash: cebd7377d46b61081338a9b9dda8b016140cb0c4439deb6d097a852eea41f74e
Instruction Fuzzy Hash: CC01F972215216CFC311DBB8D900B25B7AEEB85729B294066E907CB253CB30DC51CF76

Function 0A705DB7 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4891723b5852eeeb9bff09a43ca04857bd1b27150f6d09f56546e56c1040da43
Instruction ID: 193b783144381a0d6cf10870172d7bc4b0643cb635bcda5fa47c2ec04aeda2d3
Opcode Fuzzy Hash: 4891723b5852eeeb9bff09a43ca04857bd1b27150f6d09f56546e56c1040da43
Instruction Fuzzy Hash: F811CE35604204DBCB158F68C9186AEBFE6EF88701F14806DE806AB381CF718C068F91

Function 0A12005C Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2619846772.000000000A120000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a120000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1644c666be6255f2b058e0bfb32e2b3be54929e967c1812aac26f3f762857e7
Instruction ID: 7e401e63579d47d28b4291357e688dad61c12385b8235904ae7e3e38beb7c185
Opcode Fuzzy Hash: b1644c666be6255f2b058e0bfb32e2b3be54929e967c1812aac26f3f762857e7
Instruction Fuzzy Hash: 2F01FC3970D2A0CFE72B166498644B93F71ABCB66171902F6C8C6CB251CB25CC56CF56

Function 0A7077A0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55b573fa1bff6732a4361db9a5dfb85741c1043c1f6d8dc8120c5cf0ba388edb
Instruction ID: efcfce6d107a8113e46efd3db9df1429ec36ad3b3c3ea1819c0ec4fa752d4609
Opcode Fuzzy Hash: 55b573fa1bff6732a4361db9a5dfb85741c1043c1f6d8dc8120c5cf0ba388edb
Instruction Fuzzy Hash: BB116D30A04605CFCB58DB28C144BAABBF2EB84354F54D1B9C919C7681DB74AD8ACF85

Function 0A704CC8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db55785757bfba5d8fa7582d0c0881ac91e85dc34244e65525bfc055f9326d6e
Instruction ID: 9a5fb8da463a197d42e983cb6bbef92a1a79527b5327a089f3d8dd2717a14da2
Opcode Fuzzy Hash: db55785757bfba5d8fa7582d0c0881ac91e85dc34244e65525bfc055f9326d6e
Instruction Fuzzy Hash: 6B01D671B063A19FDB163778541822E3BD25F8962172848FED882CB382DE3AC957D384

Function 0A704CD8 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c0af874a8afb779c0bf6914191a4a0e275ce4e02961056536c386b7328aaa5d
Instruction ID: b7cad854c01700662526b494a829a6fc987127d6c966078f70ae0bf2da10af2a
Opcode Fuzzy Hash: 0c0af874a8afb779c0bf6914191a4a0e275ce4e02961056536c386b7328aaa5d
Instruction Fuzzy Hash: 86F0A430B023619FDB153738441866E3AD65FC9621B2448BDD5428B381DE3AC857C394

Function 0A705DC8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1035fddec56467c2871269ba245cfc4bdb513094a91643b89f8bc50d26ceaeb
Instruction ID: 18db4219c0ea6e4c8a3f4adfab05e6ba987289ee4b0ff2bec6e939e2e8129671
Opcode Fuzzy Hash: a1035fddec56467c2871269ba245cfc4bdb513094a91643b89f8bc50d26ceaeb
Instruction Fuzzy Hash: 9F017136600208EBCB255F64D918AAEBFF6EF8C711F108469E902A7380CF759D05CF91

Function 076907F0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618653293.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7690000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fc327aff7471ef79209c51132f45d3be99fc722a98d14215af47961bb57a964
Instruction ID: ac854c845f0b6a20676b1e180bd66ea39263a1b7824ec82a79a3066502fea7d9
Opcode Fuzzy Hash: 1fc327aff7471ef79209c51132f45d3be99fc722a98d14215af47961bb57a964
Instruction Fuzzy Hash: C1F0F476A042169FDF519F76980569AFBACDF86210F09C0BAD81BE3202E73489129BD1

Function 0A703E51 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80b8c636a34df6574c38e225c5582b01f7a0f1e5d8f1c500dc6684fb9587734a
Instruction ID: 1c6fc5b137da23964949d4c81a560898ca01bbe72e2abb72b51204bdb890f62a
Opcode Fuzzy Hash: 80b8c636a34df6574c38e225c5582b01f7a0f1e5d8f1c500dc6684fb9587734a
Instruction Fuzzy Hash: 6AF0F036B001188FCF00DAB8E858ADDBBE2EF88315F50456AD205EB752DB349C04CBD1

Function 076E2C5A Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c97723e46929ba28139c47c248195ca320d808ca9861f336194910da1d745e10
Instruction ID: 96a8ba8f03090ee57ff54c429d3e852c7c4bd667d41bdac68aab7eb10ae9bbb9
Opcode Fuzzy Hash: c97723e46929ba28139c47c248195ca320d808ca9861f336194910da1d745e10
Instruction Fuzzy Hash: B411DB75A01219CFDB04DF64D484AADB7B5BF4A240F1140B9DA16AB360DB319D41CF91

Function 076EADCB Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d50c26808ac7b9ec782745d135d431eaade22ef1e3d55a16a54af4c5d2835c3e
Instruction ID: 901bfd6d9ce4b0062f7a3d368c6e541c86f94eb55729ae8d6a1939dae76698b4
Opcode Fuzzy Hash: d50c26808ac7b9ec782745d135d431eaade22ef1e3d55a16a54af4c5d2835c3e
Instruction Fuzzy Hash: F5F05075B052115FF7154668984477BF3A9EBC9310F14806DD406DB380CB71DC818790

Function 076EAE28 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fd9d8cacb7121540853482a92dd6b9efd415187e786921d3ed17cc279592c81
Instruction ID: 4d6955c26dda99abac770d71e99304f74eb581a231de2e1685420abe6be5514e
Opcode Fuzzy Hash: 2fd9d8cacb7121540853482a92dd6b9efd415187e786921d3ed17cc279592c81
Instruction Fuzzy Hash: 14F024F6B0E2815FE31306B458103367BA59FC7205F18C4DAC0838F2D2D9468842C361

Function 076EEA80 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92ba4204feb0680f79fb182ae137b1c39d4994c89bc5b8ce384c499c5026f674
Instruction ID: c96179664e61d42cf22191bf26bcdcc7c3eb7001661f842744d350982dd5fe40
Opcode Fuzzy Hash: 92ba4204feb0680f79fb182ae137b1c39d4994c89bc5b8ce384c499c5026f674
Instruction Fuzzy Hash: E6F0F22241E3E00FCB0387200CB24F2BF709E6311430E55D7E9CA8A4A3C42C0D19C3A7

Function 076E1889 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2e20012ed3342e74a08484a31fe60cd766dbf3470215d166c44684eb4b3531c
Instruction ID: cd5daa7dad313b171932d731600b7c4803e4c286d0712bbcab1241fdead7542e
Opcode Fuzzy Hash: e2e20012ed3342e74a08484a31fe60cd766dbf3470215d166c44684eb4b3531c
Instruction Fuzzy Hash: CEF027B13003181BD30866B99C6476B9B5EAFC6240F28806FD009DF296CC31CC0103B2

Function 076ED193 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc877050dc6037baf433fea41b92d0a02e3c18e6b53309fc72cdd52990956788
Instruction ID: 492bac9c95a60074ff3aa203c3d05afa750cbfab80504e60a7ed6b0d92bde631
Opcode Fuzzy Hash: bc877050dc6037baf433fea41b92d0a02e3c18e6b53309fc72cdd52990956788
Instruction Fuzzy Hash: DBF0E972B05214AFC70BCBB4D8582EEBFB69F81120F048196D406C7251CB340A84C790

Function 07690800 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618653293.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7690000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 386f98e4b4c7c8368fe71f57909b1a17d3533de43bc6c5c4b5845929acd6ff8e
Instruction ID: fe63922ca007b47e3373329103bfe355dd504758ee3d788790a993abd96d72ff
Opcode Fuzzy Hash: 386f98e4b4c7c8368fe71f57909b1a17d3533de43bc6c5c4b5845929acd6ff8e
Instruction Fuzzy Hash: F6F0BEB6F0412A9BDF54CEAA980469EFBADDF85220F05C07ADC1BE3200D73889025AC0

Function 0A704020 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e54bedc251f8c8dd274e7c1b785df6381f0d8b313e8478164ed913593615074b
Instruction ID: bb9253b7a2bde447ed4b57f324a45944c22afec8d764ba881fa71006f183724f
Opcode Fuzzy Hash: e54bedc251f8c8dd274e7c1b785df6381f0d8b313e8478164ed913593615074b
Instruction Fuzzy Hash: 11F0BE36B05245CFDF10EB78D5146EEB7A19B44315F4088B9C601972C2DB354916DF80

Function 0A703E60 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e646a311462a398dfd8636fe46b47be451259fa40f246326e7ceab54cf3bc5af
Instruction ID: 14cfcc5012142d2d825d16781c3df6744301d505851d719f48c2b4c4025adf4f
Opcode Fuzzy Hash: e646a311462a398dfd8636fe46b47be451259fa40f246326e7ceab54cf3bc5af
Instruction Fuzzy Hash: 20F05831B001189FCB00EAACD858ADE7BE6EF89705F500569D105EB7A0DB35A8058BA6

Function 076E91E7 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4b35115acd2aafd56d9e7a4de4679bece02ff865e558697834aaea09410fab0
Instruction ID: 7d6c7c48685d7d0fee8b283dabda3394fa937792af2c292116092bb00bd23d7c
Opcode Fuzzy Hash: f4b35115acd2aafd56d9e7a4de4679bece02ff865e558697834aaea09410fab0
Instruction Fuzzy Hash: 22F06DB4B011108FD744AB78D158B7C3BEAEF89350B4940B9E90BDB391DE349C028B76

Function 076E1898 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8783e6a7b5377e8d54aaee93838f10f1ab32bdad82ffa744d11aa997adba224
Instruction ID: ed125d291a6487539beb1fd3d92b5f42940a28dc565c8a209c0ed77178522f89
Opcode Fuzzy Hash: c8783e6a7b5377e8d54aaee93838f10f1ab32bdad82ffa744d11aa997adba224
Instruction Fuzzy Hash: 50E0127134032C67E70865AA6858B6B969EEBC5650F15C42EA509DB395CC75CC0112E2

Function 076E5F77 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36821164af93ffb7fef2713ffb8d59f36f21a7c4416929f58ab13ef66e134756
Instruction ID: 0ab5aeb5f27c16efd777b7253aea910419d7dc36086e206a4415cc5a3c912887
Opcode Fuzzy Hash: 36821164af93ffb7fef2713ffb8d59f36f21a7c4416929f58ab13ef66e134756
Instruction Fuzzy Hash: 79F05EB1606115CFC7209BB8DA44B3577ADEB84629F5E4066D90797242CB30E8518F72

Function 076908F5 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618653293.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7690000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dd0b666ec2c3f0631dec201f2d4d8b26404ff48bb25c184b784f0ba09bcb89c
Instruction ID: bf51ed8c1c2bfc559576c4e93a95de3f28235be39922b7334ccfdace1dfd19b6
Opcode Fuzzy Hash: 7dd0b666ec2c3f0631dec201f2d4d8b26404ff48bb25c184b784f0ba09bcb89c
Instruction Fuzzy Hash: 57F0E2F6A19263DEDF591B294A001A8BBF8EF07200F040675CC6793242EB20E8178A96

Function 0A704030 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80ac966cb341ba2af3edfdb8b9246d6918255b05c4825fda0792ad6b0fdb6954
Instruction ID: 74aee04722cbc2c86485f17c3646b51f2e5f34d5fb1959587f8101cdadffad4d
Opcode Fuzzy Hash: 80ac966cb341ba2af3edfdb8b9246d6918255b05c4825fda0792ad6b0fdb6954
Instruction Fuzzy Hash: 21F03030F04249CBDF14EB78C418AAEB3E5AB44315F4088B8C6019B2C1DB35551ACF91

Function 0A702CE8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3650e3eecc3b3afaa947a1ab7887c05fbf3c3fdf36835b156bafa4d5123927b9
Instruction ID: 5b32f1b7ef0b1a886d0b022fb00fbeadd9aff63f187a9afd7512576f22a1b429
Opcode Fuzzy Hash: 3650e3eecc3b3afaa947a1ab7887c05fbf3c3fdf36835b156bafa4d5123927b9
Instruction Fuzzy Hash: 92E09237D04205CFDF00DA54DA097EEFBB0EB04719F008922DA04A3602D738191E9FC1

Function 0A704D99 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b78f77a52a469047008a43dff8536c42ddfaf7a8b6f80980831614bb305f7c64
Instruction ID: 462d4435c1f08ca09f782d2e1ec68923d146a41b42ee0e40945de3c6d710b1eb
Opcode Fuzzy Hash: b78f77a52a469047008a43dff8536c42ddfaf7a8b6f80980831614bb305f7c64
Instruction Fuzzy Hash: B7E0D8312092A08FDB16A77CA618BE67FE59FC6301B1544BAD208CB691CB348C1AC795

Function 076ED1A0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06e230c7bac41f3cd03717490f2c434bc238be2e6f4517cd882908ce87980dd0
Instruction ID: 761da870ea779f6d1388348e0696b928e8247943b686432ae1eb37142f215f67
Opcode Fuzzy Hash: 06e230c7bac41f3cd03717490f2c434bc238be2e6f4517cd882908ce87980dd0
Instruction Fuzzy Hash: 39F06D75B05218AFCB0ADFA8D4486EDBFBAEB84211F1480A9D40B97390DB741A85CB94

Function 076936A0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618653293.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7690000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ce4c6307ce7871d98581fdf404e6300e53bd24d694a0ff1d8d2e6d3e3dc6346
Instruction ID: 29b0b83e2ac7b4cc6367241b56d4b92be5b83cd69a1d1d395dd0b43a84d018fe
Opcode Fuzzy Hash: 7ce4c6307ce7871d98581fdf404e6300e53bd24d694a0ff1d8d2e6d3e3dc6346
Instruction Fuzzy Hash: 56F07478A00629CFCB55DF24D584A98B7B5BF09350F1500E9D90AA73A1C734AE81CF45

Function 076EA89F Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86eb0ab61fc14819d9f190b78fe14b9193d235e36c05f261beaada755d610573
Instruction ID: 42c5368b4753f0259a34fcd04092aff48f48919effa8496848ba615059900be3
Opcode Fuzzy Hash: 86eb0ab61fc14819d9f190b78fe14b9193d235e36c05f261beaada755d610573
Instruction Fuzzy Hash: CDE09270A0630DFFD704DBB0ED916AABBF9EB46204F104599D405DB642EA356E009B92

Function 0A7052B8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c90f2662c175f33008d37a9f8d59aec6dceb22c5dc208f03e62bbed9796b4904
Instruction ID: 04e62128eac8f40eec77b4ed95de0bdd1ada7b0b11a4f2d04d22cdf0ebefe8e2
Opcode Fuzzy Hash: c90f2662c175f33008d37a9f8d59aec6dceb22c5dc208f03e62bbed9796b4904
Instruction Fuzzy Hash: 2FE09A30A08104CFEB60DA49E848BA8BBE3FFC8325F04C075D21486586EB7018998F08

Function 076E1FDD Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80418dd190148e6345f5aa17301ffbfadf50be068bc9432096054df5c4ed0111
Instruction ID: 411c8ac41bb2ff960dc54b1cd97a426a90c8fadb640df4aeb2f4eda28fdf64a2
Opcode Fuzzy Hash: 80418dd190148e6345f5aa17301ffbfadf50be068bc9432096054df5c4ed0111
Instruction Fuzzy Hash: 39F01CB4B01215CFCB189B24C44065CB3A5BB0A240F0504F8C906A7360DB35DC418FA1

Function 076E5CB8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db7905d84da10508b70ae75726ebcc5ad407b672e3bd89c3590ec523c56974d0
Instruction ID: 9f9c0c38d665ba97f4b9db80db5363bfba74fdcb34795349cce57486d77ebc4c
Opcode Fuzzy Hash: db7905d84da10508b70ae75726ebcc5ad407b672e3bd89c3590ec523c56974d0
Instruction Fuzzy Hash: 7AE086B5505346DFD715CBB4EA514A9BFB8FF4625471110FBC401C71A2FB319A54CB21

Function 0A704DA8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb70ce42593020e1160ef5e15f66467bbe1a0ffe2541b4a08d0875a2437b7d2e
Instruction ID: 029da8cb3b9e89a18c8a59807e250a5b6fd36834e18fbbabf8bc78115639bcb2
Opcode Fuzzy Hash: fb70ce42593020e1160ef5e15f66467bbe1a0ffe2541b4a08d0875a2437b7d2e
Instruction Fuzzy Hash: DCE0C2312042188BCA15A769DA08B9A37DAABC4210F01403AD2088B640CF74DC05C7D4

Function 076E5CC8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88e9a23e42c6e40213d880ed316610a03fa78f701b0f3ca9f8f34ddf43db0186
Instruction ID: 7b34845e57f8591618d2999fc234a531c64f03b7b21407c10a2df583b7bf348f
Opcode Fuzzy Hash: 88e9a23e42c6e40213d880ed316610a03fa78f701b0f3ca9f8f34ddf43db0186
Instruction Fuzzy Hash: 17D0127150120CABC710DEB4DD015BAB7ACDB05115B1005E99C09C3200FE329A10DAA1

Function 076EA863 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 515332c35b3c7416e097974b44a441ca5a10fae46c6adda69b29db67472f52cd
Instruction ID: 55dfd5a226ce60e9ff6291dac9f35b7f5ef7796487ce894a52e82fafbce91515
Opcode Fuzzy Hash: 515332c35b3c7416e097974b44a441ca5a10fae46c6adda69b29db67472f52cd
Instruction Fuzzy Hash: AAE08C71A01208EFCB00EFA8E5056DD77F5EB44214F104599D809D3701DA316F809BA2

Function 0A702CF8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8baff897620cc5ae7a6a04980836b43630702dcec902fbf07021119c7a361a9
Instruction ID: 217b9c8082809115a371b5d526e7dff818dd93546f7b169c819e930ce62becba
Opcode Fuzzy Hash: f8baff897620cc5ae7a6a04980836b43630702dcec902fbf07021119c7a361a9
Instruction Fuzzy Hash: 05E08C32D04249DFDF00EA99C508BEEB7F4EB44305F008475D61493242E738691A8F86

Function 076E2CA1 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ff0643822eabfda120198b73af5ceb89fbc4b29979a045f8391bf73b5b2b0e9
Instruction ID: 94b31f4f9a2d454a5f018d2bd19673cf0545afa1f75e784c5e7048321fa69b2f
Opcode Fuzzy Hash: 9ff0643822eabfda120198b73af5ceb89fbc4b29979a045f8391bf73b5b2b0e9
Instruction Fuzzy Hash: 22E09A70A00218DFEB248F50CC41F68B374BF0A780F1040E4EA0AAB3A0CB34AD419FA5

Function 076EA8B0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04fff02bb337a2f88ec49cfcb9f1096ea766528c17b4ee7a81b5f1058e947de1
Instruction ID: 83e94ce8860306e4051cbe6fe21e7c02641b04fc337067ecbf1e2e1f3459857e
Opcode Fuzzy Hash: 04fff02bb337a2f88ec49cfcb9f1096ea766528c17b4ee7a81b5f1058e947de1
Instruction Fuzzy Hash: 95E01270A0230CFFDB00EFB5ED517AD77B5EB45204F109598D905D7340E9716E00AB91

Function 07690925 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618653293.0000000007690000.00000040.00000800.00020000.00000000.sdmp, Offset: 07690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7690000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87f5ea95536789f3226a303439f672f334398c03701e4720e6ed07e18736f7d4
Instruction ID: 9f7aa9f3b9d111c0e520f851446eea6e542027fb4ea15166be3c92045eb08286
Opcode Fuzzy Hash: 87f5ea95536789f3226a303439f672f334398c03701e4720e6ed07e18736f7d4
Instruction Fuzzy Hash: F2E08CB6B14127CBDF486B648A4027CB3BCEF06340F181535CC17A3204EB30D8038E82

Function 076EA868 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8c8e97479b00e14fffa7a788f46dcc9ccb18b4c35269cdb2543e1800222df37
Instruction ID: 732b5b31c6dc985be3ae79e52799c4e22e5af4e3394325c4c10b9252b6f7a493
Opcode Fuzzy Hash: c8c8e97479b00e14fffa7a788f46dcc9ccb18b4c35269cdb2543e1800222df37
Instruction Fuzzy Hash: 98E01270A0120CEFDB00EFA8E50469D77F5EB44214F1045999909D3301DA715E509BA2

Function 0A705D8B Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6180d179b7a430157411a1364f8ec01e67fad3a7569fe6cf756d0a7fda425a4d
Instruction ID: c63913f8cd81975561e35805f86bafcf331395f1553289bd0e2485d70e5fa5d8
Opcode Fuzzy Hash: 6180d179b7a430157411a1364f8ec01e67fad3a7569fe6cf756d0a7fda425a4d
Instruction Fuzzy Hash: D3D05E7690D2C15FE31B57345468BA53F32ABD3620B0E80DFD8C04B5A7CA554D95DB84

Function 0A705801 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 485c54ff646fba7609dc7d46d3881dceecff84bbaeaddcda39a256d82227e39d
Instruction ID: 9f4b8b79d9bc0e3edfe05610c917b3f70f6552df5573f4fb7f71de25b626ce88
Opcode Fuzzy Hash: 485c54ff646fba7609dc7d46d3881dceecff84bbaeaddcda39a256d82227e39d
Instruction Fuzzy Hash: AAD09E30604615DBDB18965CC458B5F62E2EB80248F51C12484426B2D6DB68CC4A4BC1

Function 0A7061CF Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 599e1630197cff6b798a3fa310db8b82ff4fa5745fe3ed7cb9b27c72cfb3f9a5
Instruction ID: 533409f24c580160feb755af2581b3e101cc2d1556e4043bb0b3494577a39775
Opcode Fuzzy Hash: 599e1630197cff6b798a3fa310db8b82ff4fa5745fe3ed7cb9b27c72cfb3f9a5
Instruction Fuzzy Hash: E8D0C92550D2D14FEB138B34C8B2A91BFF08F8325872D95DAD8D88F157C626E81BD358

Function 076E8B38 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 882e888f2be46a88f1d1d6fb6d21d65a4de1a88a8af2bc52947d9374c2a0311b
Instruction ID: 8490e87b9081c83976b1339b83c96c828a62d8168207ae137d38105761a796f2
Opcode Fuzzy Hash: 882e888f2be46a88f1d1d6fb6d21d65a4de1a88a8af2bc52947d9374c2a0311b
Instruction Fuzzy Hash: 61D012B0916625CFE710D650F584BAC3B25EF51324F09507694073B191C6741D42CFA1

Function 0A7051E2 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f860f55ef162e9bce24c20aebcccf0e0e9c3d8b4c260e22e7cc4c1445430cd6
Instruction ID: 100caacbfde355d4047d97bc46088bddd65f24b914adca8beafabe0dfdfd34c5
Opcode Fuzzy Hash: 6f860f55ef162e9bce24c20aebcccf0e0e9c3d8b4c260e22e7cc4c1445430cd6
Instruction Fuzzy Hash: EFD01239600200DFD720CB28E948F047BE1AB08722F21C3A4B9228B3E0C730D840CB00

Function 076E2B19 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54925ddd4dd193cb0e234f2300cdf2962486fcac7d81d6784af4a778db658484
Instruction ID: c98524a1659307e9afb3182c3d6bf376afacb3f2a7ed66b6d3a9ea675e0a96d7
Opcode Fuzzy Hash: 54925ddd4dd193cb0e234f2300cdf2962486fcac7d81d6784af4a778db658484
Instruction Fuzzy Hash: B9D0CAB8A00228CFC710CB24C880B58B3B2BF0A300F1180E5DA0AA7320C334AE808E42

Function 076E5C6F Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53bbe8fc6f0a4eff9cadd7168efb43b27e7779a14fa044ad46f67df2732ed3b8
Instruction ID: cf802f891ec754829976be5a72d038561f20b3919d4fed89492bf838f78809ce
Opcode Fuzzy Hash: 53bbe8fc6f0a4eff9cadd7168efb43b27e7779a14fa044ad46f67df2732ed3b8
Instruction Fuzzy Hash: 73B09237B00019968A00D688E9504DCBB30DA94232F404032D201620008630156A8664

Function 076E9F10 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95104e3116ed7f7daaa8e31cbe01cad80563dc221bbfdb5de0e5d421b5bebafb
Instruction ID: 99073d47c962f6e41638f12a12ccaa09185a25e76a41070af906d211ef6221a2
Opcode Fuzzy Hash: 95104e3116ed7f7daaa8e31cbe01cad80563dc221bbfdb5de0e5d421b5bebafb
Instruction Fuzzy Hash: 2990023109460C8B4680379D780B5797F5DE5446157840051FA0D499055E55781045A5

Function 076EBD2E Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80d244796e0a7f0f55d854ee3c50da589de21754cf5a2fd24ae54dd2ecbfa4c8
Instruction ID: 4eded7687557afaf11d0574f5fdc7637692afa37f376d31928ae2aa343f14236
Opcode Fuzzy Hash: 80d244796e0a7f0f55d854ee3c50da589de21754cf5a2fd24ae54dd2ecbfa4c8
Instruction Fuzzy Hash: 39A002787826016AEF2166B16E4BBD53A205741B01F101141B60A589C189D5108099B6

Function 076E9F0F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e39a748d3755696f561ba424a6e37e6f98400d091e9b118cd798cca6e661a095
Instruction ID: 30522c36a1b7427bc3baf82a5f0dcf941ecf209cd9c3f28bdf6b16a198e6b22d
Opcode Fuzzy Hash: e39a748d3755696f561ba424a6e37e6f98400d091e9b118cd798cca6e661a095
Instruction Fuzzy Hash:

Non-executed Functions

Function 0A701F28 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

\Vwn, xrefs: 0A7021DF

Memory Dump Source

Source File: 00000003.00000002.2620287835.000000000A700000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a700000_csc.jbxd

Similarity

API ID:
String ID: \Vwn
API String ID: 0-47881834
Opcode ID: c0026a1db6dfd019de832df6ab74d4b7acb7bd634db48ae1f2357c7a03b95b36
Instruction ID: 31b32641782c4142bf217611aa6a4fe1c8a3e72554444cfe9065a8810c00610d
Opcode Fuzzy Hash: c0026a1db6dfd019de832df6ab74d4b7acb7bd634db48ae1f2357c7a03b95b36
Instruction Fuzzy Hash: 0BB14B71E00209DFDB10CFA9D889BDEBBF2AF88304F15C129D915A7295EB749849CF85

Function 076D24F8 Relevance: .6, Instructions: 623COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618727233.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76d0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dd10e100101b284cdfa43b35f99c636ab799fad7fee986477e19f28f833ff89
Instruction ID: 286ab3acb5bc5ddec5c9ce26bcdab5d26407d01e2d7d77de7b8a186694478c33
Opcode Fuzzy Hash: 8dd10e100101b284cdfa43b35f99c636ab799fad7fee986477e19f28f833ff89
Instruction Fuzzy Hash: A6323875B102058FDB25DF68C8A4AAA77F2FF89710B1580A9E506DB371DB71EC41CBA0

Function 076DDAB2 Relevance: .4, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618727233.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76d0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 830044ecf0fd277921a38df370d764e7ec5697cf23b78e2b54a79c6e21d3a3c3
Instruction ID: 75e7529ff95d06051c82bf5fc72d3b49c28a0eaece7e7f3cf1fdaaf6633a28a7
Opcode Fuzzy Hash: 830044ecf0fd277921a38df370d764e7ec5697cf23b78e2b54a79c6e21d3a3c3
Instruction Fuzzy Hash: 25F136B4B106168FDB19DFA9C4A467EFBB2BF88300F248529D55B97350DB34AC41CB85

Function 076EE338 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b7af61b8e368e7c07b937581cf4294ae51d8672a3f12958634a5c196cc02450
Instruction ID: 9bcc06a706683661e305199980c8c44f81f1b787bf9b065ca1c9f7bfdf17b666
Opcode Fuzzy Hash: 0b7af61b8e368e7c07b937581cf4294ae51d8672a3f12958634a5c196cc02450
Instruction Fuzzy Hash: 6BD12DB4A01605CFEB14DF69C584A9DB7F6BF88300F25C4A9E406AB361DB31EC41CB61

Function 076E4BE8 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bb4b956c66e0a614549231da08705e85cb4cc06c8282b5355d814aeeb680cdb
Instruction ID: bdb0784c3488783b1419cd7d3cee517f05b1b42f89c2eb6954834bded185845a
Opcode Fuzzy Hash: 3bb4b956c66e0a614549231da08705e85cb4cc06c8282b5355d814aeeb680cdb
Instruction Fuzzy Hash: 9BC1A2B1E011698FDB14CBA8D9806AEFBF6FF84304F188569E416E7205DB34ED41CBA4

Function 076E4BD9 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2618749340.00000000076E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_76e0000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b3dab87a2379ddbfbe43603be167a82021dceef0abaf7cf54ddbe7de05bf0b3
Instruction ID: d88c1dde33f3f6c560a9f3528e8c3d332790f65440e9d164e93cc42d340872e9
Opcode Fuzzy Hash: 4b3dab87a2379ddbfbe43603be167a82021dceef0abaf7cf54ddbe7de05bf0b3
Instruction Fuzzy Hash: 787161B1E0156A8FDB14CFA9C8816ADFBF5FB88304F188129E416E7245D734E946CBA0

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PDFONLINE.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\Favorites\StormyFierce\Bin\Enchanted.exe

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
PDFONLINE.exe

Function 076E138C Relevance: 2.6, Strings: 2, Instructions: 125
COMMON

Function 076DF008 Relevance: 1.7, APIs: 1, Instructions: 164
COMMON

Function 076DF078 Relevance: 1.6, APIs: 1, Instructions: 144
COMMON

Function 0A701BE0 Relevance: 1.5, Strings: 1, Instructions: 238
COMMON

Function 076E12C2 Relevance: 1.4, Strings: 1, Instructions: 135
COMMON

Function 076E0F43 Relevance: 1.4, Strings: 1, Instructions: 128
COMMON

Function 076E123C Relevance: 1.4, Strings: 1, Instructions: 128
COMMON

Function 076E1474 Relevance: 1.4, Strings: 1, Instructions: 125
COMMON

Function 076E0FB4 Relevance: 1.4, Strings: 1, Instructions: 124
COMMON

Function 076E13FF Relevance: 1.4, Strings: 1, Instructions: 116
COMMON

Function 076E0EF7 Relevance: 1.4, Strings: 1, Instructions: 114
COMMON

Function 0A701BD4 Relevance: 2.7, Strings: 2, Instructions: 201
COMMON

Function 05AEC198 Relevance: 1.6, APIs: 1, Instructions: 56
memoryCOMMON

Function 0A701BD7 Relevance: 1.5, Strings: 1, Instructions: 235
COMMON