Edit tour

Windows Analysis Report
QUOTATION-9044456778.pdf (83kb).com.exe

Overview

General Information

Sample name:	QUOTATION-9044456778.pdf (83kb).com.exe
Analysis ID:	1587580
MD5:	902afcb6d3f905ff4603200341f02874
SHA1:	473fad4ac13e9c8b6b80d17ae3fb658b28d1cd47
SHA256:	1787fd4fd81dca24ca10625e93d43168eea906184da17183ba53a306856c0f28
Tags:	comexeuser-abuse_ch
Infos:

Detection

PureLog Stealer, Quasar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected PureLog Stealer

Yara detected Quasar RAT

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Installs a global keyboard hook

Machine Learning detection for dropped file

Machine Learning detection for sample

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

QUOTATION-9044456778.pdf (83kb).com.exe (PID: 2916 cmdline: "C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe" MD5: 902AFCB6D3F905FF4603200341F02874)

QUOTATION-9044456778.pdf (83kb).com.exe (PID: 2848 cmdline: "C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe" MD5: 902AFCB6D3F905FF4603200341F02874)

schtasks.exe (PID: 5920 cmdline: "schtasks" /create /tn "pdfdocument" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" /rl HIGHEST /f MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6168 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Exccelworkbook.exe (PID: 5908 cmdline: "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" MD5: 902AFCB6D3F905FF4603200341F02874)

Exccelworkbook.exe (PID: 6488 cmdline: "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" MD5: 902AFCB6D3F905FF4603200341F02874)

Exccelworkbook.exe (PID: 7140 cmdline: "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" MD5: 902AFCB6D3F905FF4603200341F02874)

Exccelworkbook.exe (PID: 6188 cmdline: "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" MD5: 902AFCB6D3F905FF4603200341F02874)

schtasks.exe (PID: 5408 cmdline: "schtasks" /create /tn "pdfdocument" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" /rl HIGHEST /f MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 5656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Exccelworkbook.exe (PID: 1256 cmdline: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe MD5: 902AFCB6D3F905FF4603200341F02874)

Exccelworkbook.exe (PID: 5912 cmdline: "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" MD5: 902AFCB6D3F905FF4603200341F02874)

Exccelworkbook.exe (PID: 3844 cmdline: "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" MD5: 902AFCB6D3F905FF4603200341F02874)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Quasar RAT, QuasarRAT	Quasar RAT is a malware family written in .NET which is used by a variety of attackers. The malware is fully functional and open source, and is often packed to make analysis of the source more difficult.	APT33 Dropping Elephant Stone Panda The Gorgon Group	http://researchcenter.paloaltonetworks.com/2017/01/unit42-downeks-and-quasar-rat-used-in-recent-targeted-attacks-against-governments http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/master-of-rats-how-to-create-your-own-tracker/20848 https://adeo.com.tr/wp-content/uploads/2020/02/APT10_Report.pdf https://asec.ahnlab.com/en/31089/	https://malpedia.caad.fkie.fraunhofer.de/details/win.quasar_rat

Malware Configuration

Threatname: Quasar

{"Version": "1.4.1", "Host:Port": "twart.myfirewall.org:9792;rency.ydns.eu:5287;wqo9.firewall-gateway.de:8841;code1.ydns.eu:5287;wqo9.firewall-gateway.de:9792;", "SubDirectory": "SubDir", "InstallName": "Exccelworkbook.exe", "MutexName": "025351e291-5d1041-4fa37-932c7-869aeiQec514992", "StartupKey": "pdfdocument", "Tag": "CODE", "LogDirectoryName": "Logs", "ServerSignature": "XBBvS+rvDQy/NRA7cnb+1Bf2zFbsUHBtrkbS5j0N0VYcCxHngz7kKbyn5Jk5bqDEI6eX9AB+bIEClKSPSVh4o0tmRTlCyQR8n6K5WidNbCUdY2+XqfpKSeeSe+/39iGrb9ZLHaZnA9ciC9yC4PwnmFUO4AD6c2tNeWgm2PU1ohA9OikWzIuh/ks9RkLPCX2N5NbpAd+AvnufkOJwDLDXLT4MfcZlD2s7folRvVMxMcO7qQh4qI3ucP90WFCEokdbM4Rp3wOtslDricIMAIkAmogGRz4B5aLGHo+UKGsYDeV1bWBtzFi1XTWQ/6q4qfqiD4xLJpDFMICIRPNdK9raQkGcTP03+NhWNSswQU59I2Ar9A0CAUdysw34N2Kjm/UbGRrW3+j9kbJxMldClUDkeN0cGmVyyaiGpPUQBlBuqH620bBOymsxD3XZ6Ouxl9MgjTV6Il/iiq/NSebMLiET2K09Tvpmc/8DD8KLeu+5NrJnmChJat6LR2NCPqv1vp8xPgJNCm4DSv6HB78QRq0Ni/oqW7UBnQR4da5/ckoEk+1ZyMZ/TftczNdKaLoyii2gXx3EzDhVEQy9OH8iNQqevGPW/pTYqLGAkH4hRs0+kir9p7nSGZpHvgHSJL7DbCzKlTEYyAlb4VFoR4L+DhJ0+A8JWxhOkfSCX2jo3RVCcPs=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQANqzkhOLx49IztAjuviKazANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI0MDgyMDEyNDQxNVoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAgCzkFEuivKBaTsClmq/3wI2X1uYUZUxf0vEiobTv72lQBIu1jz/r6PADg+cpeGisY1MV3VsdWhecO8dT7LosHtl/FnpTjASkUp3LF0d6cPTgeLsKbK/xJ06uq5gaKvG8Q5zXq6Jbxv+STJdEgmxCf1SPAXViD1PIiGLt2B24qZyOtsSpTSnM5cQuLAvr/6xZG7GYkCU7PRADMGFUm3Xg6L3vRUU3h6vaddoMBAW9ENXVaym1eN5aax3x4tLNUp+kerM+kb/Ab/mi01+PfutPKTptP/dqEGZuKmVrGdX9A+s2Wo6sPtSl85NJT+HT+SSrROvGbx4GH3d6MSHx71JSzy+dph46LV3brBMzY/2xvLbIuPVHqniL/Y0bsUke6aD9cfXIa4UBi7TiKBuoKJYqoYa/VgdoqB4yDaczAnzzYXov7thvPL1Rwv5TueNsPSrQbXbvEJUDxRazlLIrGLuYzeGrnbFHOTM8KKpSVnE8uiXiSEW31DRNHXyLImklMHjwtGd4sjZD5EfkUcg1v9gVCu80ggT+/l7SflY07DOLFvS1ii2ZUPu3IjcbyPtlFj6pGUYjMbIZj8AdqIKyMh6IWtbsu6TMC2yEPSk5pwXrEf7M89nIfHtuhZio+mZ0MhGyHos3nv51/dDBKQnEtcJiODik24kI3JTMGnfQsp7IMjECAwEAAaMyMDAwHQYDVR0OBBYEFFUq5ihhM0we5AVYMhcmFpT6wUKMMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBAFQvpu2xTTenJ6N6YiRWxJ1cwH673yEt60lfsF/xncTeD79qdjD371b1GzQtcYZtYuSdgajGG4YZ8gBrwthm2fOcfuWK2VRDOe7/++mJVEvvsUzzexNeB5nZCYuu1N4UA7z8RHJy6ycPTTcelqyMKUjAGTCZa2BQhkxoFq+wBrEZrY975RcEe7bNNWg0S8YpvdKXxwy/gDZUoWyWXvgmDFQ6VjzDk3jJb0fonxnP/9F7sjd1uU2t5d6aQdPXzbzgWC/IKRXpfdIIZe15uHs1o1O909ymViRRsyy36cjwZ1M2snHWsU7vO//CptldBoV6k6bKkvXA23Cg1vUT0mj0MW554Vb20afxPhyWqHQa4ffHspH2HxViicHx9YaD+WjNAER0Skdo7/sxVR9Ozms2kb8Tyd18mwtVvwmlBNdtwsw8MX9PeW0AXlJUXkHkj47TVP+yyv1dKdUaGZq+ErPjiGoQGBCeHrrtGh+WryK38T7huLnpt++Q4U+CJ6+u9Mvd+C7MCZmgsO9sn0fTL/z54j3zBaWZoRcUZg8IZ7U+C5eGCrg9VjubVdYSar5CrCQnw8x2Rl63qjLVOwpiRoNnEXxmE23yyx1hkP8r27EcTbH7PpJHI22khScfDhf0X/99HEaBqcs+GI+YnC5dpPHY9koTdT5JckCfPJ9sprOn9Ble"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1561987446.0000000005C60000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.1541725770.0000000003241000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000003.00000002.1562657049.0000000000720000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000007.00000002.1707022913.0000000004785000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
0000000A.00000002.3979616638.000000000321E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000006.00000002.1619359768.00000000035F1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000000.00000002.1571245849.0000000008C52000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000007.00000002.1681657823.0000000002E10000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000003.00000002.1562657049.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000006.00000002.1632944704.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000000.00000002.1544040906.0000000004249000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: QUOTATION-9044456778.pdf (83kb).com.exe PID: 2916	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: QUOTATION-9044456778.pdf (83kb).com.exe PID: 2916	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: QUOTATION-9044456778.pdf (83kb).com.exe PID: 2848	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: Exccelworkbook.exe PID: 5908	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: Exccelworkbook.exe PID: 5908	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Exccelworkbook.exe PID: 1256	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: Exccelworkbook.exe PID: 1256	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Exccelworkbook.exe PID: 6188	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Click to see the 14 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.QUOTATION-9044456778.pdf (83kb).com.exe.5c60000.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.QUOTATION-9044456778.pdf (83kb).com.exe.5c60000.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.Exccelworkbook.exe.495b390.1.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
0.2.QUOTATION-9044456778.pdf (83kb).com.exe.490dcc0.1.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
0.2.QUOTATION-9044456778.pdf (83kb).com.exe.490dcc0.1.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28d0d8:$x1: Quasar.Common.Messages 0x29d43b:$x1: Quasar.Common.Messages 0x2a99f2:$x4: Uninstalling... good bye :-( 0x2ab1e7:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
0.2.QUOTATION-9044456778.pdf (83kb).com.exe.490dcc0.1.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2a8fa4:$f1: FileZilla\recentservers.xml 0x2a8fe4:$f2: FileZilla\sitemanager.xml 0x2a9026:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2a9272:$b1: Chrome\User Data\ 0x2a92c8:$b1: Chrome\User Data\ 0x2a95a0:$b2: Mozilla\Firefox\Profiles 0x2a969c:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fb720:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2a97f4:$b4: Opera Software\Opera Stable\Login Data 0x2a98ae:$b5: YandexBrowser\User Data\ 0x2a991c:$b5: YandexBrowser\User Data\ 0x2a95f0:$s4: logins.json 0x2a9326:$a1: username_value 0x2a9344:$a2: password_value 0x2a9630:$a3: encryptedUsername 0x2fb664:$a3: encryptedUsername 0x2a9654:$a4: encryptedPassword 0x2fb682:$a4: encryptedPassword 0x2fb600:$a5: httpRealm
0.2.QUOTATION-9044456778.pdf (83kb).com.exe.490dcc0.1.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x163116:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2a9adc:$s3: Process already elevated. 0x28cdd7:$s4: get_PotentiallyVulnerablePasswords 0x276e58:$s5: GetKeyloggerLogsDirectory 0x29cb9a:$s5: GetKeyloggerLogsDirectory 0x28cdfa:$s6: set_PotentiallyVulnerablePasswords 0x2fcd4e:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
6.2.Exccelworkbook.exe.4c789b0.0.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
6.2.Exccelworkbook.exe.4c789b0.0.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28d0d8:$x1: Quasar.Common.Messages 0x29d43b:$x1: Quasar.Common.Messages 0x2a99f2:$x4: Uninstalling... good bye :-( 0x2ab1e7:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
6.2.Exccelworkbook.exe.4c789b0.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2a8fa4:$f1: FileZilla\recentservers.xml 0x2a8fe4:$f2: FileZilla\sitemanager.xml 0x2a9026:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2a9272:$b1: Chrome\User Data\ 0x2a92c8:$b1: Chrome\User Data\ 0x2a95a0:$b2: Mozilla\Firefox\Profiles 0x2a969c:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fb720:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2a97f4:$b4: Opera Software\Opera Stable\Login Data 0x2a98ae:$b5: YandexBrowser\User Data\ 0x2a991c:$b5: YandexBrowser\User Data\ 0x2a95f0:$s4: logins.json 0x2a9326:$a1: username_value 0x2a9344:$a2: password_value 0x2a9630:$a3: encryptedUsername 0x2fb664:$a3: encryptedUsername 0x2a9654:$a4: encryptedPassword 0x2fb682:$a4: encryptedPassword 0x2fb600:$a5: httpRealm
6.2.Exccelworkbook.exe.4c789b0.0.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x163116:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2a9adc:$s3: Process already elevated. 0x28cdd7:$s4: get_PotentiallyVulnerablePasswords 0x276e58:$s5: GetKeyloggerLogsDirectory 0x29cb9a:$s5: GetKeyloggerLogsDirectory 0x28cdfa:$s6: set_PotentiallyVulnerablePasswords 0x2fcd4e:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
0.2.QUOTATION-9044456778.pdf (83kb).com.exe.490dcc0.1.raw.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
0.2.QUOTATION-9044456778.pdf (83kb).com.exe.490dcc0.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.QUOTATION-9044456778.pdf (83kb).com.exe.490dcc0.1.raw.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28eed8:$x1: Quasar.Common.Messages 0x29f23b:$x1: Quasar.Common.Messages 0x2ab7f2:$x4: Uninstalling... good bye :-( 0x2acfe7:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
0.2.QUOTATION-9044456778.pdf (83kb).com.exe.490dcc0.1.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2aada4:$f1: FileZilla\recentservers.xml 0x2aade4:$f2: FileZilla\sitemanager.xml 0x2aae26:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab072:$b1: Chrome\User Data\ 0x2ab0c8:$b1: Chrome\User Data\ 0x2ab3a0:$b2: Mozilla\Firefox\Profiles 0x2ab49c:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fd520:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ab5f4:$b4: Opera Software\Opera Stable\Login Data 0x2ab6ae:$b5: YandexBrowser\User Data\ 0x2ab71c:$b5: YandexBrowser\User Data\ 0x2ab3f0:$s4: logins.json 0x2ab126:$a1: username_value 0x2ab144:$a2: password_value 0x2ab430:$a3: encryptedUsername 0x2fd464:$a3: encryptedUsername 0x2ab454:$a4: encryptedPassword 0x2fd482:$a4: encryptedPassword 0x2fd400:$a5: httpRealm
0.2.QUOTATION-9044456778.pdf (83kb).com.exe.490dcc0.1.raw.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x164f16:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ab8dc:$s3: Process already elevated. 0x28ebd7:$s4: get_PotentiallyVulnerablePasswords 0x278c58:$s5: GetKeyloggerLogsDirectory 0x29e99a:$s5: GetKeyloggerLogsDirectory 0x28ebfa:$s6: set_PotentiallyVulnerablePasswords 0x2feb4e:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
0.2.QUOTATION-9044456778.pdf (83kb).com.exe.4249970.2.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
0.2.QUOTATION-9044456778.pdf (83kb).com.exe.4249970.2.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28d0d8:$x1: Quasar.Common.Messages 0x29d43b:$x1: Quasar.Common.Messages 0x2a99f2:$x4: Uninstalling... good bye :-( 0x2ab1e7:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
0.2.QUOTATION-9044456778.pdf (83kb).com.exe.4249970.2.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2a8fa4:$f1: FileZilla\recentservers.xml 0x2a8fe4:$f2: FileZilla\sitemanager.xml 0x2a9026:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2a9272:$b1: Chrome\User Data\ 0x2a92c8:$b1: Chrome\User Data\ 0x2a95a0:$b2: Mozilla\Firefox\Profiles 0x2a969c:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fb720:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2a97f4:$b4: Opera Software\Opera Stable\Login Data 0x2a98ae:$b5: YandexBrowser\User Data\ 0x2a991c:$b5: YandexBrowser\User Data\ 0x2a95f0:$s4: logins.json 0x2a9326:$a1: username_value 0x2a9344:$a2: password_value 0x2a9630:$a3: encryptedUsername 0x2fb664:$a3: encryptedUsername 0x2a9654:$a4: encryptedPassword 0x2fb682:$a4: encryptedPassword 0x2fb600:$a5: httpRealm
0.2.QUOTATION-9044456778.pdf (83kb).com.exe.4249970.2.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x163116:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2a9adc:$s3: Process already elevated. 0x28cdd7:$s4: get_PotentiallyVulnerablePasswords 0x276e58:$s5: GetKeyloggerLogsDirectory 0x29cb9a:$s5: GetKeyloggerLogsDirectory 0x28cdfa:$s6: set_PotentiallyVulnerablePasswords 0x2fcd4e:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
3.2.QUOTATION-9044456778.pdf (83kb).com.exe.400000.0.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
3.2.QUOTATION-9044456778.pdf (83kb).com.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
3.2.QUOTATION-9044456778.pdf (83kb).com.exe.400000.0.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28eed8:$x1: Quasar.Common.Messages 0x29f23b:$x1: Quasar.Common.Messages 0x2ab7f2:$x4: Uninstalling... good bye :-( 0x2acfe7:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
3.2.QUOTATION-9044456778.pdf (83kb).com.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2aada4:$f1: FileZilla\recentservers.xml 0x2aade4:$f2: FileZilla\sitemanager.xml 0x2aae26:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab072:$b1: Chrome\User Data\ 0x2ab0c8:$b1: Chrome\User Data\ 0x2ab3a0:$b2: Mozilla\Firefox\Profiles 0x2ab49c:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fd520:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ab5f4:$b4: Opera Software\Opera Stable\Login Data 0x2ab6ae:$b5: YandexBrowser\User Data\ 0x2ab71c:$b5: YandexBrowser\User Data\ 0x2ab3f0:$s4: logins.json 0x2ab126:$a1: username_value 0x2ab144:$a2: password_value 0x2ab430:$a3: encryptedUsername 0x2fd464:$a3: encryptedUsername 0x2ab454:$a4: encryptedPassword 0x2fd482:$a4: encryptedPassword 0x2fd400:$a5: httpRealm
3.2.QUOTATION-9044456778.pdf (83kb).com.exe.400000.0.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x164f16:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ab8dc:$s3: Process already elevated. 0x28ebd7:$s4: get_PotentiallyVulnerablePasswords 0x278c58:$s5: GetKeyloggerLogsDirectory 0x29e99a:$s5: GetKeyloggerLogsDirectory 0x28ebfa:$s6: set_PotentiallyVulnerablePasswords 0x2feb4e:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
6.2.Exccelworkbook.exe.4c789b0.0.raw.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
6.2.Exccelworkbook.exe.4c789b0.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
6.2.Exccelworkbook.exe.4c789b0.0.raw.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28eed8:$x1: Quasar.Common.Messages 0x29f23b:$x1: Quasar.Common.Messages 0x2ab7f2:$x4: Uninstalling... good bye :-( 0x2acfe7:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
6.2.Exccelworkbook.exe.4c789b0.0.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2aada4:$f1: FileZilla\recentservers.xml 0x2aade4:$f2: FileZilla\sitemanager.xml 0x2aae26:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab072:$b1: Chrome\User Data\ 0x2ab0c8:$b1: Chrome\User Data\ 0x2ab3a0:$b2: Mozilla\Firefox\Profiles 0x2ab49c:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fd520:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ab5f4:$b4: Opera Software\Opera Stable\Login Data 0x2ab6ae:$b5: YandexBrowser\User Data\ 0x2ab71c:$b5: YandexBrowser\User Data\ 0x2ab3f0:$s4: logins.json 0x2ab126:$a1: username_value 0x2ab144:$a2: password_value 0x2ab430:$a3: encryptedUsername 0x2fd464:$a3: encryptedUsername 0x2ab454:$a4: encryptedPassword 0x2fd482:$a4: encryptedPassword 0x2fd400:$a5: httpRealm
6.2.Exccelworkbook.exe.4c789b0.0.raw.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x164f16:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ab8dc:$s3: Process already elevated. 0x28ebd7:$s4: get_PotentiallyVulnerablePasswords 0x278c58:$s5: GetKeyloggerLogsDirectory 0x29e99a:$s5: GetKeyloggerLogsDirectory 0x28ebfa:$s6: set_PotentiallyVulnerablePasswords 0x2feb4e:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
0.2.QUOTATION-9044456778.pdf (83kb).com.exe.4249970.2.raw.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
0.2.QUOTATION-9044456778.pdf (83kb).com.exe.4249970.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.QUOTATION-9044456778.pdf (83kb).com.exe.4249970.2.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2aada4:$f1: FileZilla\recentservers.xml 0x96f0f4:$f1: FileZilla\recentservers.xml 0x2aade4:$f2: FileZilla\sitemanager.xml 0x96f134:$f2: FileZilla\sitemanager.xml 0x2aae26:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x96f176:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab072:$b1: Chrome\User Data\ 0x2ab0c8:$b1: Chrome\User Data\ 0x96f3c2:$b1: Chrome\User Data\ 0x96f418:$b1: Chrome\User Data\ 0x2ab3a0:$b2: Mozilla\Firefox\Profiles 0x96f6f0:$b2: Mozilla\Firefox\Profiles 0x2ab49c:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fd520:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x96f7ec:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x9c1870:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ab5f4:$b4: Opera Software\Opera Stable\Login Data 0x96f944:$b4: Opera Software\Opera Stable\Login Data 0x2ab6ae:$b5: YandexBrowser\User Data\ 0x2ab71c:$b5: YandexBrowser\User Data\ 0x96f9fe:$b5: YandexBrowser\User Data\
0.2.QUOTATION-9044456778.pdf (83kb).com.exe.4249970.2.raw.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x164f16:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x829266:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ab8dc:$s3: Process already elevated. 0x96fc2c:$s3: Process already elevated. 0x28ebd7:$s4: get_PotentiallyVulnerablePasswords 0x952f27:$s4: get_PotentiallyVulnerablePasswords 0x278c58:$s5: GetKeyloggerLogsDirectory 0x29e99a:$s5: GetKeyloggerLogsDirectory 0x93cfa8:$s5: GetKeyloggerLogsDirectory 0x962cea:$s5: GetKeyloggerLogsDirectory 0x28ebfa:$s6: set_PotentiallyVulnerablePasswords 0x952f4a:$s6: set_PotentiallyVulnerablePasswords 0x2feb4e:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues> 0x9c2e9e:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
Click to see the 29 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "schtasks" /create /tn "pdfdocument" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" /rl HIGHEST /f, CommandLine: "schtasks" /create /tn "pdfdocument" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" /rl HIGHEST /f, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe", ParentImage: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe, ParentProcessId: 6188, ParentProcessName: Exccelworkbook.exe, ProcessCommandLine: "schtasks" /create /tn "pdfdocument" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" /rl HIGHEST /f, ProcessId: 5408, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "schtasks" /create /tn "pdfdocument" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" /rl HIGHEST /f, CommandLine: "schtasks" /create /tn "pdfdocument" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" /rl HIGHEST /f, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe", ParentImage: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe, ParentProcessId: 2848, ParentProcessName: QUOTATION-9044456778.pdf (83kb).com.exe, ProcessCommandLine: "schtasks" /create /tn "pdfdocument" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" /rl HIGHEST /f, ProcessId: 5920, ProcessName: schtasks.exe

Suricata Signatures

ET MALWARE Generic AsyncRAT Style SSL Cert

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T15:07:47.099927+0100	2035595	1	Domain Observed Used for C2 Detected	94.156.177.117	5287	192.168.2.10	49716	TCP

ET MALWARE Observed Malicious SSL Cert (Quasar CnC)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T15:07:47.099927+0100	2027619	1	Domain Observed Used for C2 Detected	94.156.177.117	5287	192.168.2.10	49716	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 6.2.Exccelworkbook.exe.4c789b0.0.raw.unpack

Malware Configuration Extractor: Quasar {"Version": "1.4.1", "Host:Port": "twart.myfirewall.org:9792;rency.ydns.eu:5287;wqo9.firewall-gateway.de:8841;code1.ydns.eu:5287;wqo9.firewall-gateway.de:9792;", "SubDirectory": "SubDir", "InstallName": "Exccelworkbook.exe", "MutexName": "025351e291-5d1041-4fa37-932c7-869aeiQec514992", "StartupKey": "pdfdocument", "Tag": "CODE", "LogDirectoryName": "Logs", "ServerSignature": "XBBvS+rvDQy/NRA7cnb+1Bf2zFbsUHBtrkbS5j0N0VYcCxHngz7kKbyn5Jk5bqDEI6eX9AB+bIEClKSPSVh4o0tmRTlCyQR8n6K5WidNbCUdY2+XqfpKSeeSe+/39iGrb9ZLHaZnA9ciC9yC4PwnmFUO4AD6c2tNeWgm2PU1ohA9OikWzIuh/ks9RkLPCX2N5NbpAd+AvnufkOJwDLDXLT4MfcZlD2s7folRvVMxMcO7qQh4qI3ucP90WFCEokdbM4Rp3wOtslDricIMAIkAmogGRz4B5aLGHo+UKGsYDeV1bWBtzFi1XTWQ/6q4qfqiD4xLJpDFMICIRPNdK9raQkGcTP03+NhWNSswQU59I2Ar9A0CAUdysw34N2Kjm/UbGRrW3+j9kbJxMldClUDkeN0cGmVyyaiGpPUQBlBuqH620bBOymsxD3XZ6Ouxl9MgjTV6Il/iiq/NSebMLiET2K09Tvpmc/8DD8KLeu+5NrJnmChJat6LR2NCPqv1vp8xPgJNCm4DSv6HB78QRq0Ni/oqW7UBnQR4da5/ckoEk+1ZyMZ/TftczNdKaLoyii2gXx3EzDhVEQy9OH8iNQqevGPW/pTYqLGAkH4hRs0+kir9p7nSGZpHvgHSJL7DbCzKlTEYyAlb4VFoR4L+DhJ0+A8JWxhOkfSCX2jo3RVCcPs=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQANqzkhOLx49IztAjuviKazANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI0MDgyMDEyNDQxNVoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAgCzkFEuivKBaTsClmq/3wI2X1uYUZUxf0vEiobTv72lQBIu1jz/r6PADg+cpeGisY1MV3VsdWhecO8dT7LosHtl/FnpTjASkUp3LF0d6cPTgeLsKbK/xJ06uq5gaKvG8Q5zXq6Jbxv+STJdEgmxCf1SPAXViD1PIiGLt2B24qZyOtsSpTSnM5cQuLAvr/6xZG7GYkCU7PRADMGFUm3Xg6L3vRUU3h6vaddoMBAW9ENXVaym1eN5aax3x4tLNUp+kerM+kb/Ab/mi01+PfutPKTptP/dqEGZuKmVrGdX9A+s2Wo6sPtSl85NJT+HT+SSrROvGbx4GH3d6MSHx71JSzy+dph46LV3brBMzY/2xvLbIuPVHqniL/Y0bsUke6aD9cfXIa4UBi7TiKBuoKJYqoYa/VgdoqB4yDaczAnzzYXov7thvPL1Rwv5TueNsPSrQbXbvEJUDxRazlLIrGLuYzeGrnbFHOTM8KKpSVnE8uiXiSEW31DRNHXyLImklMHjwtGd4sjZD5EfkUcg1v9gVCu80ggT+/l7SflY07DOLFvS1ii2ZUPu3IjcbyPtlFj6pGUYjMbIZj8AdqIKyMh6IWtbsu6TMC2yEPSk5pwXrEf7M89nIfHtuhZio+mZ0MhGyHos3nv51/dDBKQnEtcJiODik24kI3JTMGnfQsp7IMjECAwEAAaMyMDAwHQYDVR0OBBYEFFUq5ihhM0we5AVYMhcmFpT6wUKMMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBAFQvpu2xTTenJ6N6YiRWxJ1cwH673yEt60lfsF/xncTeD79qdjD371b1GzQtcYZtYuSdgajGG4YZ8gBrwthm2fOcfuWK2VRDOe7/++mJVEvvsUzzexNeB5nZCYuu1N4UA7z8RHJy6ycPTTcelqyMKUjAGTCZa2BQhkxoFq+wBrEZrY975RcEe7bNNWg0S8YpvdKXxwy/gDZUoWyWXvgmDFQ6VjzDk3jJb0fonxnP/9F7sjd1uU2t5d6aQdPXzbzgWC/IKRXpfdIIZe15uHs1o1O909ymViRRsyy36cjwZ1M2snHWsU7vO//CptldBoV6k6bKkvXA23Cg1vUT0mj0MW554Vb20afxPhyWqHQa4ffHspH2HxViicHx9YaD+WjNAER0Skdo7/sxVR9Ozms2kb8Tyd18mwtVvwmlBNdtwsw8MX9PeW0AXlJUXkHkj47TVP+yyv1dKdUaGZq+ErPjiGoQGBCeHrrtGh+WryK38T7huLnpt++Q4U+CJ6+u9Mvd+C7MCZmgsO9sn0fTL/z54j3zBaWZoRcUZg8IZ7U+C5eGCrg9VjubVdYSar5CrCQnw8x2Rl63qjLVOwpiRoNnEXxmE23yyx1hkP8r27EcTbH7PpJHI22khScfDhf0X/99HEaBqcs+GI+YnC5dpPHY9koTdT5JckCfPJ9sprOn9Ble"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe

ReversingLabs: Detection: 57%

Multi AV Scanner detection for submitted file

Source: QUOTATION-9044456778.pdf (83kb).com.exe	Virustotal: Detection: 62%			Perma Link
Source: QUOTATION-9044456778.pdf (83kb).com.exe	ReversingLabs: Detection: 57%

Yara detected Quasar RAT

Source: Yara match	File source: 6.2.Exccelworkbook.exe.495b390.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.490dcc0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Exccelworkbook.exe.4c789b0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.490dcc0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.4249970.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.QUOTATION-9044456778.pdf (83kb).com.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Exccelworkbook.exe.4c789b0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.4249970.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1541725770.0000000003241000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1562657049.0000000000720000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1707022913.0000000004785000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3979616638.000000000321E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1619359768.00000000035F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1571245849.0000000008C52000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1681657823.0000000002E10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1562657049.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1632944704.0000000004C77000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1544040906.0000000004249000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QUOTATION-9044456778.pdf (83kb).com.exe PID: 2916, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QUOTATION-9044456778.pdf (83kb).com.exe PID: 2848, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Exccelworkbook.exe PID: 5908, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Exccelworkbook.exe PID: 1256, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Exccelworkbook.exe PID: 6188, type: MEMORYSTR

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: QUOTATION-9044456778.pdf (83kb).com.exe

Joe Sandbox ML: detected

Source: QUOTATION-9044456778.pdf (83kb).com.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 195.201.57.90:443 -> 192.168.2.10:49718 version: TLS 1.2

Source: QUOTATION-9044456778.pdf (83kb).com.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Code function: 4x nop then jmp 052B7B26h	0_2_052B7532
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 4x nop then jmp 03427B26h	6_2_03427532
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 4x nop then jmp 02C87B26h	7_2_02C87532

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2027619 - Severity 1 - ET MALWARE Observed Malicious SSL Cert (Quasar CnC) : 94.156.177.117:5287 -> 192.168.2.10:49716
Source: Network traffic	Suricata IDS: 2035595 - Severity 1 - ET MALWARE Generic AsyncRAT Style SSL Cert : 94.156.177.117:5287 -> 192.168.2.10:49716

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: twart.myfirewall.org

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.490dcc0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.QUOTATION-9044456778.pdf (83kb).com.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Exccelworkbook.exe.4c789b0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.4249970.2.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.10:49716 -> 94.156.177.117:5287

Source: Joe Sandbox View	IP Address: 195.201.57.90 195.201.57.90
Source: Joe Sandbox View	IP Address: 195.201.57.90 195.201.57.90

Source: Joe Sandbox View

ASN Name: NET1-ASBG NET1-ASBG

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS query: name: ipwho.is

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: ipwho.isConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: ipwho.isConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: twart.myfirewall.org
Source: global traffic	DNS traffic detected: DNS query: rency.ydns.eu
Source: global traffic	DNS traffic detected: DNS query: ipwho.is

Source: Exccelworkbook.exe, 0000000A.00000002.3976727963.0000000001483000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: 77EC63BDA74BD0D0E0426DC8F8008506.10.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: Exccelworkbook.exe, 0000000A.00000002.3976727963.00000000014B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab9
Source: Exccelworkbook.exe, 0000000A.00000002.3979616638.00000000031D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ipwho.is
Source: Exccelworkbook.exe, 0000000A.00000002.3979616638.00000000031D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ipwho.isd
Source: Exccelworkbook.exe, 0000000A.00000002.3979616638.000000000321E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: Exccelworkbook.exe, 0000000A.00000002.3979616638.000000000321E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/d
Source: QUOTATION-9044456778.pdf (83kb).com.exe, 00000003.00000002.1585378847.00000000034B1000.00000004.00000800.00020000.00000000.sdmp, Exccelworkbook.exe, 0000000A.00000002.3979616638.000000000301C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: QUOTATION-9044456778.pdf (83kb).com.exe, 00000000.00000002.1571245849.0000000008C52000.00000004.00000800.00020000.00000000.sdmp, QUOTATION-9044456778.pdf (83kb).com.exe, 00000000.00000002.1544040906.0000000004249000.00000004.00000800.00020000.00000000.sdmp, QUOTATION-9044456778.pdf (83kb).com.exe, 00000003.00000002.1562657049.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Exccelworkbook.exe, 00000006.00000002.1632944704.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: Exccelworkbook.exe, 0000000A.00000002.3979616638.00000000031C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipwho.is
Source: QUOTATION-9044456778.pdf (83kb).com.exe, 00000000.00000002.1571245849.0000000008C52000.00000004.00000800.00020000.00000000.sdmp, QUOTATION-9044456778.pdf (83kb).com.exe, 00000000.00000002.1544040906.0000000004249000.00000004.00000800.00020000.00000000.sdmp, QUOTATION-9044456778.pdf (83kb).com.exe, 00000003.00000002.1562657049.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Exccelworkbook.exe, 00000006.00000002.1632944704.0000000004C77000.00000004.00000800.00020000.00000000.sdmp, Exccelworkbook.exe, 0000000A.00000002.3979616638.00000000031C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipwho.is/
Source: QUOTATION-9044456778.pdf (83kb).com.exe, 00000000.00000002.1571245849.0000000008C52000.00000004.00000800.00020000.00000000.sdmp, QUOTATION-9044456778.pdf (83kb).com.exe, 00000000.00000002.1544040906.0000000004249000.00000004.00000800.00020000.00000000.sdmp, QUOTATION-9044456778.pdf (83kb).com.exe, 00000003.00000002.1562657049.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Exccelworkbook.exe, 00000006.00000002.1632944704.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: QUOTATION-9044456778.pdf (83kb).com.exe, 00000000.00000002.1571245849.0000000008C52000.00000004.00000800.00020000.00000000.sdmp, QUOTATION-9044456778.pdf (83kb).com.exe, 00000000.00000002.1544040906.0000000004249000.00000004.00000800.00020000.00000000.sdmp, QUOTATION-9044456778.pdf (83kb).com.exe, 00000003.00000002.1562657049.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Exccelworkbook.exe, 00000006.00000002.1632944704.0000000004C77000.00000004.00000800.00020000.00000000.sdmp, Exccelworkbook.exe, 0000000A.00000002.3979616638.0000000003042000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: QUOTATION-9044456778.pdf (83kb).com.exe, 00000000.00000002.1571245849.0000000008C52000.00000004.00000800.00020000.00000000.sdmp, QUOTATION-9044456778.pdf (83kb).com.exe, 00000000.00000002.1544040906.0000000004249000.00000004.00000800.00020000.00000000.sdmp, QUOTATION-9044456778.pdf (83kb).com.exe, 00000003.00000002.1562657049.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Exccelworkbook.exe, 00000006.00000002.1632944704.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354sCannot

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443

Source: unknown

HTTPS traffic detected: 195.201.57.90:443 -> 192.168.2.10:49718 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe

Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe

Jump to behavior

E-Banking Fraud

Yara detected Quasar RAT

Source: Yara match	File source: 6.2.Exccelworkbook.exe.495b390.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.490dcc0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Exccelworkbook.exe.4c789b0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.490dcc0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.4249970.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.QUOTATION-9044456778.pdf (83kb).com.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Exccelworkbook.exe.4c789b0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.4249970.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1541725770.0000000003241000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1562657049.0000000000720000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1707022913.0000000004785000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3979616638.000000000321E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1619359768.00000000035F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1571245849.0000000008C52000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1681657823.0000000002E10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1562657049.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1632944704.0000000004C77000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1544040906.0000000004249000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QUOTATION-9044456778.pdf (83kb).com.exe PID: 2916, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QUOTATION-9044456778.pdf (83kb).com.exe PID: 2848, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Exccelworkbook.exe PID: 5908, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Exccelworkbook.exe PID: 1256, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Exccelworkbook.exe PID: 6188, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.490dcc0.1.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.490dcc0.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.490dcc0.1.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 6.2.Exccelworkbook.exe.4c789b0.0.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 6.2.Exccelworkbook.exe.4c789b0.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 6.2.Exccelworkbook.exe.4c789b0.0.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.490dcc0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.490dcc0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.490dcc0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.4249970.2.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.4249970.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.4249970.2.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 3.2.QUOTATION-9044456778.pdf (83kb).com.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 3.2.QUOTATION-9044456778.pdf (83kb).com.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 3.2.QUOTATION-9044456778.pdf (83kb).com.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 6.2.Exccelworkbook.exe.4c789b0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 6.2.Exccelworkbook.exe.4c789b0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 6.2.Exccelworkbook.exe.4c789b0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.4249970.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.4249970.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen

Initial sample is a PE file and has a suspicious name

Source: initial sample	Static PE information: Filename: QUOTATION-9044456778.pdf (83kb).com.exe
Source: initial sample	Static PE information: Filename: QUOTATION-9044456778.pdf (83kb).com.exe

Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Code function: 0_2_052B2C28	0_2_052B2C28
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Code function: 0_2_052B2C38	0_2_052B2C38
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Code function: 0_2_052B34A8	0_2_052B34A8
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Code function: 0_2_052B5660	0_2_052B5660
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Code function: 0_2_052B513F	0_2_052B513F
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Code function: 0_2_052B5150	0_2_052B5150
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Code function: 0_2_052B3070	0_2_052B3070
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Code function: 3_2_0188F03C	3_2_0188F03C
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Code function: 3_2_05A19068	3_2_05A19068
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Code function: 3_2_05A10508	3_2_05A10508
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Code function: 3_2_05A10518	3_2_05A10518
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Code function: 3_2_05A19EE0	3_2_05A19EE0
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_03425150	6_2_03425150
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_03423070	6_2_03423070
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_03425660	6_2_03425660
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_03422C38	6_2_03422C38
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_03428CE0	6_2_03428CE0
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_034234A8	6_2_034234A8
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_05B74322	6_2_05B74322
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_05B74322	6_2_05B74322
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_05B726F8	6_2_05B726F8
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_05B726EB	6_2_05B726EB
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_05B7061C	6_2_05B7061C
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_05B742B3	6_2_05B742B3
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_05B708C0	6_2_05B708C0
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_05B708CC	6_2_05B708CC
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_05BBA668	6_2_05BBA668
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 6_2_05BBA663	6_2_05BBA663
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 7_2_02C83070	7_2_02C83070
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 7_2_02C85150	7_2_02C85150
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 7_2_02C85660	7_2_02C85660
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 7_2_02C834A8	7_2_02C834A8
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 7_2_02C88CE0	7_2_02C88CE0
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 7_2_02C82C28	7_2_02C82C28
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 7_2_02C82C38	7_2_02C82C38
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 10_2_015DF03C	10_2_015DF03C
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 10_2_0803B6D0	10_2_0803B6D0
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 10_2_08037E48	10_2_08037E48
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 14_2_0136F03C	14_2_0136F03C

Source: QUOTATION-9044456778.pdf (83kb).com.exe, 00000000.00000002.1541725770.0000000003241000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClient.exe. vs QUOTATION-9044456778.pdf (83kb).com.exe
Source: QUOTATION-9044456778.pdf (83kb).com.exe, 00000000.00000002.1561987446.0000000005C60000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs QUOTATION-9044456778.pdf (83kb).com.exe
Source: QUOTATION-9044456778.pdf (83kb).com.exe, 00000000.00000000.1509291300.0000000000EEE000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamemgfs.exe@ vs QUOTATION-9044456778.pdf (83kb).com.exe
Source: QUOTATION-9044456778.pdf (83kb).com.exe, 00000000.00000002.1544040906.0000000004249000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClient.exe. vs QUOTATION-9044456778.pdf (83kb).com.exe
Source: QUOTATION-9044456778.pdf (83kb).com.exe, 00000000.00000002.1540669375.000000000150E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs QUOTATION-9044456778.pdf (83kb).com.exe
Source: QUOTATION-9044456778.pdf (83kb).com.exe, 00000003.00000002.1562657049.0000000000720000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClient.exe. vs QUOTATION-9044456778.pdf (83kb).com.exe
Source: QUOTATION-9044456778.pdf (83kb).com.exe, 00000003.00000002.1569402928.0000000001718000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs QUOTATION-9044456778.pdf (83kb).com.exe
Source: QUOTATION-9044456778.pdf (83kb).com.exe	Binary or memory string: OriginalFilenamemgfs.exe@ vs QUOTATION-9044456778.pdf (83kb).com.exe

Source: QUOTATION-9044456778.pdf (83kb).com.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.490dcc0.1.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.490dcc0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.490dcc0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 6.2.Exccelworkbook.exe.4c789b0.0.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 6.2.Exccelworkbook.exe.4c789b0.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 6.2.Exccelworkbook.exe.4c789b0.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.490dcc0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.490dcc0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.490dcc0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.4249970.2.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.4249970.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.4249970.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 3.2.QUOTATION-9044456778.pdf (83kb).com.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 3.2.QUOTATION-9044456778.pdf (83kb).com.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 3.2.QUOTATION-9044456778.pdf (83kb).com.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 6.2.Exccelworkbook.exe.4c789b0.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 6.2.Exccelworkbook.exe.4c789b0.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 6.2.Exccelworkbook.exe.4c789b0.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.4249970.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.4249970.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@22/5@3/3

Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\QUOTATION-9044456778.pdf (83kb).com.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\025351e291-5d1041-4fa37-932c7-869aeiQec514992
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5656:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6168:120:WilError_03

Source: QUOTATION-9044456778.pdf (83kb).com.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: QUOTATION-9044456778.pdf (83kb).com.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: QUOTATION-9044456778.pdf (83kb).com.exe	Virustotal: Detection: 62%
Source: QUOTATION-9044456778.pdf (83kb).com.exe	ReversingLabs: Detection: 57%

Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe

File read: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe

Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: QUOTATION-9044456778.pdf (83kb).com.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: QUOTATION-9044456778.pdf (83kb).com.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: QUOTATION-9044456778.pdf (83kb).com.exe

Static file information: File size 3791872 > 1048576

Source: QUOTATION-9044456778.pdf (83kb).com.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x39b000

Source: QUOTATION-9044456778.pdf (83kb).com.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Code function: 0_2_052B8F6D push FFFFFF8Bh; iretd	0_2_052B8F6F
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Code function: 0_2_052B5650 push 28052835h; retf	0_2_052B565D
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Code function: 0_2_052B10E1 push 7C05280Bh; retf	0_2_052B10ED
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 7_2_01103950 push eax; retf	7_2_01103959
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 7_2_02C8A162 push edx; retf	7_2_02C8A163
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Code function: 7_2_02C85650 push 2802C535h; retf	7_2_02C8565D

Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe

File created: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /create /tn "pdfdocument" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" /rl HIGHEST /f

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	File opened: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	File opened: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	File opened: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe:Zone.Identifier read attributes \| delete	Jump to behavior

Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: QUOTATION-9044456778.pdf (83kb).com.exe PID: 2916, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Exccelworkbook.exe PID: 5908, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Exccelworkbook.exe PID: 1256, type: MEMORYSTR

Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Memory allocated: 3020000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Memory allocated: 3240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Memory allocated: 5240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Memory allocated: 80E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Memory allocated: 90E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Memory allocated: A600000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Memory allocated: 9290000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Memory allocated: B600000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Memory allocated: 1880000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Memory allocated: 34B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Memory allocated: 32A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: 1AB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: 35F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: 33B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: 8310000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: 7A00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: A590000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: 9310000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: B590000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: 1100000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: 2DE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: 2C10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: 77A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: 87A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: 9CC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: 8940000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: ACC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: 15D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: 3010000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: 2F60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: 1360000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: 2EC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory allocated: 4EC0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Window / User API: threadDelayed 6664			Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Window / User API: threadDelayed 3054			Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe TID: 3228	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe TID: 6864	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe TID: 5900	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe TID: 6196	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe TID: 364	Thread sleep time: -23980767295822402s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe TID: 5440	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe TID: 5924	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Exccelworkbook.exe, 0000000A.00000002.3998671060.0000000005AB7000.00000004.00000020.00020000.00000000.sdmp, Exccelworkbook.exe, 0000000A.00000002.3998671060.0000000005AD5000.00000004.00000020.00020000.00000000.sdmp, Exccelworkbook.exe, 0000000A.00000002.3998671060.0000000005A03000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Memory written: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory written: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Memory written: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe base: 400000 value starts with: 4D5A	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process created: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe "C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe"	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /create /tn "pdfdocument" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Process created: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process created: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process created: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process created: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process created: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process created: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /create /tn "pdfdocument" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" /rl HIGHEST /f	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Queries volume information: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Queries volume information: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.5c60000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.5c60000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1561987446.0000000005C60000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Yara detected Quasar RAT

Source: Yara match	File source: 6.2.Exccelworkbook.exe.495b390.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.490dcc0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Exccelworkbook.exe.4c789b0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.490dcc0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.4249970.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.QUOTATION-9044456778.pdf (83kb).com.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Exccelworkbook.exe.4c789b0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.4249970.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1541725770.0000000003241000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1562657049.0000000000720000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1707022913.0000000004785000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3979616638.000000000321E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1619359768.00000000035F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1571245849.0000000008C52000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1681657823.0000000002E10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1562657049.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1632944704.0000000004C77000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1544040906.0000000004249000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QUOTATION-9044456778.pdf (83kb).com.exe PID: 2916, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QUOTATION-9044456778.pdf (83kb).com.exe PID: 2848, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Exccelworkbook.exe PID: 5908, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Exccelworkbook.exe PID: 1256, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Exccelworkbook.exe PID: 6188, type: MEMORYSTR

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.5c60000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.5c60000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1561987446.0000000005C60000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Yara detected Quasar RAT

Source: Yara match	File source: 6.2.Exccelworkbook.exe.495b390.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.490dcc0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Exccelworkbook.exe.4c789b0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.490dcc0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.4249970.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.QUOTATION-9044456778.pdf (83kb).com.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Exccelworkbook.exe.4c789b0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION-9044456778.pdf (83kb).com.exe.4249970.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1541725770.0000000003241000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1562657049.0000000000720000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1707022913.0000000004785000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3979616638.000000000321E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1619359768.00000000035F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1571245849.0000000008C52000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1681657823.0000000002E10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1562657049.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1632944704.0000000004C77000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1544040906.0000000004249000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QUOTATION-9044456778.pdf (83kb).com.exe PID: 2916, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QUOTATION-9044456778.pdf (83kb).com.exe PID: 2848, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Exccelworkbook.exe PID: 5908, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Exccelworkbook.exe PID: 1256, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Exccelworkbook.exe PID: 6188, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 Scheduled Task/Job	111 Process Injection	1 Masquerading	11 Input Capture	1 Query Registry	Remote Services	11 Input Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	111 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	41 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Hidden Files and Directories	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	113 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	23 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
QUOTATION-9044456778.pdf (83kb).com.exe	62%	Virustotal		Browse
QUOTATION-9044456778.pdf (83kb).com.exe	58%	ReversingLabs	ByteCode-MSIL.Backdoor.Quasarrat
QUOTATION-9044456778.pdf (83kb).com.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe	58%	ReversingLabs	ByteCode-MSIL.Backdoor.Quasarrat

Source	Detection	Scanner	Label	Link
http://schemas.datacontract.org/2004/07/d	0%	Avira URL Cloud	safe
http://ipwho.isd	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
rency.ydns.eu	94.156.177.117	true	true	unknown
ipwho.is	195.201.57.90	true	false	high
twart.myfirewall.org	127.0.0.4	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ipwho.is/	false		high
twart.myfirewall.org	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	QUOTATION-9044456778.pdf (83kb).com.exe, 00000000.00000002.1571245849.0000000008C52000.00000004.00000800.00020000.00000000.sdmp, QUOTATION-9044456778.pdf (83kb).com.exe, 00000000.00000002.1544040906.0000000004249000.00000004.00000800.00020000.00000000.sdmp, QUOTATION-9044456778.pdf (83kb).com.exe, 00000003.00000002.1562657049.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Exccelworkbook.exe, 00000006.00000002.1632944704.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.datacontract.org/2004/07/d	Exccelworkbook.exe, 0000000A.00000002.3979616638.000000000321E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/14436606/23354	QUOTATION-9044456778.pdf (83kb).com.exe, 00000000.00000002.1571245849.0000000008C52000.00000004.00000800.00020000.00000000.sdmp, QUOTATION-9044456778.pdf (83kb).com.exe, 00000000.00000002.1544040906.0000000004249000.00000004.00000800.00020000.00000000.sdmp, QUOTATION-9044456778.pdf (83kb).com.exe, 00000003.00000002.1562657049.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Exccelworkbook.exe, 00000006.00000002.1632944704.0000000004C77000.00000004.00000800.00020000.00000000.sdmp, Exccelworkbook.exe, 0000000A.00000002.3979616638.0000000003042000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354sCannot	QUOTATION-9044456778.pdf (83kb).com.exe, 00000000.00000002.1571245849.0000000008C52000.00000004.00000800.00020000.00000000.sdmp, QUOTATION-9044456778.pdf (83kb).com.exe, 00000000.00000002.1544040906.0000000004249000.00000004.00000800.00020000.00000000.sdmp, QUOTATION-9044456778.pdf (83kb).com.exe, 00000003.00000002.1562657049.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Exccelworkbook.exe, 00000006.00000002.1632944704.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.datacontract.org/2004/07/	Exccelworkbook.exe, 0000000A.00000002.3979616638.000000000321E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	QUOTATION-9044456778.pdf (83kb).com.exe, 00000003.00000002.1585378847.00000000034B1000.00000004.00000800.00020000.00000000.sdmp, Exccelworkbook.exe, 0000000A.00000002.3979616638.000000000301C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ipwho.is	Exccelworkbook.exe, 0000000A.00000002.3979616638.00000000031D2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/11564914/23354;	QUOTATION-9044456778.pdf (83kb).com.exe, 00000000.00000002.1571245849.0000000008C52000.00000004.00000800.00020000.00000000.sdmp, QUOTATION-9044456778.pdf (83kb).com.exe, 00000000.00000002.1544040906.0000000004249000.00000004.00000800.00020000.00000000.sdmp, QUOTATION-9044456778.pdf (83kb).com.exe, 00000003.00000002.1562657049.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Exccelworkbook.exe, 00000006.00000002.1632944704.0000000004C77000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ipwho.isd	Exccelworkbook.exe, 0000000A.00000002.3979616638.00000000031D2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipwho.is	Exccelworkbook.exe, 0000000A.00000002.3979616638.00000000031C0000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
94.156.177.117	rency.ydns.eu	Bulgaria		43561	NET1-ASBG	true
195.201.57.90	ipwho.is	Germany		24940	HETZNER-ASDE	false

Private

IP
127.0.0.4

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587580
Start date and time:	2025-01-10 15:06:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	QUOTATION-9044456778.pdf (83kb).com.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@22/5@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 289 Number of non-executed functions: 8
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.214.172, 172.202.163.200, 2.23.242.162, 52.149.20.212
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:07:29	API Interceptor	1x Sleep call for process: QUOTATION-9044456778.pdf (83kb).com.exe modified
09:07:35	API Interceptor	11108510x Sleep call for process: Exccelworkbook.exe modified
15:07:36	Task Scheduler	Run new task: pdfdocument path: C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
94.156.177.117	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Get hash	malicious	Quasar	Browse
195.201.57.90	SPt4FUjZMt.exe	Get hash	malicious	AsyncRAT, Luca Stealer, MicroClip, PythonCryptoHijacker, RedLine	Browse	/?output=json
	765iYbgWn9.exe	Get hash	malicious	Luca Stealer	Browse	/?output=json
	765iYbgWn9.exe	Get hash	malicious	Luca Stealer	Browse	/?output=json
	WfKynArKjH.exe	Get hash	malicious	AsyncRAT, Luca Stealer, MicroClip, RedLine	Browse	/?output=json
	ubes6SC7Vd.exe	Get hash	malicious	Unknown	Browse	ipwhois.app/xml/
	cOQD62FceM.exe	Get hash	malicious	Luca Stealer, Rusty Stealer	Browse	/?output=json
	Clipper.exe	Get hash	malicious	Unknown	Browse	/?output=json
	cOQD62FceM.exe	Get hash	malicious	Luca Stealer	Browse	/?output=json
	Cryptor.exe	Get hash	malicious	Luca Stealer	Browse	/?output=json
	Cryptor.exe	Get hash	malicious	Luca Stealer, Rusty Stealer	Browse	/?output=json

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipwho.is	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Get hash	malicious	Quasar	Browse	195.201.57.90
	UXxZ4m65ro.exe	Get hash	malicious	Quasar	Browse	195.201.57.90
	ny9LDJr6pA.exe	Get hash	malicious	Quasar	Browse	195.201.57.90
	jaTDEkWCbs.exe	Get hash	malicious	Quasar	Browse	195.201.57.90
	2Mi3lKoJfj.exe	Get hash	malicious	Quasar	Browse	195.201.57.90
	YJaaZuNHwI.exe	Get hash	malicious	Quasar	Browse	195.201.57.90
	Flasher.exe	Get hash	malicious	Luca Stealer, Rusty Stealer	Browse	108.181.61.49
	msgde.exe	Get hash	malicious	Quasar	Browse	108.181.61.49
	6ee7HCp9cD.exe	Get hash	malicious	Quasar	Browse	108.181.61.49
	wUSt04rfJ0.exe	Get hash	malicious	Quasar	Browse	108.181.61.49
rency.ydns.eu	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Get hash	malicious	Quasar	Browse	94.156.177.117
rency.ydns.eu	Zam#U00f3wienie 89118 _ Metal-Constructions.pdf.com.exe	Get hash	malicious	Quasar	Browse	93.123.85.234
bg.microsoft.map.fastly.net	Shipping Document.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	199.232.210.172
	3254519122657813770.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1712226379134618467.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	7401990642713807.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	A5815BC0-FA26-4ECC-9A97-EE9DB31273CA_12272024154104847.dll	Get hash	malicious	Unknown	Browse	199.232.210.172
	382215884163542302.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2503475573085815370.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	17772451271118687.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1353125634235611874.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1947415746274847548.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	http://pdfdrive.com.co	Get hash	malicious	Unknown	Browse	178.63.248.53
	1162-201.exe	Get hash	malicious	FormBook	Browse	136.243.64.147
	3.elf	Get hash	malicious	Unknown	Browse	197.242.86.251
	https://199.188.109.181	Get hash	malicious	Unknown	Browse	188.40.164.54
	n41dQbiw1Y.exe	Get hash	malicious	Babuk, Djvu	Browse	188.40.141.211
	https://downloads.jam-software.de/ultrasearch/UltraSearch-Setup.exe	Get hash	malicious	Unknown	Browse	116.202.5.43
	https://customers.jam-software.de/downloadTrialProcess.php?article_no=671&	Get hash	malicious	Unknown	Browse	78.47.225.43
	Appraisal-nation-Review_and_Signature_Request46074.pdf	Get hash	malicious	Unknown	Browse	195.201.80.48
	Appraisal-nation-Review_and_Signature_Request46074.pdf	Get hash	malicious	Unknown	Browse	195.201.80.48
NET1-ASBG	Fantazy.i486.elf	Get hash	malicious	Unknown	Browse	95.87.199.40
	Fantazy.x86_64.elf	Get hash	malicious	Unknown	Browse	93.123.77.220
	Kloki.arm7.elf	Get hash	malicious	Unknown	Browse	83.222.191.90
	Kloki.m68k.elf	Get hash	malicious	Unknown	Browse	83.222.191.90
	Kloki.x86_64.elf	Get hash	malicious	Unknown	Browse	83.222.189.67
	Kloki.x86.elf	Get hash	malicious	Unknown	Browse	83.222.190.214
	Kloki.arm4.elf	Get hash	malicious	Unknown	Browse	83.222.191.90
	Kloki.spc.elf	Get hash	malicious	Unknown	Browse	83.222.191.90
	Kloki.arm5.elf	Get hash	malicious	Unknown	Browse	83.222.189.126
	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Get hash	malicious	Quasar	Browse	94.156.177.117

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	PO#17971.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	195.201.57.90
	https://sign.zoho.com/zsguest?locale=en&sign_id=234b4d535f4956237c699124bb06f6840075804affff79070f72fbd27ec4885c3a2ba06657b8a52338eb80052baee9f74c4e2e0e7f85c073df939f1ac4dff75f76c95d46ac2361c7b14335e4f12c5c5d49c49b1d2f4c838a&action_type=SIGN	Get hash	malicious	Unknown	Browse	195.201.57.90
	IMG_10503677.exe	Get hash	malicious	MassLogger RAT	Browse	195.201.57.90
	XClient.exe	Get hash	malicious	XWorm	Browse	195.201.57.90
	RFQ SHEETS PX2 MULE25 SHENZHEN LUCKY.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	195.201.57.90
	1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	195.201.57.90
	https://aqctslc.com/	Get hash	malicious	Unknown	Browse	195.201.57.90
	https://sacredartscommunications.com/	Get hash	malicious	HTMLPhisher	Browse	195.201.57.90
	http://stonecoldstalley.com/	Get hash	malicious	Unknown	Browse	195.201.57.90

Process:	C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.2345913795203645
Encrypted:	false
SSDEEP:	6:kKxWtL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:pWtiDImsLNkPlE99SNxAhUe/3
MD5:	AD030E2DAB9F570C3AB9FB59EFBBD28B
SHA1:	FFFC808ED708ED979767AD9474F0C2F309F5CF7A
SHA-256:	0B342966E005EF1E1597CEABC18F05606205C680113837A7C1ABC73AFCEBD6A6
SHA-512:	A20884A673CECAC82A20E251E812246E30B3FF0060AC3DD5F26DC867420CDD95E12921F0A9EFFD776592225ECCBB516591B5487A668D544BE4A16F94754A1AFB
Malicious:	false
Reputation:	low
Preview:	p...... ...........ic..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Exccelworkbook.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\QUOTATION-9044456778.pdf (83kb).com.exe.log

Download File

Process:	C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe

Download File

Process:	C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3791872
Entropy (8bit):	7.994905688236858
Encrypted:	true
SSDEEP:	49152:Bg6eXlKawrTTN8CaimN0G0LI1yfuJDqHkN0IrmRZiLTqK2W3rcKmUd5mgo:BKVtw7N1aim/0pMtNrmRZu32W+Kgj
MD5:	902AFCB6D3F905FF4603200341F02874
SHA1:	473FAD4AC13E9C8B6B80D17AE3FB658B28D1CD47
SHA-256:	1787FD4FD81DCA24CA10625E93D43168EEA906184DA17183BA53A306856C0F28
SHA-512:	E405EC77372DBF367C873D3531FC6455C44C4D185BD1A0B60C9314EA21B1B51F72818503366EFAA8D2D322C7819763986A837E06845A0F81EACB6E4C1A98EC3C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 58%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...7_.g..................9..........9.. ........@.. .......................@:...........`.................................p.9.K.....9..(................... :...................................................... ............... ..H............text....9.. ....9................. ..`.rsrc....(....9..(....9.............@..@.reloc....... :.......9.............@..B..................9.....H........v9..X......z....................................................0..A....... .........%.....(......... .........%.....(.........(.........&....0..@.........}.......\|.....t....}:....(......}...... 0... ....(...+.....&.0..E.......+$.E.............................&..+..{.........~.... ....~............0..F.......~.....+-.E.............................&..Y. ....Y.+..\|....{:........*...0..........~......+0.E....U...C...C............................&..+..(.........~...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.994905688236858
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	QUOTATION-9044456778.pdf (83kb).com.exe
File size:	3'791'872 bytes
MD5:	902afcb6d3f905ff4603200341f02874
SHA1:	473fad4ac13e9c8b6b80d17ae3fb658b28d1cd47
SHA256:	1787fd4fd81dca24ca10625e93d43168eea906184da17183ba53a306856c0f28
SHA512:	e405ec77372dbf367c873d3531fc6455c44c4d185bd1a0b60c9314ea21b1b51f72818503366efaa8d2d322c7819763986a837e06845a0f81eacb6e4c1a98ec3c
SSDEEP:	49152:Bg6eXlKawrTTN8CaimN0G0LI1yfuJDqHkN0IrmRZiLTqK2W3rcKmUd5mgo:BKVtw7N1aim/0pMtNrmRZu32W+Kgj
TLSH:	4E06331DBB42C872DB6D227FE9C3B3494845E725F835F67A4DD0386389318C9C1A66E1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...7_.g..................9..*........9.. ........@.. .......................@:...........`................................

File Icon


Icon Hash:	33362c2d36335470

Static PE Info

General

Entrypoint:	0x79cfbe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x677F5F37 [Thu Jan 9 05:31:35 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x39cf70	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x39e000	0x2800	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3a2000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x39afc4	0x39b000	867135dfbdc022fc17b1a44ba7fd1a91	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x39e000	0x2800	0x2800	822b2f5732ea3fdbc214c946e4a1d293	False	0.87939453125	data	7.615533991634477	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x3a2000	0xc	0x200	e0419931c0eb7457218e8feb1f59bf7a	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x39e0c8	0x2356	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9427371213796153
RT_GROUP_ICON	0x3a0430	0x14	data	1.05
RT_VERSION	0x3a0454	0x378	data	0.393018018018018

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T15:07:47.099927+0100	2027619	ET MALWARE Observed Malicious SSL Cert (Quasar CnC)	1	94.156.177.117	5287	192.168.2.10	49716	TCP
2025-01-10T15:07:47.099927+0100	2035595	ET MALWARE Generic AsyncRAT Style SSL Cert	1	94.156.177.117	5287	192.168.2.10	49716	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 15:07:45.885696888 CET	49716	5287	192.168.2.10	94.156.177.117
Jan 10, 2025 15:07:45.890474081 CET	5287	49716	94.156.177.117	192.168.2.10
Jan 10, 2025 15:07:45.890548944 CET	49716	5287	192.168.2.10	94.156.177.117
Jan 10, 2025 15:07:45.895016909 CET	49716	5287	192.168.2.10	94.156.177.117
Jan 10, 2025 15:07:45.899756908 CET	5287	49716	94.156.177.117	192.168.2.10
Jan 10, 2025 15:07:47.032551050 CET	5287	49716	94.156.177.117	192.168.2.10
Jan 10, 2025 15:07:47.032572031 CET	5287	49716	94.156.177.117	192.168.2.10
Jan 10, 2025 15:07:47.032676935 CET	49716	5287	192.168.2.10	94.156.177.117
Jan 10, 2025 15:07:47.095107079 CET	49716	5287	192.168.2.10	94.156.177.117
Jan 10, 2025 15:07:47.099926949 CET	5287	49716	94.156.177.117	192.168.2.10
Jan 10, 2025 15:07:47.404448986 CET	5287	49716	94.156.177.117	192.168.2.10
Jan 10, 2025 15:07:47.463459015 CET	49716	5287	192.168.2.10	94.156.177.117
Jan 10, 2025 15:07:48.364149094 CET	49718	443	192.168.2.10	195.201.57.90
Jan 10, 2025 15:07:48.364191055 CET	443	49718	195.201.57.90	192.168.2.10
Jan 10, 2025 15:07:48.364265919 CET	49718	443	192.168.2.10	195.201.57.90
Jan 10, 2025 15:07:48.365380049 CET	49718	443	192.168.2.10	195.201.57.90
Jan 10, 2025 15:07:48.365392923 CET	443	49718	195.201.57.90	192.168.2.10
Jan 10, 2025 15:07:49.292956114 CET	443	49718	195.201.57.90	192.168.2.10
Jan 10, 2025 15:07:49.293024063 CET	49718	443	192.168.2.10	195.201.57.90
Jan 10, 2025 15:07:49.297560930 CET	49718	443	192.168.2.10	195.201.57.90
Jan 10, 2025 15:07:49.297569990 CET	443	49718	195.201.57.90	192.168.2.10
Jan 10, 2025 15:07:49.297923088 CET	443	49718	195.201.57.90	192.168.2.10
Jan 10, 2025 15:07:49.303962946 CET	49718	443	192.168.2.10	195.201.57.90
Jan 10, 2025 15:07:49.347326994 CET	443	49718	195.201.57.90	192.168.2.10
Jan 10, 2025 15:07:49.499241114 CET	443	49718	195.201.57.90	192.168.2.10
Jan 10, 2025 15:07:49.499310017 CET	443	49718	195.201.57.90	192.168.2.10
Jan 10, 2025 15:07:49.499511003 CET	49718	443	192.168.2.10	195.201.57.90
Jan 10, 2025 15:07:49.568619013 CET	49718	443	192.168.2.10	195.201.57.90
Jan 10, 2025 15:07:50.133191109 CET	49716	5287	192.168.2.10	94.156.177.117
Jan 10, 2025 15:07:50.137974977 CET	5287	49716	94.156.177.117	192.168.2.10
Jan 10, 2025 15:07:50.138025999 CET	49716	5287	192.168.2.10	94.156.177.117
Jan 10, 2025 15:07:50.142855883 CET	5287	49716	94.156.177.117	192.168.2.10
Jan 10, 2025 15:07:50.597393990 CET	5287	49716	94.156.177.117	192.168.2.10
Jan 10, 2025 15:07:50.650966883 CET	49716	5287	192.168.2.10	94.156.177.117
Jan 10, 2025 15:07:50.807670116 CET	5287	49716	94.156.177.117	192.168.2.10
Jan 10, 2025 15:07:50.950557947 CET	49716	5287	192.168.2.10	94.156.177.117
Jan 10, 2025 15:08:15.822876930 CET	49716	5287	192.168.2.10	94.156.177.117
Jan 10, 2025 15:08:15.827677011 CET	5287	49716	94.156.177.117	192.168.2.10
Jan 10, 2025 15:08:40.838608980 CET	49716	5287	192.168.2.10	94.156.177.117
Jan 10, 2025 15:08:40.843641043 CET	5287	49716	94.156.177.117	192.168.2.10
Jan 10, 2025 15:09:05.854217052 CET	49716	5287	192.168.2.10	94.156.177.117
Jan 10, 2025 15:09:05.858999014 CET	5287	49716	94.156.177.117	192.168.2.10
Jan 10, 2025 15:09:30.917192936 CET	49716	5287	192.168.2.10	94.156.177.117
Jan 10, 2025 15:09:30.922152042 CET	5287	49716	94.156.177.117	192.168.2.10
Jan 10, 2025 15:09:56.026200056 CET	49716	5287	192.168.2.10	94.156.177.117
Jan 10, 2025 15:09:56.031214952 CET	5287	49716	94.156.177.117	192.168.2.10
Jan 10, 2025 15:10:21.041959047 CET	49716	5287	192.168.2.10	94.156.177.117
Jan 10, 2025 15:10:21.047112942 CET	5287	49716	94.156.177.117	192.168.2.10
Jan 10, 2025 15:10:46.151496887 CET	49716	5287	192.168.2.10	94.156.177.117
Jan 10, 2025 15:10:46.157124043 CET	5287	49716	94.156.177.117	192.168.2.10
Jan 10, 2025 15:11:11.168843985 CET	49716	5287	192.168.2.10	94.156.177.117
Jan 10, 2025 15:11:11.173832893 CET	5287	49716	94.156.177.117	192.168.2.10
Jan 10, 2025 15:11:36.182663918 CET	49716	5287	192.168.2.10	94.156.177.117
Jan 10, 2025 15:11:36.187850952 CET	5287	49716	94.156.177.117	192.168.2.10

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 15:07:43.512339115 CET	59457	53	192.168.2.10	1.1.1.1
Jan 10, 2025 15:07:43.523461103 CET	53	59457	1.1.1.1	192.168.2.10
Jan 10, 2025 15:07:45.871052980 CET	56795	53	192.168.2.10	1.1.1.1
Jan 10, 2025 15:07:45.884888887 CET	53	56795	1.1.1.1	192.168.2.10
Jan 10, 2025 15:07:48.351814032 CET	62445	53	192.168.2.10	1.1.1.1
Jan 10, 2025 15:07:48.358643055 CET	53	62445	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 15:07:43.512339115 CET	192.168.2.10	1.1.1.1	0x333c	Standard query (0)	twart.myfirewall.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:07:45.871052980 CET	192.168.2.10	1.1.1.1	0x17fe	Standard query (0)	rency.ydns.eu	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:07:48.351814032 CET	192.168.2.10	1.1.1.1	0x2820	Standard query (0)	ipwho.is	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 15:07:26.318697929 CET	1.1.1.1	192.168.2.10	0x661a	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:07:26.318697929 CET	1.1.1.1	192.168.2.10	0x661a	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:07:43.523461103 CET	1.1.1.1	192.168.2.10	0x333c	No error (0)	twart.myfirewall.org	127.0.0.4	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:07:45.884888887 CET	1.1.1.1	192.168.2.10	0x17fe	No error (0)	rency.ydns.eu	94.156.177.117	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:07:47.568933964 CET	1.1.1.1	192.168.2.10	0xd5e8	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:07:47.568933964 CET	1.1.1.1	192.168.2.10	0xd5e8	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:07:48.358643055 CET	1.1.1.1	192.168.2.10	0x2820	No error (0)	ipwho.is	195.201.57.90	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ipwho.is

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49718	195.201.57.90	443	6188	C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:07:49 UTC	150	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0 Host: ipwho.is Connection: Keep-Alive
2025-01-10 14:07:49 UTC	223	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:07:49 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Server: ipwhois Access-Control-Allow-Headers: * X-Robots-Tag: noindex
2025-01-10 14:07:49 UTC	1021	IN	Data Raw: 33 66 31 0d 0a 7b 0a 20 20 20 20 22 41 62 6f 75 74 20 55 73 22 3a 20 22 68 74 74 70 73 3a 5c 2f 5c 2f 69 70 77 68 6f 69 73 2e 69 6f 22 2c 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 0a 20 20 20 20 22 73 75 63 63 65 73 73 22 3a 20 74 72 75 65 2c 0a 20 20 20 20 22 74 79 70 65 22 3a 20 22 49 50 76 34 22 2c 0a 20 20 20 20 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 20 22 4e 6f 72 74 68 20 41 6d 65 72 69 63 61 22 2c 0a 20 20 20 20 22 63 6f 6e 74 69 6e 65 6e 74 5f 63 6f 64 65 22 3a 20 22 4e 41 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f Data Ascii: 3f1{ "About Us": "https:\/\/ipwhois.io", "ip": "8.46.123.189", "success": true, "type": "IPv4", "continent": "North America", "continent_code": "NA", "country": "United States", "country_code": "US", "region": "New Yo

Target ID:	0
Start time:	09:07:29
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe"
Imagebase:	0xb50000
File size:	3'791'872 bytes
MD5 hash:	902AFCB6D3F905FF4603200341F02874
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1561987446.0000000005C60000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000002.1541725770.0000000003241000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000002.1571245849.0000000008C52000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000002.1544040906.0000000004249000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:07:32
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\QUOTATION-9044456778.pdf (83kb).com.exe"
Imagebase:	0xda0000
File size:	3'791'872 bytes
MD5 hash:	902AFCB6D3F905FF4603200341F02874
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000003.00000002.1562657049.0000000000720000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000003.00000002.1562657049.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:07:34
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"schtasks" /create /tn "pdfdocument" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" /rl HIGHEST /f
Imagebase:	0x180000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:07:34
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:07:34
Start date:	10/01/2025
Path:	C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe"
Imagebase:	0xd50000
File size:	3'791'872 bytes
MD5 hash:	902AFCB6D3F905FF4603200341F02874
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000006.00000002.1619359768.00000000035F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000006.00000002.1632944704.0000000004C77000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 58%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:07:36
Start date:	10/01/2025
Path:	C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe
Imagebase:	0x670000
File size:	3'791'872 bytes
MD5 hash:	902AFCB6D3F905FF4603200341F02874
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000007.00000002.1707022913.0000000004785000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000007.00000002.1681657823.0000000002E10000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:07:37
Start date:	10/01/2025
Path:	C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe"
Imagebase:	0x370000
File size:	3'791'872 bytes
MD5 hash:	902AFCB6D3F905FF4603200341F02874
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:07:37
Start date:	10/01/2025
Path:	C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe"
Imagebase:	0x480000
File size:	3'791'872 bytes
MD5 hash:	902AFCB6D3F905FF4603200341F02874
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:07:37
Start date:	10/01/2025
Path:	C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe"
Imagebase:	0xa60000
File size:	3'791'872 bytes
MD5 hash:	902AFCB6D3F905FF4603200341F02874
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 0000000A.00000002.3979616638.000000000321E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	09:07:40
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"schtasks" /create /tn "pdfdocument" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe" /rl HIGHEST /f
Imagebase:	0x180000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	09:07:40
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	09:07:45
Start date:	10/01/2025
Path:	C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe"
Imagebase:	0x10000
File size:	3'791'872 bytes
MD5 hash:	902AFCB6D3F905FF4603200341F02874
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	09:07:45
Start date:	10/01/2025
Path:	C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe"
Imagebase:	0x8b0000
File size:	3'791'872 bytes
MD5 hash:	902AFCB6D3F905FF4603200341F02874
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	195
Total number of Limit Nodes:	5

Executed Functions

Function 052B5DE0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 052B6016

Strings

BEjL, xrefs: 052B5E1B
BEjL, xrefs: 052B5E4A

Memory Dump Source

Source File: 00000000.00000002.1558597176.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52b0000_QUOTATION-9044456778.jbxd

Similarity

API ID: CreateProcess
String ID: BEjL$BEjL
API String ID: 963392458-3006919381
Opcode ID: 1cbb2f5ba7f2003d4c36f838668e3f24d5676a6bea442a20374f877c317a7f45
Instruction ID: 634e1fbfa876a1f5b08109cd5ba778b7c3a84c52d4798f552edd019eaf381f3b
Opcode Fuzzy Hash: 1cbb2f5ba7f2003d4c36f838668e3f24d5676a6bea442a20374f877c317a7f45
Instruction Fuzzy Hash: 7F914971D10219DFEF20CF69C840BEDBBB2BF49350F148569E819A7240EBB59985CF91

Function 052B5DDF Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 052B6016

Strings

BEjL, xrefs: 052B5E1B
BEjL, xrefs: 052B5E4A

Memory Dump Source

Source File: 00000000.00000002.1558597176.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52b0000_QUOTATION-9044456778.jbxd

Similarity

API ID: CreateProcess
String ID: BEjL$BEjL
API String ID: 963392458-3006919381
Opcode ID: e53a0c179c43ea9ef2bcb45326e3c252f4acb898aa2dcd15f61f2df18a9e9207
Instruction ID: 10d275fe1d223713ed87b19b165778ffa569c61a57ecd04da6990f4f8aa0eaa3
Opcode Fuzzy Hash: e53a0c179c43ea9ef2bcb45326e3c252f4acb898aa2dcd15f61f2df18a9e9207
Instruction Fuzzy Hash: 1F914A71D10219DFEF20CF69C840BEDBBB2BF48350F148569E819A7240EBB59985CF91

Function 03066404 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 03067D91

Strings

BEjL, xrefs: 03067D14

Memory Dump Source

Source File: 00000000.00000002.1541063975.0000000003060000.00000040.00000800.00020000.00000000.sdmp, Offset: 03060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3060000_QUOTATION-9044456778.jbxd

Similarity

API ID: Create
String ID: BEjL
API String ID: 2289755597-2255523351
Opcode ID: 61c507016ad8261c3fb0a00d394c5860a4513fc550b4c2cf296a7f578902db56
Instruction ID: c28f54b01b4310e71b65f983fb5217ef0ef03ccb0eb424ae1c6ce65e4886812a
Opcode Fuzzy Hash: 61c507016ad8261c3fb0a00d394c5860a4513fc550b4c2cf296a7f578902db56
Instruction Fuzzy Hash: 2041D2B0C0071CCBEB24CFA9C844B9DBBF6BF49704F60846AD408AB255D7B56946CF90

Function 03067CD5 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 03067D91

Strings

BEjL, xrefs: 03067D14

Memory Dump Source

Source File: 00000000.00000002.1541063975.0000000003060000.00000040.00000800.00020000.00000000.sdmp, Offset: 03060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3060000_QUOTATION-9044456778.jbxd

Similarity

API ID: Create
String ID: BEjL
API String ID: 2289755597-2255523351
Opcode ID: 76b09db4fdad984a4960c4b28cbb52b056d7d0b9b9f645161ec8e44322ae19b4
Instruction ID: 3b78b441e588d57e722d3d2c83635c610041d69beae180cde3a790a21e029d2c
Opcode Fuzzy Hash: 76b09db4fdad984a4960c4b28cbb52b056d7d0b9b9f645161ec8e44322ae19b4
Instruction Fuzzy Hash: 2641D0B0C01718DBEB24CFA9C884B9DBBF6BF49704F24846AD408AB255D7B56946CF90

Function 052B5B50 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 71
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 052B5BE8

Strings

BEjL, xrefs: 052B5B77

Memory Dump Source

Source File: 00000000.00000002.1558597176.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52b0000_QUOTATION-9044456778.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: BEjL
API String ID: 3559483778-2255523351
Opcode ID: b0e66caf4f8d9a4ff8f634415ae16e66c9cff42ba37fdc11802630f34b845c39
Instruction ID: 65d455149d6a3fab54a43d01ba80c0faab18385dbf55fe0ffa7539a22d448adc
Opcode Fuzzy Hash: b0e66caf4f8d9a4ff8f634415ae16e66c9cff42ba37fdc11802630f34b845c39
Instruction Fuzzy Hash: 232157759003499FDB10CFAAC885BEEBBF5FF49310F14842AE959A7240DB789941CBA0

Function 052B5B58 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 052B5BE8

Strings

BEjL, xrefs: 052B5B77

Memory Dump Source

Source File: 00000000.00000002.1558597176.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52b0000_QUOTATION-9044456778.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: BEjL
API String ID: 3559483778-2255523351
Opcode ID: 744d455cc80d6f1f02a01b914b451cd3e52ba68480732fb7f06171864a94df58
Instruction ID: e3907b3b8d5258f54c4fddc29ca46d38c8793ea953a54d8d9431139fb44ed72a
Opcode Fuzzy Hash: 744d455cc80d6f1f02a01b914b451cd3e52ba68480732fb7f06171864a94df58
Instruction Fuzzy Hash: F02127759003599FDB10CFAAC885BEEBBF5FF48310F108429E919A7240D7789941CBA0

Function 052B5C40 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 052B5CC8

Strings

BEjL, xrefs: 052B5C67

Memory Dump Source

Source File: 00000000.00000002.1558597176.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52b0000_QUOTATION-9044456778.jbxd

Similarity

API ID: MemoryProcessRead
String ID: BEjL
API String ID: 1726664587-2255523351
Opcode ID: a0b4d8631ffe7818037ddb7b2fc0a6a397debedf00927e22774e935a9cd45f64
Instruction ID: 5b4d02a25d5379f34f496db27a9fd8c34b8f0ee5f6786ea8c24a3063eeb5b827
Opcode Fuzzy Hash: a0b4d8631ffe7818037ddb7b2fc0a6a397debedf00927e22774e935a9cd45f64
Instruction Fuzzy Hash: 38212871D003599FDB10CFAAC885BEEBBF5FF48310F14842AE919A7250D7799941CBA0

Function 052B5588 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 052B5606

Strings

BEjL, xrefs: 052B55A4

Memory Dump Source

Source File: 00000000.00000002.1558597176.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52b0000_QUOTATION-9044456778.jbxd

Similarity

API ID: ContextThreadWow64
String ID: BEjL
API String ID: 983334009-2255523351
Opcode ID: 39ab396693dd42788c5dd181b1dcce57fc45f59f64b06e0b5140ffe0bbd28b7c
Instruction ID: 637e08821f827b306d6119c5c4afbfb4aeb32c8b0a9783f5aab65ea6dec202c5
Opcode Fuzzy Hash: 39ab396693dd42788c5dd181b1dcce57fc45f59f64b06e0b5140ffe0bbd28b7c
Instruction Fuzzy Hash: 35212371D103098FEB10DFAAC4857EEBBF5EF48360F14842AD419A7240DBB8A945CFA4

Function 052B5C48 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 052B5CC8

Strings

BEjL, xrefs: 052B5C67

Memory Dump Source

Source File: 00000000.00000002.1558597176.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52b0000_QUOTATION-9044456778.jbxd

Similarity

API ID: MemoryProcessRead
String ID: BEjL
API String ID: 1726664587-2255523351
Opcode ID: 71da744acb47f6e2d650d6cb36e6b06daf1384b5a0199c657084116d93b358ad
Instruction ID: 5296db9ce35b91b94ddf7ef2d66fa6285edbc3db428c2c02a6223112f8309bdc
Opcode Fuzzy Hash: 71da744acb47f6e2d650d6cb36e6b06daf1384b5a0199c657084116d93b358ad
Instruction Fuzzy Hash: 4221F871D003599FDB10DFAAC885BEEBBF5FF48310F108429E919A7250D7799941CBA4

Function 0306FD48 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0306FDCF

Strings

BEjL, xrefs: 0306FD67

Memory Dump Source

Source File: 00000000.00000002.1541063975.0000000003060000.00000040.00000800.00020000.00000000.sdmp, Offset: 03060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3060000_QUOTATION-9044456778.jbxd

Similarity

API ID: DuplicateHandle
String ID: BEjL
API String ID: 3793708945-2255523351
Opcode ID: 7df7cfa39a478700987d8540496bbcc1040c0f03e65a637aed3b00bd841337dd
Instruction ID: d45f6ea12dadad54890679f3350248876bd719f74335fc198a5f3187886f3408
Opcode Fuzzy Hash: 7df7cfa39a478700987d8540496bbcc1040c0f03e65a637aed3b00bd841337dd
Instruction Fuzzy Hash: 2D21E2B59002499FDB10CFAAD884ADEFBF9FB48310F14841AE918A7310D378A940CFA4

Function 052B5587 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 61
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 052B5606

Strings

BEjL, xrefs: 052B55A4

Memory Dump Source

Source File: 00000000.00000002.1558597176.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52b0000_QUOTATION-9044456778.jbxd

Similarity

API ID: ContextThreadWow64
String ID: BEjL
API String ID: 983334009-2255523351
Opcode ID: 4b10379f52ab9ec4380c147f1bd711406b2cb5a15bec8fd808e1fd8509a67eb9
Instruction ID: e298575dd5d85b16d94a1e1207b742ba35de19c8c2969164e6fd931e5b25a59a
Opcode Fuzzy Hash: 4b10379f52ab9ec4380c147f1bd711406b2cb5a15bec8fd808e1fd8509a67eb9
Instruction Fuzzy Hash: FF2134B5D103098FEB10CFAAC4857EEBBF5BF48360F14842AD419A7240DB789945CFA0

Function 052B5A90 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 052B5B06

Strings

BEjL, xrefs: 052B5AAF

Memory Dump Source

Source File: 00000000.00000002.1558597176.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52b0000_QUOTATION-9044456778.jbxd

Similarity

API ID: AllocVirtual
String ID: BEjL
API String ID: 4275171209-2255523351
Opcode ID: 969b70d52abe79870c23d190fef2110e5c6276a6d69f08d6b83323eb6c05cd0e
Instruction ID: 0b4edc329f9d6bf423e6caac0fd69f15da982041c4b74618cbd2bce8bdf06b69
Opcode Fuzzy Hash: 969b70d52abe79870c23d190fef2110e5c6276a6d69f08d6b83323eb6c05cd0e
Instruction Fuzzy Hash: BF1136719002499BDB20DFAAC845BDEBBF5EF49320F148419E919A7250CA799941CBA0

Function 052B5A98 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 052B5B06

Strings

BEjL, xrefs: 052B5AAF

Memory Dump Source

Source File: 00000000.00000002.1558597176.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52b0000_QUOTATION-9044456778.jbxd

Similarity

API ID: AllocVirtual
String ID: BEjL
API String ID: 4275171209-2255523351
Opcode ID: e17429ee44155e84717ea9760eb923509ba5cf64bb747d8bded6227233acbda1
Instruction ID: 360f4023193ddfb36a8108158cf32c4e483c0dda788d8a6761c17b4c22d0cf0a
Opcode Fuzzy Hash: e17429ee44155e84717ea9760eb923509ba5cf64bb747d8bded6227233acbda1
Instruction Fuzzy Hash: A41137759003499FDB20DFAAC844BDEBBF5FF48320F148419E519A7250CB79A941CFA0

Function 052B5099 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 052B5102

Strings

BEjL, xrefs: 052B50B7

Memory Dump Source

Source File: 00000000.00000002.1558597176.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52b0000_QUOTATION-9044456778.jbxd

Similarity

API ID: ResumeThread
String ID: BEjL
API String ID: 947044025-2255523351
Opcode ID: d1de5d4b0199caaf2308d8ac9d56dadc4d966b93e4949df0c979d7f309879910
Instruction ID: 864ff058c06fbf9ed53af8cd76bf5987307c166d0065762166301acfe4e26eaa
Opcode Fuzzy Hash: d1de5d4b0199caaf2308d8ac9d56dadc4d966b93e4949df0c979d7f309879910
Instruction Fuzzy Hash: 90111971D003498FDB20DFAAC4457DEBBF5EF48324F148419D519A7240DA79A941CFA4

Function 052B50A0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 052B5102

Strings

BEjL, xrefs: 052B50B7

Memory Dump Source

Source File: 00000000.00000002.1558597176.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52b0000_QUOTATION-9044456778.jbxd

Similarity

API ID: ResumeThread
String ID: BEjL
API String ID: 947044025-2255523351
Opcode ID: 45f27a1a31fc7fa0e71526a52767e67fe5828440d22a0c471c7830eefc486670
Instruction ID: 32eb7a190d0a0038def84895ba906a25c6a2edfd75d320c78e0cd863ea75302d
Opcode Fuzzy Hash: 45f27a1a31fc7fa0e71526a52767e67fe5828440d22a0c471c7830eefc486670
Instruction Fuzzy Hash: 291125B1D003488FDB20DFAAC8457EEFBF5EF88320F248419D519A7240DA79A941CFA4

Function 052B4348 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 052B8085

Strings

BEjL, xrefs: 052B8042

Memory Dump Source

Source File: 00000000.00000002.1558597176.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52b0000_QUOTATION-9044456778.jbxd

Similarity

API ID: MessagePost
String ID: BEjL
API String ID: 410705778-2255523351
Opcode ID: 6846001782e94422414df88c4a34b7321bd4284f2cd327a6fa3281ec023bcf99
Instruction ID: b292b0fdb5b91d0baf2c15643361382d34d848f2530384406a968c3233eb012e
Opcode Fuzzy Hash: 6846001782e94422414df88c4a34b7321bd4284f2cd327a6fa3281ec023bcf99
Instruction Fuzzy Hash: 491106B5800349DFDB20CF9AC445BDEBBF8FB48350F108819E959A7200C3B9A944CFA5

Function 0306DA60 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0306DAC6

Strings

BEjL, xrefs: 0306DA7F

Memory Dump Source

Source File: 00000000.00000002.1541063975.0000000003060000.00000040.00000800.00020000.00000000.sdmp, Offset: 03060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3060000_QUOTATION-9044456778.jbxd

Similarity

API ID: HandleModule
String ID: BEjL
API String ID: 4139908857-2255523351
Opcode ID: 5a7d2a6e4ab936060b119ca4debf4f856d02d9ee998376e4919e67b73369821a
Instruction ID: 9f73dc9125e86b195ba2bb9ed3262589201e52735b8703f2035bad90c32a73a8
Opcode Fuzzy Hash: 5a7d2a6e4ab936060b119ca4debf4f856d02d9ee998376e4919e67b73369821a
Instruction Fuzzy Hash: F51110B5D042498FCB20CF9AC844BDEFBF5EF88220F14841AD829A7610C379A545CFA1

Function 052B8020 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 052B8085

Strings

BEjL, xrefs: 052B8042

Memory Dump Source

Source File: 00000000.00000002.1558597176.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52b0000_QUOTATION-9044456778.jbxd

Similarity

API ID: MessagePost
String ID: BEjL
API String ID: 410705778-2255523351
Opcode ID: 38755ecdbd7d274bb970bf512f9236f74f73fcb17dbcc7bceb1220436b10d1b4
Instruction ID: 52c392f46d4fefd0979f66028a6fde2f92c30df743c3f8b9f386817c387dc36b
Opcode Fuzzy Hash: 38755ecdbd7d274bb970bf512f9236f74f73fcb17dbcc7bceb1220436b10d1b4
Instruction Fuzzy Hash: 061106B58003499FDB10CF9AC885BDEBFF8FB48364F148819E959A7200C379A944CFA5

Function 014CD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1540514745.00000000014CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14cd000_QUOTATION-9044456778.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5a6ab57471d1d885da2e61a1c646315d8bf9fa993096716801a6fc37cb44bf2
Instruction ID: 62dad13cb4a5a8924b86ac9f5b4f43e5643172f7fed439c31a3a232a69ec9bbb
Opcode Fuzzy Hash: f5a6ab57471d1d885da2e61a1c646315d8bf9fa993096716801a6fc37cb44bf2
Instruction Fuzzy Hash: A521007A900240DFDB45DF54D8C0B26BB61EB98618F20C57EE9090A266C336D446CAA2

Function 014CD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1540514745.00000000014CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14cd000_QUOTATION-9044456778.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ac7f1a24f9401bc1f294f224536a3e56e8137dc4afdd117cb1573ce21bbd758
Instruction ID: a6cff78442a1d0c65b1cd5fade43ae81bdd5f0625fe3482d96b05a54fcf47ba9
Opcode Fuzzy Hash: 9ac7f1a24f9401bc1f294f224536a3e56e8137dc4afdd117cb1573ce21bbd758
Instruction Fuzzy Hash: 4A21F479900204DFDB45DF54D9C0B66FB65FB88714F20C17EDA090B266C336E456CAE6

Function 014ED01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1540589225.00000000014ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 014ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14ed000_QUOTATION-9044456778.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6462df40d29ca9d1dc65fc142876c3244711fac028ed41a048fe2e7e16712641
Instruction ID: ac81ce5dbb686fec2235dce2b5375761a6015ba7fe3a5d0eb14c8212cb35e916
Opcode Fuzzy Hash: 6462df40d29ca9d1dc65fc142876c3244711fac028ed41a048fe2e7e16712641
Instruction Fuzzy Hash: 962103B1904300DFDB15DF54D888B16BFA1EB84259F28C56AD80A0B366C33AD447CA61

Function 014ED1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1540589225.00000000014ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 014ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14ed000_QUOTATION-9044456778.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac21540ffd42525cc728f7bbe21eb075bdb4ca65baef12b68363f367ce88ea55
Instruction ID: b039ad253fc8ca8d8e53de6385f06d3b6553a0307143641bd53b4564175a29f1
Opcode Fuzzy Hash: ac21540ffd42525cc728f7bbe21eb075bdb4ca65baef12b68363f367ce88ea55
Instruction Fuzzy Hash: 00210775904344DFDB05DF94D9C4F16BBA5FB84325F20C56ED8494B3A2C336D446CA61

Function 014ED006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1540589225.00000000014ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 014ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14ed000_QUOTATION-9044456778.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c5d7ded5bcc810353d8ad08c6c578eae9b35ae65d158ebf50897100848193ad
Instruction ID: 27a6be93199dadebd28653827faf810ba82e93c31d3f638a2aaf428dd7712dd2
Opcode Fuzzy Hash: 9c5d7ded5bcc810353d8ad08c6c578eae9b35ae65d158ebf50897100848193ad
Instruction Fuzzy Hash: B12183755093808FCB06CF24D594716BFB1EB46214F28C5DBD8498B267C33A980ACB62

Function 014CD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1540514745.00000000014CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14cd000_QUOTATION-9044456778.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1166f709330a6c50fb0ccab333658baa4cf0de4601631cd9e1789cef95a599a7
Instruction ID: 53e696a8fdaef5fb851bb8c4912880cee2863694efe567e272249dad271e9b73
Opcode Fuzzy Hash: 1166f709330a6c50fb0ccab333658baa4cf0de4601631cd9e1789cef95a599a7
Instruction Fuzzy Hash: AA11CD76804240DFCB06CF44D9C0B56BF61FB84224F2482BED9090B266C33AE456CBA1

Function 014CD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1540514745.00000000014CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14cd000_QUOTATION-9044456778.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1166f709330a6c50fb0ccab333658baa4cf0de4601631cd9e1789cef95a599a7
Instruction ID: 8fdb9b4af38adf290400e739b28d6b52e876607fe833e446238ac27731d5511e
Opcode Fuzzy Hash: 1166f709330a6c50fb0ccab333658baa4cf0de4601631cd9e1789cef95a599a7
Instruction Fuzzy Hash: 3411AF76904280CFCB16CF54D9C4B16BF71FB98714F24C6AED8490B666C336D456CBA1

Function 014ED1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1540589225.00000000014ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 014ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14ed000_QUOTATION-9044456778.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5930c3722e95abe2067eb95ddfb8aa1848112c8b53b048d5b6b565b5491e75cf
Instruction ID: 18b9cb934944c6518b24ef09bddfcc4d6e31dfb8b3e614e791db30afe6e26c47
Opcode Fuzzy Hash: 5930c3722e95abe2067eb95ddfb8aa1848112c8b53b048d5b6b565b5491e75cf
Instruction Fuzzy Hash: 2711BB75904280DFCB06CF54C5C4B16BFA1FB84224F24C6AAD8494B3A6C33AD40ACB61

Function 014CD745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1540514745.00000000014CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14cd000_QUOTATION-9044456778.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff50cc45545e3e130ca3e524d1325c58d9abbac5807e5914fdd9c2e7e0b13d76
Instruction ID: 3b4f3debd68060a52cfd74df11555de907e67bcb7db81579a3d91248ad598493
Opcode Fuzzy Hash: ff50cc45545e3e130ca3e524d1325c58d9abbac5807e5914fdd9c2e7e0b13d76
Instruction Fuzzy Hash: E801F7398063809AF7619A55CC84B67BBA8DF41A64F04C53FED090A292D3799842CAF5

Function 014CD744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1540514745.00000000014CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14cd000_QUOTATION-9044456778.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41e6dec0ea62ee914941cf117353d98aae2c1bae850af6a8e2a0a3d87faf5d48
Instruction ID: 3a9d116866c7bf29f9423359de4a3c683efc39a82591f33d71b49923d3786e40
Opcode Fuzzy Hash: 41e6dec0ea62ee914941cf117353d98aae2c1bae850af6a8e2a0a3d87faf5d48
Instruction Fuzzy Hash: 78F06275405384AEE7208E19CCC4B63FF98EB81674F18C46AED095F696C2799845CEB1

Non-executed Functions

Function 052B2C38 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1558597176.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52b0000_QUOTATION-9044456778.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3b611462f0b6b52f8c130e137d5cc95652d5bbfc8f2062f6dbcbe54446f3aa7
Instruction ID: 3e35c1857870208f12809fe0cfc445951fcc56e691bbe437cfc968528c072316
Opcode Fuzzy Hash: e3b611462f0b6b52f8c130e137d5cc95652d5bbfc8f2062f6dbcbe54446f3aa7
Instruction Fuzzy Hash: 47E1F874E142198FEB14CFA9C580AAEFBB2FF89304F248169D454AB355D771AD42CF60

Function 052B34A8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1558597176.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52b0000_QUOTATION-9044456778.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61cd4f55caff9e18beab85719ba3fcf5693eb0da809dcaddaebdc3554ebb67b6
Instruction ID: f301501071b232cc145b0289c03a9e3730251bae467dce6a2ec8bde81fb19a2e
Opcode Fuzzy Hash: 61cd4f55caff9e18beab85719ba3fcf5693eb0da809dcaddaebdc3554ebb67b6
Instruction Fuzzy Hash: 60E12774E142198FEB14CFA9C580AAEFBB2FF89304F248569D454AB355D770AD42CFA0

Function 052B5660 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1558597176.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52b0000_QUOTATION-9044456778.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a139e78b2ccc03af8deedb31576d4fb727e8801cac66d57469320ae4fbd4be2
Instruction ID: 0f56fa114453fe5119d334cfe26e20ea6ec804cf6d0357b381640283d0365ba5
Opcode Fuzzy Hash: 3a139e78b2ccc03af8deedb31576d4fb727e8801cac66d57469320ae4fbd4be2
Instruction Fuzzy Hash: 6EE1E674E142198FEB14CFA9C580AAEFBB2FF89304F248169D455AB355D770AD42CF60

Function 052B5150 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1558597176.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52b0000_QUOTATION-9044456778.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69f03d9753c99541cac2aaac3d9f5dcf5858bf88d4d2ee193a4408bfebce1d9d
Instruction ID: c2be132eb30af4cdf6ab2c357b6adad4f925ef0164f0e4c6f696920c80bb830a
Opcode Fuzzy Hash: 69f03d9753c99541cac2aaac3d9f5dcf5858bf88d4d2ee193a4408bfebce1d9d
Instruction Fuzzy Hash: 32E10474E142198FEB14CFA8D580AAEBBF2FF89305F248169D458AB355D770AD42CF60

Function 052B3070 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1558597176.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52b0000_QUOTATION-9044456778.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a659193743632cf7a9ee41589f1e44459efac33e6d11b6595da0a6cbf1b35cc2
Instruction ID: 67a6c627e9aea034609af8db2139acf6a1381ec3e451ab6249b6f4aae4f9c865
Opcode Fuzzy Hash: a659193743632cf7a9ee41589f1e44459efac33e6d11b6595da0a6cbf1b35cc2
Instruction Fuzzy Hash: 8CE11974E142198FEB14CFA9C580AAEFBB2FF89304F248569D454AB355D770AD42CFA0

Function 052B2C28 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1558597176.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52b0000_QUOTATION-9044456778.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b338b6c3f670830eb38ed93b224df04e7805636d2696379f93d08b9883e72e38
Instruction ID: c48c5afb78b0926eeb682b7eaa64bdb394613f3dcb013b499e621cedc2f39156
Opcode Fuzzy Hash: b338b6c3f670830eb38ed93b224df04e7805636d2696379f93d08b9883e72e38
Instruction Fuzzy Hash: 98512A74E142198FDB14CFA9C580AAEFBF2FF89304F24C169D418A7256D7719942CFA1

Function 052B513F Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1558597176.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52b0000_QUOTATION-9044456778.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b880155a5caa907ea893bfb0441933a7ac5b81619cdcc1c2099522c15d9f2877
Instruction ID: f99fd1d4bfb881bda8c288fec944ca517f2fc3529f12c10d97577b8947325000
Opcode Fuzzy Hash: b880155a5caa907ea893bfb0441933a7ac5b81619cdcc1c2099522c15d9f2877
Instruction Fuzzy Hash: FD512874E142198FDB14CFA9C9806AEFBF2FF89300F248169D458AB355D7709A42CFA1

Function 052B7532 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1558597176.00000000052B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52b0000_QUOTATION-9044456778.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f14598d860b8a0b009819487454100f92e3fc9414653e7e0a3dea28c7c93d2c
Instruction ID: 8cc6d05915478155a686f7e4728a2c876a6841475782d9fe89c8761afdcb42b3
Opcode Fuzzy Hash: 7f14598d860b8a0b009819487454100f92e3fc9414653e7e0a3dea28c7c93d2c
Instruction Fuzzy Hash: F2C04C269BE108DAA9108984A5054F8BB3EDADB3A6F053051D11EA24024FE051544A94

Analysis Process: QUOTATION-9044456778.pdf (83kb).com.exePID: 2848, Parent PID: 2916COMMON

Execution Graph

Execution Coverage:	9.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	433
Total number of Limit Nodes:	37

Executed Functions

Function 0188BFF0 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0188C256

Memory Dump Source

Source File: 00000003.00000002.1573656798.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1880000_QUOTATION-9044456778.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f45c2bb9b4310fdd7a58ed02357b695818fe2457294edffce0bbc554d94fe11b
Instruction ID: 56a4462ea874057ff3e04b72ebac083101901b9d73a9af04f5c247f0be87ac93
Opcode Fuzzy Hash: f45c2bb9b4310fdd7a58ed02357b695818fe2457294edffce0bbc554d94fe11b
Instruction Fuzzy Hash: 898169B0A00B058FE725DF69C44079ABBF1FF48344F00892ED58AD7A54D775EA46CBA1

Function 05A1C90C Relevance: 1.6, APIs: 1, Instructions: 118
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumThreadWindows.USER32(?,00000000,?), ref: 05A1E259

Memory Dump Source

Source File: 00000003.00000002.1606407585.0000000005A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a10000_QUOTATION-9044456778.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: 5e8f1c275d9a2fe72a7ac82bd13a12ad3b30c108489568f38449af5057c309d1
Instruction ID: f3643b88540654e461250a813e6ce9686f549c021354c91b7635310c701f3308
Opcode Fuzzy Hash: 5e8f1c275d9a2fe72a7ac82bd13a12ad3b30c108489568f38449af5057c309d1
Instruction Fuzzy Hash: BE41B471A04219CFDB14CF99C844BAEBBF9FF88320F14842AD819E7350DB789945CB69

Function 01886780 Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0188674E,?,?,?,?,?), ref: 0188680F

Memory Dump Source

Source File: 00000003.00000002.1573656798.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1880000_QUOTATION-9044456778.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e0428942e546ed148e770327524eff3d01174c9e70c7490568fdbd61a8306288
Instruction ID: 09744c791238bd0561cc03ece8ab4f4f2c69b682307dcbd2876e30f1b2aa14a8
Opcode Fuzzy Hash: e0428942e546ed148e770327524eff3d01174c9e70c7490568fdbd61a8306288
Instruction Fuzzy Hash: E0413876900248AFCF01DF99D884ADEBFF9EB48310F14801AE914E7311D735A950CFA5

Function 05A12B64 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05A14411

Memory Dump Source

Source File: 00000003.00000002.1606407585.0000000005A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a10000_QUOTATION-9044456778.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: d6c51dde30f1ed9b9ff6442385b54c0f4231b3c6e0725904dfbb8bdd7777d304
Instruction ID: f8c6f000d4915429a44ae0ff5ffdd809c6d518677e2bcaa196b5ecaf0f03ea52
Opcode Fuzzy Hash: d6c51dde30f1ed9b9ff6442385b54c0f4231b3c6e0725904dfbb8bdd7777d304
Instruction Fuzzy Hash: DF41F8B99003058FDB14CF99C488EAABBF5FB88314F24C459D929AB321D775A841CBA5

Function 01886414 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 01887421

Memory Dump Source

Source File: 00000003.00000002.1573656798.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1880000_QUOTATION-9044456778.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 8fec39a30cbd837ffca56db01c83f8a691725ec222100d561e44c2b93862dc13
Instruction ID: 0bd925e44ec794fcdb51247de8302ca4fbcb0e54e2dcdee6b44670706da614a6
Opcode Fuzzy Hash: 8fec39a30cbd837ffca56db01c83f8a691725ec222100d561e44c2b93862dc13
Instruction Fuzzy Hash: 4441A2B0C0471DCBEB24DFA9C884B9DBBB6BF49304F20805AD418AB251D7796946CF90

Function 01887364 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 01887421

Memory Dump Source

Source File: 00000003.00000002.1573656798.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1880000_QUOTATION-9044456778.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 90f15fdba7be3c2c62df2274b84646f364f658e5d447b2f5430e654be528a8d3
Instruction ID: 01ee4aa24939e158328387fdb9850c4c15044f12726c1c67c0688040eb153039
Opcode Fuzzy Hash: 90f15fdba7be3c2c62df2274b84646f364f658e5d447b2f5430e654be528a8d3
Instruction Fuzzy Hash: F041A2B1C00719CFEB24DFA9C884B8DBBB5BF49305F24805AD418AB251D7796946CF90

Function 05A1B168 Relevance: 1.6, APIs: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.1606407585.0000000005A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a10000_QUOTATION-9044456778.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 04a9a024ef784d2faca60bd4b46c207722c8a0f3e2eaf63058474f1342aa8040
Instruction ID: 73a2d3b1feed1dc733a2065c4b3c2c1384a912ad9266273853989da599a296a3
Opcode Fuzzy Hash: 04a9a024ef784d2faca60bd4b46c207722c8a0f3e2eaf63058474f1342aa8040
Instruction Fuzzy Hash: A4317A719003899FCB11DFA9D844AEEBFF8EF09250F14805AE954A7261C3359854CBA5

Function 0188611C Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0188674E,?,?,?,?,?), ref: 0188680F

Memory Dump Source

Source File: 00000003.00000002.1573656798.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1880000_QUOTATION-9044456778.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2a6e70b81e0f2ec742701ac8ea72b3041f85b6afa8b9f9c053679d628bdba107
Instruction ID: 207cb945dc32e9e4923739ff4f2060660b4555aa224e0951efca5178c315b221
Opcode Fuzzy Hash: 2a6e70b81e0f2ec742701ac8ea72b3041f85b6afa8b9f9c053679d628bdba107
Instruction Fuzzy Hash: 2721E3B5D00348AFDB10DF9AD984ADEBBF4EB48310F14841AE918A7310D379AA44CFA5

Function 05A1C91C Relevance: 1.6, APIs: 1, Instructions: 62
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumThreadWindows.USER32(?,00000000,?), ref: 05A1E259

Memory Dump Source

Source File: 00000003.00000002.1606407585.0000000005A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a10000_QUOTATION-9044456778.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: aaa288279c2c6991346e5e239eab5886daa5278384db622d7a5f956fe225df21
Instruction ID: f758f25d7993288cc5551f6e03b85622b934fadfa0faf7fd85f17519a37967c0
Opcode Fuzzy Hash: aaa288279c2c6991346e5e239eab5886daa5278384db622d7a5f956fe225df21
Instruction Fuzzy Hash: 4D211875900209CFDB14CF9AC844BEEFBF9FB88310F14842AE825A7250D778A945CFA5

Function 05A19D7C Relevance: 1.6, APIs: 1, Instructions: 56
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?,?,?,?,05A1B182,?,?,?,?,?), ref: 05A1B227

Memory Dump Source

Source File: 00000003.00000002.1606407585.0000000005A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a10000_QUOTATION-9044456778.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 928968186bb462f46dc362f9e7d13b671b4106f16fd080efd61959ad808190e8
Instruction ID: 8992060e6bbb5051fef308c58a61da3f0475bd72f8d212f9815e0638a22fdfc5
Opcode Fuzzy Hash: 928968186bb462f46dc362f9e7d13b671b4106f16fd080efd61959ad808190e8
Instruction Fuzzy Hash: 371114B590034D9FDB10CF9AD944BEEBFF8EB48320F14841AE918A7250C379A954CFA5

Function 0188C1F0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0188C256

Memory Dump Source

Source File: 00000003.00000002.1573656798.0000000001880000.00000040.00000800.00020000.00000000.sdmp, Offset: 01880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1880000_QUOTATION-9044456778.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: c985eec37e3046847addd32f4652411118be0e1b94b478845aafb5ff9bd886d3
Instruction ID: cb22fb0fe1b31c94f5753021d7c03d70e403675a73d26f4938ae29aea2b36d97
Opcode Fuzzy Hash: c985eec37e3046847addd32f4652411118be0e1b94b478845aafb5ff9bd886d3
Instruction Fuzzy Hash: 1E1110B5C002498FDB20DF9AC444BDEFBF4EB88310F10841AD929A7650D379A645CFA5

Function 05A12010 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowLongW.USER32(?,?,?), ref: 05A12075

Memory Dump Source

Source File: 00000003.00000002.1606407585.0000000005A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a10000_QUOTATION-9044456778.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 2edd93ff1463d9258b42652806d8de5b8e72062b6025faaa522c135d90d62423
Instruction ID: 4697277477be6e244cc870c5b958ee36e660650da414f569bae4b6f0eaec5dc8
Opcode Fuzzy Hash: 2edd93ff1463d9258b42652806d8de5b8e72062b6025faaa522c135d90d62423
Instruction Fuzzy Hash: 7F11F2B5800349DFDB20CF9AD485BDEBBF8EB48320F20851AD959A3700D379A944CFA5

Function 05A19DC0 Relevance: 1.5, APIs: 1, Instructions: 47
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageW.USER32(?,?,?,?), ref: 05A1B58D

Memory Dump Source

Source File: 00000003.00000002.1606407585.0000000005A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a10000_QUOTATION-9044456778.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: f9f7c94513057356d9ac33bbbb18fb6d81a24429ca8e5be0ea280bc6131bbc71
Instruction ID: 9d16b6abba2a9bbcdd42f1d3729dfa56b53003201e60994cb91da997ff1e9904
Opcode Fuzzy Hash: f9f7c94513057356d9ac33bbbb18fb6d81a24429ca8e5be0ea280bc6131bbc71
Instruction Fuzzy Hash: AA11F2B580034C9FDB20DF9AD485BDEBBF8EB48320F108419E929A7200D379A944CFA5

Function 05A1B52B Relevance: 1.5, APIs: 1, Instructions: 45
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageW.USER32(?,?,?,?), ref: 05A1B58D

Memory Dump Source

Source File: 00000003.00000002.1606407585.0000000005A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a10000_QUOTATION-9044456778.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 4d4f80896e4a64a754dfe087f268baea2cc132ad968d87c5965dc282ad1fe630
Instruction ID: 47374ae28fb54ad4b1ea8495e9df6d73b1f72b90a09108a237dea762cd7256ca
Opcode Fuzzy Hash: 4d4f80896e4a64a754dfe087f268baea2cc132ad968d87c5965dc282ad1fe630
Instruction Fuzzy Hash: B111D3B58003499FDB10DF9AD885BDEBFF8EB48324F148419E929A7200D379A944CFA5

Function 05A12018 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 05A12075

Memory Dump Source

Source File: 00000003.00000002.1606407585.0000000005A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a10000_QUOTATION-9044456778.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: b50956b0a52411e462066a2321e9fdb673ed60f41b31e034fa68c9fe72918c35
Instruction ID: 6adef02af354ca358ab9c193eebe5b4330b1ee8e49c5543724815ad45a67061e
Opcode Fuzzy Hash: b50956b0a52411e462066a2321e9fdb673ed60f41b31e034fa68c9fe72918c35
Instruction Fuzzy Hash: 8D1103B58002498FDB20CF9AC485BDEBBF8EB48320F10851AD959A3300D379A944CFA5

Function 0183D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1571922395.000000000183D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0183D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_183d000_QUOTATION-9044456778.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53e938bf52e329d0e5b1fdf799f927d58bcf69a8d6dee808a612917070ad121b
Instruction ID: 6727b008f74e0b538e3ad8aa9b49d0d4f31d3eb71c0f7c536464c4a44972f415
Opcode Fuzzy Hash: 53e938bf52e329d0e5b1fdf799f927d58bcf69a8d6dee808a612917070ad121b
Instruction Fuzzy Hash: 6D213071604304DFDB15DFA4D8D0B16FB61EBC8714F68C669E80A8B242C33AD907CAA2

Function 0183D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1571922395.000000000183D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0183D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_183d000_QUOTATION-9044456778.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5930c3722e95abe2067eb95ddfb8aa1848112c8b53b048d5b6b565b5491e75cf
Instruction ID: 6eac4b1e25d17f32ba8761ba13f886a015c183d72aeb136029b8171eaeda811f
Opcode Fuzzy Hash: 5930c3722e95abe2067eb95ddfb8aa1848112c8b53b048d5b6b565b5491e75cf
Instruction Fuzzy Hash: 8B11BB75504280CFCB16CF54D5D4B15FFA2FB88714F28C6AAD8498B656C33AD50BCBA2

Analysis Process: Exccelworkbook.exePID: 5908, Parent PID: 2848COMMON

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	295
Total number of Limit Nodes:	15

Executed Functions

Function 05BBCBE8 Relevance: 5.3, Strings: 4, Instructions: 323
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,q, xrefs: 05BBCD0C
,q, xrefs: 05BBCD00
Hq, xrefs: 05BBCFA9
d8q, xrefs: 05BBD098

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID: ,q$,q$Hq$d8q
API String ID: 0-2404486864
Opcode ID: 0a2ce17f80088bc034f58b54625fe5dc157aeb0561f3d5b594b9f08eefe253e4
Instruction ID: 53bddfd12f9767cde6a73edf650cda3531996779edfcaaf970f596c3fba2cb7e
Opcode Fuzzy Hash: 0a2ce17f80088bc034f58b54625fe5dc157aeb0561f3d5b594b9f08eefe253e4
Instruction Fuzzy Hash: B1C14E30B102199FEB14DF69D954ABE7BB6FF88640F148069E406E7390DBB5EC41CB91

Function 05BB806E Relevance: 4.1, Strings: 3, Instructions: 360
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fq, xrefs: 05BB8357
fq, xrefs: 05BB84D1
fq, xrefs: 05BB8367

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID: fq$ fq$ fq
API String ID: 0-2888945447
Opcode ID: 8b4274c4c73aa841c8440c8121366840946042350bd23a8ce03260c1334af25b
Instruction ID: e41d3758496981d80c6b1773aba802cc8da01ab4bee598a6ff5cb22d4ac44115
Opcode Fuzzy Hash: 8b4274c4c73aa841c8440c8121366840946042350bd23a8ce03260c1334af25b
Instruction Fuzzy Hash: 54D16930A04258CFEB14CA94C854BBDB7BAFB84310F2485A6F516AB395DBF4EC81CB51

Function 05BBD5A0 Relevance: 2.7, Strings: 2, Instructions: 239
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8q, xrefs: 05BBD9A1
8q, xrefs: 05BBD97C

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID: 8q$8q
API String ID: 0-4291441500
Opcode ID: c1d49607589af96727fe63ba24daf5d1ecd33981e8c84a3241d97f1c47da7798
Instruction ID: b9f4218b57b2a2c21b74c05d3cd07127bdea6d312fa989d215bdf002ac6e3507
Opcode Fuzzy Hash: c1d49607589af96727fe63ba24daf5d1ecd33981e8c84a3241d97f1c47da7798
Instruction Fuzzy Hash: EE81C230B141058FEB14DB698854BBE7BA2FF85201F2840AAD44ACB391DAF9ED45C796

Function 05BB0448 Relevance: 2.7, Strings: 2, Instructions: 212
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hq, xrefs: 05BB0510
Hq, xrefs: 05BB0576

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID: Hq$Hq
API String ID: 0-925789375
Opcode ID: e2f6889e5b0af4452c4731885b039183dd80f5f0c251da23d77bb6fe6da45b38
Instruction ID: d4abe7841dc7d994bd86230aa3a653b95a947c27683b7e07d81f8f1de57c649b
Opcode Fuzzy Hash: e2f6889e5b0af4452c4731885b039183dd80f5f0c251da23d77bb6fe6da45b38
Instruction Fuzzy Hash: 91816C70E003199FDB14DFA9C8946EEBBB2FF88300F24856AE405AB350DBB49941CB91

Function 05BB8219 Relevance: 2.7, Strings: 2, Instructions: 204
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fq, xrefs: 05BB8357
fq, xrefs: 05BB84D1

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID: fq$ fq
API String ID: 0-1977554630
Opcode ID: eebf0be14ca952af635ff2f9aee30b7c1e6ce91503b3803919d593c351fbb9d5
Instruction ID: eca930e92dd4bd3181d9b4e6a8b4c0140d755e9240a37f3b8c9c6ebcb2d070f2
Opcode Fuzzy Hash: eebf0be14ca952af635ff2f9aee30b7c1e6ce91503b3803919d593c351fbb9d5
Instruction Fuzzy Hash: 0A715730A44618DFEB24CA94D945BFCB7BAFB40310F1581A6F516AB291DBF0E882CF51

Function 05BB8200 Relevance: 2.7, Strings: 2, Instructions: 192
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fq, xrefs: 05BB8357
fq, xrefs: 05BB84D1

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID: fq$ fq
API String ID: 0-1977554630
Opcode ID: 46e16725ea087fab6967a4b97798e74159ec7cfebbb349a5587b0f7cf8a0c6c7
Instruction ID: 58cc1d5995d27ddb088bcd07ce58008e929050bf6a2e55511a1c75ea125e2cbf
Opcode Fuzzy Hash: 46e16725ea087fab6967a4b97798e74159ec7cfebbb349a5587b0f7cf8a0c6c7
Instruction Fuzzy Hash: FF713630A44618DFEB24CA94D944BFCB7BAFB40311F1581A6F516AB291DBF4E881CF42

Function 05BB00E8 Relevance: 2.7, Strings: 2, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hq, xrefs: 05BB0FF0
(q, xrefs: 05BB0F32

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID: (q$Hq
API String ID: 0-1154169777
Opcode ID: 9fe267303087f4deae7c2afea3827f9fa35a15f4f4846ef60cf9dc9d05de1171
Instruction ID: 93e5396576d78cac7459c8ea461e954439a95e96641732d157b2518239b27d7b
Opcode Fuzzy Hash: 9fe267303087f4deae7c2afea3827f9fa35a15f4f4846ef60cf9dc9d05de1171
Instruction Fuzzy Hash: 3051F97070020A9FEB19EB68D8597BF7AE6FBC4300F204468E406D73D4DEB49D058799

Function 05BBBF78 Relevance: 2.6, Strings: 2, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(q, xrefs: 05BBBF90
(q, xrefs: 05BBBFBF

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID: (q$(q
API String ID: 0-2485164810
Opcode ID: 1f0440f025cd51c156472e0d5a899cc42770924f65b7dac7f5714b7e2d320940
Instruction ID: 98be09ae078b3659b4d5eb0b49bbab5b1878e360ae1798dce78038a8d8e067f0
Opcode Fuzzy Hash: 1f0440f025cd51c156472e0d5a899cc42770924f65b7dac7f5714b7e2d320940
Instruction Fuzzy Hash: 4811E6306093055FE719EFB9E85065EBBB2EFC1101B2481ADD80A97295DEB0AE04CB51

Function 03425DD4 Relevance: 1.7, APIs: 1, Instructions: 246
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 03426016

Memory Dump Source

Source File: 00000006.00000002.1616392444.0000000003420000.00000040.00000800.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3420000_Exccelworkbook.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: b9b796141d237ca65147b796287bfd68ddaab49a3c77c23c2ecf719cb5362827
Instruction ID: 101ba37c6d1462bd86c4fa2560a08e3a350b8904b1de0a92c73a090caab7f317
Opcode Fuzzy Hash: b9b796141d237ca65147b796287bfd68ddaab49a3c77c23c2ecf719cb5362827
Instruction Fuzzy Hash: B2A15B71D00229DFEB20DF68C94079EFBB2BF49310F1585AAE818BB240DB759985CF95

Function 03425DE0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 03426016

Memory Dump Source

Source File: 00000006.00000002.1616392444.0000000003420000.00000040.00000800.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3420000_Exccelworkbook.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: cc22ce184e85e26bde2c4b0ed152b9b17a19680d4baa00d22d93d3ac2c3ef4ef
Instruction ID: c65b430c1fb509f153d8ddba10c789a129b3a9a26204d38ff90347fc7669b049
Opcode Fuzzy Hash: cc22ce184e85e26bde2c4b0ed152b9b17a19680d4baa00d22d93d3ac2c3ef4ef
Instruction Fuzzy Hash: 14914C71D00229DFEB20DF68C94079EFBB2BF49310F1585AAE818BB240DB759985CF95

Function 05B73FB0 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05B740C2

Memory Dump Source

Source File: 00000006.00000002.1658550062.0000000005B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5b70000_Exccelworkbook.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 4256d7b327b4eece2c7c254b4cabf85b2be77f61c6dcadfcbec36c520c327866
Instruction ID: 211a1d07f098c5764cf9784c22caea4d2f8fa36a0576c2382f577b1f7026ffd6
Opcode Fuzzy Hash: 4256d7b327b4eece2c7c254b4cabf85b2be77f61c6dcadfcbec36c520c327866
Instruction Fuzzy Hash: 86419DB1D002499FDB14CF9AC884ADEBFB5FF48310F24856AE819AB250D775A985CF90

Function 05B73FAD Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05B740C2

Memory Dump Source

Source File: 00000006.00000002.1658550062.0000000005B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5b70000_Exccelworkbook.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: f74a4f076c697d92b5a57248371b3f0647002ba9ff646099831a9109fb9fb354
Instruction ID: 65617190ddebdc6444e5d1932112141e6b9c64a8042be11a13573cda391cb3fb
Opcode Fuzzy Hash: f74a4f076c697d92b5a57248371b3f0647002ba9ff646099831a9109fb9fb354
Instruction Fuzzy Hash: 1641ADB5D002499FDB14CF99C984ADEBFB5FF48300F24866AE819AB250D775A885CF90

Function 05B74E14 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05B767C1

Memory Dump Source

Source File: 00000006.00000002.1658550062.0000000005B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5b70000_Exccelworkbook.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 8f4e93cfd64edd1f2de2bc6c8b3b249c033dce1b0aab9e30ccbce9792cbe92b6
Instruction ID: a4b6e2c2f560d1645b9b9950cf2e9d1b1715f777579b3ffa3a4b6f975a2fa640
Opcode Fuzzy Hash: 8f4e93cfd64edd1f2de2bc6c8b3b249c033dce1b0aab9e30ccbce9792cbe92b6
Instruction Fuzzy Hash: F8410DB59007099FDB14CF55C488EAABBF5FF88314F24C499D919A7321D774A845CFA0

Function 01AF6404 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 01AF7D91

Memory Dump Source

Source File: 00000006.00000002.1615134213.0000000001AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1af0000_Exccelworkbook.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 616d8602710a4986442d05e2656b09386cb87b87bc60c8c0d8645535495d404a
Instruction ID: 22ed5e47e74554c72f0ede36eb2388198bcd0695d9f32f069cd1ec14cae231c2
Opcode Fuzzy Hash: 616d8602710a4986442d05e2656b09386cb87b87bc60c8c0d8645535495d404a
Instruction Fuzzy Hash: 3441D2B1C00718DBEB24CFA9C844B9DBBB5BF48314F60846AE508AB255D7B56946CF90

Function 01AF7CD5 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 01AF7D91

Memory Dump Source

Source File: 00000006.00000002.1615134213.0000000001AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1af0000_Exccelworkbook.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 0e6f27824750107facc34ca35734f9975d48e46587061208c4b99be5c4a70ffe
Instruction ID: 443e4a82c83d79d0253f83a27844cd8fa9ea9d3b99e7886934e95ebaa4ee5001
Opcode Fuzzy Hash: 0e6f27824750107facc34ca35734f9975d48e46587061208c4b99be5c4a70ffe
Instruction Fuzzy Hash: 3641E2B1C00718CFEB24CFA9C884BDDBBB2BF48314F64846AD508AB255D7756946CF90

Function 03425B50 Relevance: 1.6, APIs: 1, Instructions: 71injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 03425BE8

Memory Dump Source

Source File: 00000006.00000002.1616392444.0000000003420000.00000040.00000800.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3420000_Exccelworkbook.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 45761521631f600913e4076e4ee3a2febfa431e701c534afb6bf2412d7a87e16
Instruction ID: 093b5f03891d2e91df0a0f91a070e58ce0f4e5a78091b718574fea1b02a2128c
Opcode Fuzzy Hash: 45761521631f600913e4076e4ee3a2febfa431e701c534afb6bf2412d7a87e16
Instruction Fuzzy Hash: 112124759003199FDB10CFAAC881BEEBBF1FF48310F14842AE918A7240CB799951CBA4

Function 03425B58 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 03425BE8

Memory Dump Source

Source File: 00000006.00000002.1616392444.0000000003420000.00000040.00000800.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3420000_Exccelworkbook.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 8e2c942412266767e6409f593f24909a47bf45548a1ee3d6124025c119022296
Instruction ID: 22043f46bd4de112d536425765909e8b0730b643d71aab8b6975ebe763ab6e8f
Opcode Fuzzy Hash: 8e2c942412266767e6409f593f24909a47bf45548a1ee3d6124025c119022296
Instruction Fuzzy Hash: 3C2124759003599FDB10CFAAC885BEEFBF5FF48310F54842AE919A7240DB789941CBA4

Function 03425C40 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 03425CC8

Memory Dump Source

Source File: 00000006.00000002.1616392444.0000000003420000.00000040.00000800.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3420000_Exccelworkbook.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: e7f68b849e4097d8dce4a31eaa8ed4c22d4be91c0da51ec05e173ededd4cc6e6
Instruction ID: 27f9d209f6c995337c8618dc180f21ec894276a9557a417f56a839e44b743021
Opcode Fuzzy Hash: e7f68b849e4097d8dce4a31eaa8ed4c22d4be91c0da51ec05e173ededd4cc6e6
Instruction Fuzzy Hash: 2F2127718003599FDB10CFAAC981BEEFBF5FF48310F10892AE518A7240D7789541CBA5

Function 03425580 Relevance: 1.6, APIs: 1, Instructions: 67threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 03425606

Memory Dump Source

Source File: 00000006.00000002.1616392444.0000000003420000.00000040.00000800.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3420000_Exccelworkbook.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: adac7bd9eea92c134260494b0e278f934523c9f6d4c566b52a3ccdb7cf920181
Instruction ID: d287ceb94ef7bd212f8cd7a5d4eb2d6365a9f5703e88a6e55a7924cca6013c89
Opcode Fuzzy Hash: adac7bd9eea92c134260494b0e278f934523c9f6d4c566b52a3ccdb7cf920181
Instruction Fuzzy Hash: 85213971D103088FDB20DFAAC485BEEFBF5EF48220F54842AD419A7240DB789945CFA5

Function 03425588 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 03425606

Memory Dump Source

Source File: 00000006.00000002.1616392444.0000000003420000.00000040.00000800.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3420000_Exccelworkbook.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 810b27df12634144da3421f8021e39893cd2cf3e3d9a1c0a03452393a2ee6383
Instruction ID: 5e511db10459391258aa7148ff642250eb75510c46097022bdecda1283eaafb4
Opcode Fuzzy Hash: 810b27df12634144da3421f8021e39893cd2cf3e3d9a1c0a03452393a2ee6383
Instruction Fuzzy Hash: 99213771D003088FDB10DFAAC4857EEFBF5EF48220F54842AD419A7240CB78A945CFA4

Function 03425C48 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 03425CC8

Memory Dump Source

Source File: 00000006.00000002.1616392444.0000000003420000.00000040.00000800.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3420000_Exccelworkbook.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: f253ecf6fdf1d1f1adab695ac341489f763b5a9c24cd28f5767855f8d2fc0779
Instruction ID: 356c7516f364818691435fbed0de8ad9ffecec3ff572c128c5c48097b805e42c
Opcode Fuzzy Hash: f253ecf6fdf1d1f1adab695ac341489f763b5a9c24cd28f5767855f8d2fc0779
Instruction Fuzzy Hash: A12105B18003599FDB10CFAAC880BEEFBF5FF48310F50842AE518A7240D77899458BA4

Function 01AFFD48 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01AFFDCF

Memory Dump Source

Source File: 00000006.00000002.1615134213.0000000001AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1af0000_Exccelworkbook.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b645de0975b912750b51d66312251cf516773d16ee3a301ffa8a82609594ddaa
Instruction ID: 7ddbeba6e2c6849781fb31bf587a27d6fdd189a75c380bdebb74a531da2ecfc9
Opcode Fuzzy Hash: b645de0975b912750b51d66312251cf516773d16ee3a301ffa8a82609594ddaa
Instruction Fuzzy Hash: D021C4B59002499FDB10CF9AD584ADEFBF9FB48310F14841AE918A3350D378A955CF65

Function 03425A90 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 03425B06

Memory Dump Source

Source File: 00000006.00000002.1616392444.0000000003420000.00000040.00000800.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3420000_Exccelworkbook.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a7356fc5d16af98e7d9471eda7bd990aad58a5a6f4e4fcc252e3d0cda01a0fc5
Instruction ID: 86c69be3d0f24e6c02245439fe8694e939bd28daea1d63ffb5afb0c2dedbd668
Opcode Fuzzy Hash: a7356fc5d16af98e7d9471eda7bd990aad58a5a6f4e4fcc252e3d0cda01a0fc5
Instruction Fuzzy Hash: AD1136729002498BDB20DFAAC845BDEFBF5EB48320F14881AE519A7250CB799541CBA0

Function 03425A98 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 03425B06

Memory Dump Source

Source File: 00000006.00000002.1616392444.0000000003420000.00000040.00000800.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3420000_Exccelworkbook.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 966e260fa90e4b54499670f7f8588fbc3d3ec27ecdb24d6282cad1af7f9d7a63
Instruction ID: 9408cd4febf96cc3add17d545e235043a4809b0dfbe1d78d431d544d878373f4
Opcode Fuzzy Hash: 966e260fa90e4b54499670f7f8588fbc3d3ec27ecdb24d6282cad1af7f9d7a63
Instruction Fuzzy Hash: 9B1117759002489FDB20DFAAC844BDEFFF5EB48320F148419E519A7250CB799541CBA4

Function 03425099 Relevance: 1.6, APIs: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 03425102

Memory Dump Source

Source File: 00000006.00000002.1616392444.0000000003420000.00000040.00000800.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3420000_Exccelworkbook.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: b86fe07619df82808d75da59f28d311d26f56075be3e68e616f8f9290a9de869
Instruction ID: adcbff7feec3ebe1564f0c4dbe8fa2b98dc638fadf6ae6bb7ca777e2310b94d3
Opcode Fuzzy Hash: b86fe07619df82808d75da59f28d311d26f56075be3e68e616f8f9290a9de869
Instruction Fuzzy Hash: 5A110771D002598FDB20DFAAC4857EEFBF5EF88324F24845AD419A7240CB796941CFA4

Function 03428120 Relevance: 1.5, APIs: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 03428185

Memory Dump Source

Source File: 00000006.00000002.1616392444.0000000003420000.00000040.00000800.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3420000_Exccelworkbook.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 3587d4d5e22507e256c297900b63e9f49376c6e032ce036af6d21f59d3b1c275
Instruction ID: 66ef36310b125dc70dcf537272894f8d6b0e5db4c1804b0d79df16188e2f1e36
Opcode Fuzzy Hash: 3587d4d5e22507e256c297900b63e9f49376c6e032ce036af6d21f59d3b1c275
Instruction Fuzzy Hash: 3C11F5B58003599FDB20CF9AD885BDEFFF8EB48310F14885AE518A7640C375A584CFA5

Function 034250A0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 03425102

Memory Dump Source

Source File: 00000006.00000002.1616392444.0000000003420000.00000040.00000800.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3420000_Exccelworkbook.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: cfc1a4ea3b47375ae2318be9bdcf60a12cd033167b7fb7fee1b1f66b29e4332e
Instruction ID: ec8ece98eaf80b4e83132e60b8e1ce4300547add1e3dae5819d01ea8e7ebea71
Opcode Fuzzy Hash: cfc1a4ea3b47375ae2318be9bdcf60a12cd033167b7fb7fee1b1f66b29e4332e
Instruction Fuzzy Hash: 57113A71D003588FDB20DFAAC4457EEFBF5EF88220F24845AD419A7240CB79A941CFA4

Function 034243D8 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 03428185

Memory Dump Source

Source File: 00000006.00000002.1616392444.0000000003420000.00000040.00000800.00020000.00000000.sdmp, Offset: 03420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3420000_Exccelworkbook.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 03d0748a1ac53b7955fc94073e53cfb9d02223860146db3934f4c8d96417d58c
Instruction ID: 36a56e0448278602ebcab2e861bab83bb3b74a7cb1f8fba88c2a79d13e3e567e
Opcode Fuzzy Hash: 03d0748a1ac53b7955fc94073e53cfb9d02223860146db3934f4c8d96417d58c
Instruction Fuzzy Hash: 1911F5B58003599FDB20CF9AC445BEEFBF8EB48310F10885AE518B7240C379A944CFA5

Function 01AFDA60 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 01AFDAC6

Memory Dump Source

Source File: 00000006.00000002.1615134213.0000000001AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1af0000_Exccelworkbook.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2aeac75357f5cadf7ab7068a6a6f6cf2297bc57863e232015bad54e9cbb2362f
Instruction ID: 9fe62c6e5400e49dc0f7446b3b94e5545e364f506d1666cc5b47471166b9122b
Opcode Fuzzy Hash: 2aeac75357f5cadf7ab7068a6a6f6cf2297bc57863e232015bad54e9cbb2362f
Instruction Fuzzy Hash: 331110B6C002498FDB20DF9AC444BDEFBF4EB88320F10845AD928B7600C379A546CFA5

Function 05BB017C Relevance: 1.5, Strings: 1, Instructions: 294COMMON

Download Yara Rule

Strings

(q, xrefs: 05BB1512

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID: (q
API String ID: 0-2414175341
Opcode ID: 14a58990d86149e309e69c7bd649e6b41183201758dcb7e4a2be80d265248a78
Instruction ID: 81f5c0080e80e5e584758e828a8c31353180c1360e89c82f9fa466d861a92343
Opcode Fuzzy Hash: 14a58990d86149e309e69c7bd649e6b41183201758dcb7e4a2be80d265248a78
Instruction Fuzzy Hash: 3391E471A01208DFDB18DFA9D854BEEBBF6FF85300F2484A9E445A7750DBB4A806CB51

Function 05BBCBD8 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

,q, xrefs: 05BBCD00

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID: ,q
API String ID: 0-196045463
Opcode ID: b04a7cb0e229d2d51611ef153f7184c55eaacad0c26d47f672f5629483058437
Instruction ID: e680b6398d70ec5a8c2659b9b50c6c5708c456651dfe1137ab9695fe5d646bdd
Opcode Fuzzy Hash: b04a7cb0e229d2d51611ef153f7184c55eaacad0c26d47f672f5629483058437
Instruction Fuzzy Hash: 0F51E934A1061ADFDB24CF68D985AADBFF1FF48711F1481A9E806A7260D7F0AD44CB90

Function 05BBC3F0 Relevance: 1.3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

Strings

Hq, xrefs: 05BBC494

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID: Hq
API String ID: 0-1594803414
Opcode ID: 004d313b27d7ed42f72857d07cdd5d8e7d1b8818a58e78c2e8a7d0f7f7e5b76b
Instruction ID: 2811caaff112138f5dc3a476b58aa01983482740680e0efd4b5bb7f8a5d150c5
Opcode Fuzzy Hash: 004d313b27d7ed42f72857d07cdd5d8e7d1b8818a58e78c2e8a7d0f7f7e5b76b
Instruction Fuzzy Hash: DD21C270B14205AFEB05DF748D0ABBE3F76EB84700F20C4A9E506DB285DEB06E058B91

Function 05BBC400 Relevance: 1.3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

Strings

Hq, xrefs: 05BBC494

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID: Hq
API String ID: 0-1594803414
Opcode ID: 3f6468b5ab481ebd57854af2b755d10782bda706d07f9ae3af875d7f9d65be80
Instruction ID: d94afac3a3f606efb4bcb2d739deeb333fe8447ea57d280821fa7db58db6c3f0
Opcode Fuzzy Hash: 3f6468b5ab481ebd57854af2b755d10782bda706d07f9ae3af875d7f9d65be80
Instruction Fuzzy Hash: BA21D470A14209AFFB04DF688D05BFE7F76EB84700F10C0A5E506DB284DEB06E0587A5

Function 05BB2670 Relevance: .8, Instructions: 781COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13c83c6ebff1b8d499c492f688fa3b38b5dcf44fcda4cdfe272d14757eff6cb8
Instruction ID: 6595a676a5f661a2a1a8bd10939bb022f00d39582986896df0b165574b0c54d4
Opcode Fuzzy Hash: 13c83c6ebff1b8d499c492f688fa3b38b5dcf44fcda4cdfe272d14757eff6cb8
Instruction Fuzzy Hash: EC62DD74E00B414AE7745F6489987FEBAE9FB42700F204D5ED1BACB380DBF8A4458B59

Function 05BB26B0 Relevance: .5, Instructions: 453COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c99f69f30500c001e14b2d0b8502c58049a544a85b690eff21d5fee59a8442d
Instruction ID: 43718dd039129ca4257b3c1a706f2a198c81659bc157dd3583766fc567322a5d
Opcode Fuzzy Hash: 6c99f69f30500c001e14b2d0b8502c58049a544a85b690eff21d5fee59a8442d
Instruction Fuzzy Hash: AB124DB0A05B424AE7745B6488843EDB6D8FB06700F304D5FC0FAC9355E7F9E08A8B89

Function 05BBFA80 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 549fedbae96497d6d759882828e375fe4e01f4d33e1588735e31f8ce745922bc
Instruction ID: 9107c1971c4cee938b02c31c3204eec332052cb24ffb5eec604024674bce53ed
Opcode Fuzzy Hash: 549fedbae96497d6d759882828e375fe4e01f4d33e1588735e31f8ce745922bc
Instruction Fuzzy Hash: C1912D75A106098FDF04DFA8D8949FDBBB2FF88314F1441A9D906AB355EBB0E895CB40

Function 05BBE858 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d19d158fcf6ef6a6531703cb6b8c6d581113e2f6f54790a85992fae889104f1
Instruction ID: a72e7a0592085765af38b3df27a84772c4130aac1f68a841bfec0c69380037f0
Opcode Fuzzy Hash: 1d19d158fcf6ef6a6531703cb6b8c6d581113e2f6f54790a85992fae889104f1
Instruction Fuzzy Hash: 7071B071A002198FEF15DFA8C8846EEBBB9FF84300F1485AAD455EB255DBF0E945CB90

Function 05BB4A58 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5bef54d1cdbc4ac382ec501cac16a6aa353f124b6d1794ab772aae998d07e5b
Instruction ID: 29372ff35530ca40547c7af8dfd3636e109a437f38a4babe10f897ae94fcfa20
Opcode Fuzzy Hash: d5bef54d1cdbc4ac382ec501cac16a6aa353f124b6d1794ab772aae998d07e5b
Instruction Fuzzy Hash: 9F719F74A01208AFDB14DF99D994DAEBBB6FF48714F114498F901AB362D7B1EC81CB50

Function 05BB22F0 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cff84ede06bd63c073753d5f3c98b955ebb18cf5713f39f7ffba5ba3bab1abab
Instruction ID: 026499f29b4e8efcaf5976e74fa180991d2585fa701b5d1064cdd1f67cd26783
Opcode Fuzzy Hash: cff84ede06bd63c073753d5f3c98b955ebb18cf5713f39f7ffba5ba3bab1abab
Instruction Fuzzy Hash: 62517A36A015199FEF00CFA4D884AEEB3B6FF45710F0580A6E905AB261D6F5E906CB80

Function 05BB7AB4 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9e57778fdd2a762298cc8a25ccf89e613d38163714d307c59d3197713d0cf7d
Instruction ID: ed488fe8ac9595e698bd8554de51c06ae870ea3a7b710efb1c98aabbdb79d64a
Opcode Fuzzy Hash: a9e57778fdd2a762298cc8a25ccf89e613d38163714d307c59d3197713d0cf7d
Instruction Fuzzy Hash: AE51AD35B002068FDB15DB7988889BEBBF6FFC4220B158569E419DB391EFB0E9058791

Function 05BB0A28 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cb5f44f7d5510fefa78cb81fb8a28abd6d95c5c7f91dee1eabff97f835ab50c
Instruction ID: e4e6213d1370a5ecc434722e7a6c2bc14d94a2d77d3db58c53949c3eae6806bb
Opcode Fuzzy Hash: 6cb5f44f7d5510fefa78cb81fb8a28abd6d95c5c7f91dee1eabff97f835ab50c
Instruction Fuzzy Hash: CF515F71E102499FDB14EFA9C848ABFFBF5EF88200F10846AD415E7250EAB4A9058B91

Function 05BB4220 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a0f305a654006635cb84d41e2b05cb7984c10b9c39087aff9d571b34b33f175
Instruction ID: 40f78d947957a1e7cc0b0762890c6cbfd4779afe06e11e5b30630dbb8f08d097
Opcode Fuzzy Hash: 0a0f305a654006635cb84d41e2b05cb7984c10b9c39087aff9d571b34b33f175
Instruction Fuzzy Hash: BB518C30A10309CFDB15EBA4C594BBEBBB2FF85300F148569D406A7255DFF4A94ACB51

Function 05BB3928 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ab6114cdd624e80448c453be8cd9e299c5b6d17da3a2cecb02800f5fcbb9628
Instruction ID: 8e2c2fbadc9953bf5faa37aceb7207c25a29a4e99161a1daa11243d7feb8b1ba
Opcode Fuzzy Hash: 8ab6114cdd624e80448c453be8cd9e299c5b6d17da3a2cecb02800f5fcbb9628
Instruction Fuzzy Hash: 80414A30B141588FEB14DB69D894EEEBBF6FF49614F1440A9E542EB361DAB1EC00CB50

Function 05BB4A48 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c78d00236c7957ce85790791d5fde82fcd2c6aa8161055b67f8ea9899443e472
Instruction ID: 007b0e4c9beb4bac78b4fb985c0d79e13ce162a1cb7372054e52a66c5fcc40b9
Opcode Fuzzy Hash: c78d00236c7957ce85790791d5fde82fcd2c6aa8161055b67f8ea9899443e472
Instruction Fuzzy Hash: 1651A478600208EFDB14DF69D898DAD7BB2FF49720B154499F9029B362DBB1EC41CB50

Function 05BBD360 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 134fd97263c5eb49b320b8b75b0a9b4fc44a6dc753fc2e4bf121204b9f568b9d
Instruction ID: 33021ef723c00c82ba8a253a596018ffc64a3b46a5e831ee050af66c0bf7b0c4
Opcode Fuzzy Hash: 134fd97263c5eb49b320b8b75b0a9b4fc44a6dc753fc2e4bf121204b9f568b9d
Instruction Fuzzy Hash: BF411B75A04209DFDB04CF59C885BAEBBB2FF88300F1585A8E9159B3A1CBB4F841CB51

Function 05BBAC18 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd97ce0859caa0fbd4e67e78d24eca07796626e129769205118eac5502a6cf35
Instruction ID: 609f02eaec068a6725df7ca64be5990585ecdd1be55b6cbcbe640da9b7519636
Opcode Fuzzy Hash: bd97ce0859caa0fbd4e67e78d24eca07796626e129769205118eac5502a6cf35
Instruction Fuzzy Hash: 7C31E531E08218CFF714EA28CC416FABBF2EB81211F4848A7E421CB291D6F8E845C751

Function 05BBD35B Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a59e4f5bf267826bc0629c8392a8e74a19d78b01fdb6edd3d405940eaa51c3b1
Instruction ID: 57e1840ddf023acf14602c6aa2e6ebaf688f2884a39a8382cf8277ea7ec31d81
Opcode Fuzzy Hash: a59e4f5bf267826bc0629c8392a8e74a19d78b01fdb6edd3d405940eaa51c3b1
Instruction Fuzzy Hash: DB41D875A002099FDB14CF59C885BAEBBB2FF88710F1585A8E9159B3A1CBB4FC41CB51

Function 05BB0A19 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0f79ac2faa3a183e46a33808f29ced5dbad9ec7f11af6d20faf2ff33e7b2da4
Instruction ID: fccb742479bb8b3880986dab3d640c0a4fe9a98fd64d81b7271af606dd41f02b
Opcode Fuzzy Hash: b0f79ac2faa3a183e46a33808f29ced5dbad9ec7f11af6d20faf2ff33e7b2da4
Instruction Fuzzy Hash: D03164B5F001199BDB14EB99D948AFFBBFAEBC4300F14816AD555E3250EAF0A9058790

Function 05BB0895 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e82a0a59de25e73c4af7bca35b8160f03197e069dc2f993a49a8e3b16739c569
Instruction ID: b3e506f8117dde4427c09fb52a8e78658f61553d8bd2a69ddac89ec1396695ef
Opcode Fuzzy Hash: e82a0a59de25e73c4af7bca35b8160f03197e069dc2f993a49a8e3b16739c569
Instruction Fuzzy Hash: 8D41D3B1D00309DBEB24DFA9C584ADEFBB1BF48304F248069D419BB210D7B56A4ACF50

Function 05BB08A0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7426ec04bd25be10542f46cbb8d0fef4276cf80431cc71ffbf177ee419259445
Instruction ID: 7020a0a0d240470450e124c71f87fac3b7376a10d9144b3d04a2ab2e5e8c7771
Opcode Fuzzy Hash: 7426ec04bd25be10542f46cbb8d0fef4276cf80431cc71ffbf177ee419259445
Instruction Fuzzy Hash: F141B3B1D0030D9BEB24DFAAC584ADEFBB5BF48304F248169D419AB210D7B5694ACF90

Function 05BBB440 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2737d34b4f779872d06efbd32ad9468b9d4142b58e2a2445fa88b85ad2307862
Instruction ID: ab0483291d65665197cf98b454b2a471a9f792222f0ba18227a0ec98aa17a822
Opcode Fuzzy Hash: 2737d34b4f779872d06efbd32ad9468b9d4142b58e2a2445fa88b85ad2307862
Instruction Fuzzy Hash: B4313B74A142499FDB00CF98D884ABEBBB5FF49301F04809AF856D7291D7B4E941CB66

Function 05BB6DF8 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd53a4da534f94c41a21534f574d3e71e18a10591453e87d316ea9f3329a8e74
Instruction ID: 7549c6c829b35ccbda8d63940f5e7a7c549f4cd4ddd55113f027a56f3bcba0f5
Opcode Fuzzy Hash: dd53a4da534f94c41a21534f574d3e71e18a10591453e87d316ea9f3329a8e74
Instruction Fuzzy Hash: 9B31C371A08264CFE7108FA4C8506FABBB2EB45211F0881E6F865DB285D2F5EC50CB61

Function 05BB3E57 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75674e9a09b82d66197c5c7e29ea8cf96b2be5d53fd274d1d2bfab9b923a5556
Instruction ID: dd07bd482f629b09020bfde007e5425b3c20efffa715d50a1c131a14c4051bc6
Opcode Fuzzy Hash: 75674e9a09b82d66197c5c7e29ea8cf96b2be5d53fd274d1d2bfab9b923a5556
Instruction Fuzzy Hash: 13212C313045114BE7259A3DD895BBD77F6EFC0610F1844BAE009CB391DAF5EC4587A0

Function 05BBE847 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3165e614d6f05f2ba402ba8b92ec0258488d6ea9dbe5c1202398ee128e1a12de
Instruction ID: cd34a77b85344cf605b55870464af6f18ac2fddb7e3798363dd85b676bfba3d0
Opcode Fuzzy Hash: 3165e614d6f05f2ba402ba8b92ec0258488d6ea9dbe5c1202398ee128e1a12de
Instruction Fuzzy Hash: 1831F2702001209FEF55CF18C880BFABBE9FB80601F44C5AAD885CB256DBF0E905CBA1

Function 05BBB433 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6ff56c289a48bfc11f756e1a8d8bd8f5ac524e46a05c9a7ceda0a362c3eb30a
Instruction ID: 9a38621294abd6057e6a4f5b5461ba9fedab8c1c7e26ba1b7ca2fbe739727897
Opcode Fuzzy Hash: c6ff56c289a48bfc11f756e1a8d8bd8f5ac524e46a05c9a7ceda0a362c3eb30a
Instruction Fuzzy Hash: 9C317C74A102599FDB00CF98D884ABFBBB5FF48311F04809AF856D7291E7B4E901CB66

Function 05BB3FB0 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0774472ca0371f98f4b53336a94706d1734f6d1fdf696b2e90db26c339ff8e11
Instruction ID: 6ffc07a28457350a2cb32f82e4ffa48adee8efefb1a024cbc644bdc7cbdcb2cb
Opcode Fuzzy Hash: 0774472ca0371f98f4b53336a94706d1734f6d1fdf696b2e90db26c339ff8e11
Instruction Fuzzy Hash: 8A31C471608A949FEB218B64C9406FABBF2FB42311F4486A7E4B6C6682C3F5F414C652

Function 05BBADD0 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4785ec8eeaf2b44fccfe23fa7281791012881432edc88d43911b62bab9d10d79
Instruction ID: 5655780806dd8ec6d272da08583cff31ae167b8b35eee62a3e25038c9c8dbcf9
Opcode Fuzzy Hash: 4785ec8eeaf2b44fccfe23fa7281791012881432edc88d43911b62bab9d10d79
Instruction Fuzzy Hash: C121D631E441149FEB10CA68D985AFEBBF5FB45311F2481A6E865EB281D7F5FE0087A0

Function 05BBF890 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3915e863596be90ab741747d95750f45e2b7025299e428c6325ed5a67468cb26
Instruction ID: 99941afbc93c5b7faa52b20c88a2acf084bbdbef6359ce8a165161c83361bc48
Opcode Fuzzy Hash: 3915e863596be90ab741747d95750f45e2b7025299e428c6325ed5a67468cb26
Instruction Fuzzy Hash: 912103327002115FEB289E65C881ABE77E7FBC4210F288069E287D3754E6B4FD828761

Function 05BB0798 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e06200f8e747d72e635cc6ad204d0bd76972d60f2f0c83eed46164f1e8e7ca0
Instruction ID: c3565361e0c6b0617688e7c25b65b29b4a73696f5edbcc744aae29d8de29f13d
Opcode Fuzzy Hash: 8e06200f8e747d72e635cc6ad204d0bd76972d60f2f0c83eed46164f1e8e7ca0
Instruction Fuzzy Hash: 9121D3326002088FC715EF79D8889ABBBF6FF85200B15C4A9D506DB350EF71E9058BD1

Function 05BB6DE8 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0ea9bf6578dc64d14a867c1981ae04f8203f117a3b7132686edc034806f7616
Instruction ID: b6026cf67ea360eb6bd4a0aac925c5a04f04579e008d29c1f07211ab8ff077b0
Opcode Fuzzy Hash: c0ea9bf6578dc64d14a867c1981ae04f8203f117a3b7132686edc034806f7616
Instruction Fuzzy Hash: C131F671908264CBEB10CFA4D8506FABBB3FB85211F0481E6F865CB285D6F9EC50CB51

Function 05BBD780 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77b297b77f9c1d3b32c3b27b5649a8f14f7cfab06c7710664eb53049361794be
Instruction ID: a7569691e960ca2acefa66c1680f4cc9755057ef11b72abd3110bf92de75aee5
Opcode Fuzzy Hash: 77b297b77f9c1d3b32c3b27b5649a8f14f7cfab06c7710664eb53049361794be
Instruction Fuzzy Hash: E521F870E05150DFFB109B189D00BFA7BB2FB86312F1841E5E8598B282D3FEA901C792

Function 05BB9EFC Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59347f73decba466a754f1c414a43c9d497b5a7e642e1b1187c91917737ee003
Instruction ID: 1416acfc5fd5962ac4f0dad3422ad6a6e287e4d0dd6e92ec19ccee2aeb9f911b
Opcode Fuzzy Hash: 59347f73decba466a754f1c414a43c9d497b5a7e642e1b1187c91917737ee003
Instruction Fuzzy Hash: 9921B375E00208AFDF01DFA8C845EFEBBB5EF49310F1484A6F905D3211EAB0A916CB51

Function 05BBF8A0 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b139b2504e00ac3c7c495623b8355e55e2a68d7adabb05947a6deaff6d404911
Instruction ID: 4a4bef689e28c6cf80dc32cd268f95409d8b9d05f615493e6cb66f90b14d52fe
Opcode Fuzzy Hash: b139b2504e00ac3c7c495623b8355e55e2a68d7adabb05947a6deaff6d404911
Instruction Fuzzy Hash: F721D4367006105FEF249E65C881ABE77E7FBC4210B248069E687D3754E6B4FD818761

Function 05BB9388 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a24f38b0e53858e58544aa5d5932d6e99964bc2fbbd523f7ed7d5adb4e986266
Instruction ID: 56cac6554c2e22baed8da935110a7a03c63564bd9faaa39f45338c5aee357e10
Opcode Fuzzy Hash: a24f38b0e53858e58544aa5d5932d6e99964bc2fbbd523f7ed7d5adb4e986266
Instruction Fuzzy Hash: 4121E571908118CBEB24CF69C4406FEBBB6FB85710F1042A6EA66D7281C7F1FA00CB56

Function 05BB9378 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b27f9f8bb61fdeeb453d6e9eeb6f255c07e6f22b4b470fc22fc03b8b1a14ea6
Instruction ID: 4a504dde7f2e339a7e21eae8dfbc31a89cd09de85a4a9bed9d146aafc6026018
Opcode Fuzzy Hash: 8b27f9f8bb61fdeeb453d6e9eeb6f255c07e6f22b4b470fc22fc03b8b1a14ea6
Instruction Fuzzy Hash: A921A371908518CBEB24CF59C440AFEBBB6FB85710F0442A6EA66D7281C3F5F600CB52

Function 0180D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1612769983.000000000180D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0180D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180d000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44303b8348968df7ac43ef9e72bf6495a8d6b8663328f0300932e07616ca86f2
Instruction ID: 3079d9f51b586d93cc29671f053a2d92cb7e3e81f0f94d0034c67c380d19fd2c
Opcode Fuzzy Hash: 44303b8348968df7ac43ef9e72bf6495a8d6b8663328f0300932e07616ca86f2
Instruction Fuzzy Hash: DC210372500248DFDB56DF94D9C0F26BF65FB88318F20C669EC098B296C336D556CAA2

Function 0180D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1612769983.000000000180D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0180D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180d000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41e217b3f2bade9ff6d4c1053656aa49851d2a5e46ed417981a35556062df733
Instruction ID: 3893b097c745a075b373ed242c70c9a532a6c2b85c9800f538d8d38283617319
Opcode Fuzzy Hash: 41e217b3f2bade9ff6d4c1053656aa49851d2a5e46ed417981a35556062df733
Instruction Fuzzy Hash: EE213671500608DFDB06DF84D9C0B56BB65FB88324F20C269E9098B296C33AE546CAA2

Function 05BB3FA1 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fd7d1e1ef21274852533d6ebd4ada1f6a1c49c2bb2efaf2fbb109792a8b3dcf
Instruction ID: ffde898e96fc4e6edd694d54be68cb4d774447a8fc7c76236c349c37a0899edc
Opcode Fuzzy Hash: 6fd7d1e1ef21274852533d6ebd4ada1f6a1c49c2bb2efaf2fbb109792a8b3dcf
Instruction Fuzzy Hash: 8A21D631608A549BEB208B65DD41BFBB7F6FB41321F4486A7E4A6C6281C3F9F414C692

Function 0181D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1612978002.000000000181D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0181D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_181d000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f456857e848fc1dffa94c5074000b7282ac2a6e55b6bf04efd1b5623c2b9fb1
Instruction ID: 56d34c392d2eb471093b7b41bf9e46575c17431adb6873bff57091ebd289973d
Opcode Fuzzy Hash: 5f456857e848fc1dffa94c5074000b7282ac2a6e55b6bf04efd1b5623c2b9fb1
Instruction Fuzzy Hash: D8213772504304DFDB05DF94D5C4F55BBA9FB84324F20C76DD8198B25AC33AE546CA61

Function 0181D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1612978002.000000000181D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0181D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_181d000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9faac4db8ff748b6d7f681d62e4fbe16a2d2e8ff8c41ad70238c9dd9662542b4
Instruction ID: 1e3f41d56649ca8d1b1b32c34f73e52f6a41c356eae35b10f87c8b289bdb3c5a
Opcode Fuzzy Hash: 9faac4db8ff748b6d7f681d62e4fbe16a2d2e8ff8c41ad70238c9dd9662542b4
Instruction Fuzzy Hash: 7F212276604304DFDB15DF54D8C8B16BB69EB88354F20C6ADD80A8B24AC33AD947CA62

Function 05BB1C00 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15a49c2c822565932e781a62f0dd405e0379d2b4637ad540273a4f82a2a99c91
Instruction ID: 2cc218ee652ae900c3aceb38b7dcf823e76f83e8300e3f1df23696f566e58831
Opcode Fuzzy Hash: 15a49c2c822565932e781a62f0dd405e0379d2b4637ad540273a4f82a2a99c91
Instruction Fuzzy Hash: 3B212171E1021A9FCB05DFADC8848EEFBF5FF98210B10C15AE414A7215E7B0A942CB90

Function 05BB4E60 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 522b7e102e474f3fc3d8eafa0264ac11c8350cf8f8020cd6dcb2df05176c8bd2
Instruction ID: 5defcd117961e3e0a06ac9902f7a421ef8fd55e54b9d9c73d11c5816dec063f0
Opcode Fuzzy Hash: 522b7e102e474f3fc3d8eafa0264ac11c8350cf8f8020cd6dcb2df05176c8bd2
Instruction Fuzzy Hash: 09214D357006149FDB249E19D580EBAB3BBFB88620F11446EE64687751D7F2FC41CB60

Function 05BB987C Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88402305e3936badb6c71219d03373ef84c3567a9f3fe774461d6cfe4ba1323e
Instruction ID: 74d728f703fde9575f144b34b55930ce15bc3a4c02d92340ea8865645f0ca8e6
Opcode Fuzzy Hash: 88402305e3936badb6c71219d03373ef84c3567a9f3fe774461d6cfe4ba1323e
Instruction Fuzzy Hash: D531E3B1D012189FDB20CF99C588BEEBBF1FB48314F248459E448B7250C7B96845CFA0

Function 05BB7C54 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e15fd633fd468604d8049a9f45ad0597ff07fdf185b24dfa3d89885b338d25
Instruction ID: f4b91fa12d168dcb290498d638251225675376c73475630db98f57977cd14387
Opcode Fuzzy Hash: 05e15fd633fd468604d8049a9f45ad0597ff07fdf185b24dfa3d89885b338d25
Instruction Fuzzy Hash: 3531E2B0D012589FEB60CF99C588BEEBBF5FB48314F208059E545B7250C7B56845CBA1

Function 05BB1B78 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4cf19045057a3b85e0e4c6ff5c3f2ba2bfe73d5310c13257d77b7153c1b804e
Instruction ID: ce2b90c2c1fc92ef8a2a6a7f83645ba8ea2c7d512b1426491e1d6dc580d3fd5a
Opcode Fuzzy Hash: e4cf19045057a3b85e0e4c6ff5c3f2ba2bfe73d5310c13257d77b7153c1b804e
Instruction Fuzzy Hash: 8611D3323006054BE7259A2DD8987AA77F6EBC4210F18CCBAA04ACB755DAF4E8458751

Function 05BB4E50 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13f7b5206677fb0b7678373f4ed6ce5d58f07897d9112dc0ea2ff66e683b10ee
Instruction ID: 5eaee40a9560418e78a6ba76f2bed72819b2e3287a6b34e1cfec227610d22b11
Opcode Fuzzy Hash: 13f7b5206677fb0b7678373f4ed6ce5d58f07897d9112dc0ea2ff66e683b10ee
Instruction Fuzzy Hash: 39214A357006149FEB288E15D584EBA73BBFB98620F11446DE64687B51DBF2F8418B50

Function 05BBCB8C Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32590184356ea64dcd2b0f7b885103852542cb7d670d7d580137336e46fabfe9
Instruction ID: 94d10cb88fffeb8140f83799ba1dc881bbd87c9466c4a45f37be7701dd6f6ef7
Opcode Fuzzy Hash: 32590184356ea64dcd2b0f7b885103852542cb7d670d7d580137336e46fabfe9
Instruction Fuzzy Hash: 2311B134B005188BEB19EB79C454ABC73B2BFC4A10F0080AAE456873A4DFF8AC41CB81

Function 05BB6209 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b42e3662e77d994422bd700d67aba62dfd3198b7adcb08c44ad0fbc5e55e5b2c
Instruction ID: 917accc03aba2fcc37b5a4d4f75c82c5011820e6267f54a611c497754cb4c73a
Opcode Fuzzy Hash: b42e3662e77d994422bd700d67aba62dfd3198b7adcb08c44ad0fbc5e55e5b2c
Instruction Fuzzy Hash: AE21ED71E1020E9FCB04DFA9C8459AFFBF9FF98210B14C55AE518E7211E770A956CB90

Function 05BBE5C1 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b1242240d5f5fd8923f752bf126dee6fe7e77ea2fe3a800d118f5cfd1bbfe80
Instruction ID: 6510ce837c4b7491deab2db48f4905a57e59b595d668dadbefc752336558868f
Opcode Fuzzy Hash: 2b1242240d5f5fd8923f752bf126dee6fe7e77ea2fe3a800d118f5cfd1bbfe80
Instruction Fuzzy Hash: 3B212B31D1074A8BDB11DFA4C4407EDBBB2FF95310F248B55E015BB6A1EBB0A986C781

Function 05BB1C0C Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7e4dacf510d16621dd400f656774d9beaa031243c8d8816c9d63de3beae1b45
Instruction ID: b29eaa144bd5df91b437e74a9eca1a4781249a135435d2165092525a1f93d890
Opcode Fuzzy Hash: b7e4dacf510d16621dd400f656774d9beaa031243c8d8816c9d63de3beae1b45
Instruction Fuzzy Hash: 6721DE71E1020A9F8B04DFA9C8849AFFBF9FF98210B10855AE515E7211E770A955CB90

Function 05BB7AA4 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 724f4e74924054a8dbb2b2eb9c6366e4707adb2c00a2594f6356908cbb05de65
Instruction ID: 32d228b3914ea0c857fc852a73e76eb99735f47f0c7d9a5d00f533bd3767c36d
Opcode Fuzzy Hash: 724f4e74924054a8dbb2b2eb9c6366e4707adb2c00a2594f6356908cbb05de65
Instruction Fuzzy Hash: 23115E71B402098BDB14EBA998506FEB6B2FBC4310B5040A9C606E7240EFB6AD01CB95

Function 05BBDCD8 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6bc16386fcc735080b45a389297d8a98183b83c05f3ba6d44463aeea572fe84
Instruction ID: a5cac66a8cd5901ea829baaf04cd1c61221e35ac1f2bbfd6f7a798bb204b21a9
Opcode Fuzzy Hash: b6bc16386fcc735080b45a389297d8a98183b83c05f3ba6d44463aeea572fe84
Instruction Fuzzy Hash: EB012D713585688FF71C852DDC127FAB296E784220F04867BF85AC72C0D1FCF8454594

Function 05BB0789 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f412324f359869c8b3b973405c842cfaa2a9b13a801d2794a8cd98483c38bc5c
Instruction ID: 29e04abca3b4ba41ed486fafe7e2d2964a2b7198eeea31c12c47d693f7cddd5f
Opcode Fuzzy Hash: f412324f359869c8b3b973405c842cfaa2a9b13a801d2794a8cd98483c38bc5c
Instruction Fuzzy Hash: 4F1181767006098FC711EB68C944ABE77F6FF84210B058969D516EB390EF70ED058F91

Function 05BB96C7 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba9cfd23fd9ece5a1e8b886da7ed3d8e43451d4af894025807dad67ecbfbd74f
Instruction ID: 3103b876a99b28c091e9565242f0fa9dc45f9feb2964249a375689b9aefe9a41
Opcode Fuzzy Hash: ba9cfd23fd9ece5a1e8b886da7ed3d8e43451d4af894025807dad67ecbfbd74f
Instruction Fuzzy Hash: A8118C75A0020A5F9B15DA798C849BFBBFBEFC82607154569E928D7240EFB0A90587A0

Function 05BBDCE8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d72704ed28ba4aaaadaeabaf3b2880f33b197113bef15d3c78fd747a4b908d4c
Instruction ID: 94757eaf63df5e48ce42c169705d79c647eca66f346bd8fe3008cee59eeeca53
Opcode Fuzzy Hash: d72704ed28ba4aaaadaeabaf3b2880f33b197113bef15d3c78fd747a4b908d4c
Instruction Fuzzy Hash: D801B5713585A89FF728C96DD8127FAA29AE784320F14467BE8AAC72C0D1EDF9404294

Function 05BBBEA8 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91282628f1e01f0e2234fc433c32126b7ae2f7016992e84f92c8185225dea5cb
Instruction ID: ae0fca58d7d965e5a08fbee034807b3fcb51eb6133b026fbc54c80141a9c8827
Opcode Fuzzy Hash: 91282628f1e01f0e2234fc433c32126b7ae2f7016992e84f92c8185225dea5cb
Instruction Fuzzy Hash: 1E110172A00924DFEB24CB79C4806FAFBA1FB05311F0445A3EA65A7281C3F0FA40CB91

Function 05BBF9E0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aef372ea55b8635a08ff0e6245f6b509764fba9130087b15573ea9b70daa7c0a
Instruction ID: ecc734c5450586aa258e0f13d1129743adad692694290705efe6ec86b282e24e
Opcode Fuzzy Hash: aef372ea55b8635a08ff0e6245f6b509764fba9130087b15573ea9b70daa7c0a
Instruction Fuzzy Hash: 7D11C9B5E0021A9FCB44DFADC8809AEBBF5FF88210B10816AE918E7311E7349911CB90

Function 05BBDDA8 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43b0960e934cacbad088e306d014a990ab28bf799e09c68ae48affd5eaae0f20
Instruction ID: bcda79f682ec49a783385a0a7ed3e3eadef3e43d180f52bf70e1a20b3d325b00
Opcode Fuzzy Hash: 43b0960e934cacbad088e306d014a990ab28bf799e09c68ae48affd5eaae0f20
Instruction Fuzzy Hash: 5411A1317105148BEB29EA39D854BBC77A2AFC5A20F1485FAD165CB3A0DFF8EC018781

Function 05BB5C2E Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92ad564e6dbbb7168d6dd9be5fc226e1d69005c23fcf70c1444a6a626e6fa1cc
Instruction ID: 17badcc3cc4f6457e7a0910d5d07323716eeb08b78b50e1fbe916b259a687d60
Opcode Fuzzy Hash: 92ad564e6dbbb7168d6dd9be5fc226e1d69005c23fcf70c1444a6a626e6fa1cc
Instruction Fuzzy Hash: C121AF30A09159CFE734CF28C944AF9BBB2FB46301F0589EAD0A19B1C1E3F5A585CB42

Function 0180D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1612769983.000000000180D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0180D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180d000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1166f709330a6c50fb0ccab333658baa4cf0de4601631cd9e1789cef95a599a7
Instruction ID: 8b8fa69734afee30d7d531af5a1c90f0b76c35d678e6b63aefc4495fc6bbb72e
Opcode Fuzzy Hash: 1166f709330a6c50fb0ccab333658baa4cf0de4601631cd9e1789cef95a599a7
Instruction Fuzzy Hash: B2110372504644CFDB06CF84D9C0B56BF71FB84324F24C2A9D8094B257C33AE556CBA1

Function 0180D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1612769983.000000000180D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0180D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180d000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1166f709330a6c50fb0ccab333658baa4cf0de4601631cd9e1789cef95a599a7
Instruction ID: 535669548dcb029abfbe0130ac818c1eea92ae73644bb5ccc03231fa5b5eacc5
Opcode Fuzzy Hash: 1166f709330a6c50fb0ccab333658baa4cf0de4601631cd9e1789cef95a599a7
Instruction Fuzzy Hash: BA11DF72504284CFCB06CF54D9C0B16BF71FB88314F24C6A9EC494B296C336D55ACBA1

Function 0181D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1612978002.000000000181D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0181D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_181d000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5930c3722e95abe2067eb95ddfb8aa1848112c8b53b048d5b6b565b5491e75cf
Instruction ID: 1dd3988a1e7daa5414ed5822f544a6100d06bb194e873a03ef15df5b8a44fe4d
Opcode Fuzzy Hash: 5930c3722e95abe2067eb95ddfb8aa1848112c8b53b048d5b6b565b5491e75cf
Instruction Fuzzy Hash: 3411BE76504280CFCB16CF54D5C4B15BF61FB44314F24C6A9D8498B65AC33AD54BCB62

Function 0181D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1612978002.000000000181D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0181D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_181d000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5930c3722e95abe2067eb95ddfb8aa1848112c8b53b048d5b6b565b5491e75cf
Instruction ID: 37d13456125fea0d0924173f21eb3d2c47871cd9285e988798c16c33e0173bd5
Opcode Fuzzy Hash: 5930c3722e95abe2067eb95ddfb8aa1848112c8b53b048d5b6b565b5491e75cf
Instruction Fuzzy Hash: 7211BB76504280DFCB06CF54C5C4B15BFA2FB84324F24C6A9D8498B69AC33AE40ACB61

Function 05BB5C8C Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da072dd23435209d6bd2a729bdb83cf024ad1f71381f07026000f5a1eb15b2a4
Instruction ID: 4a092ffec87d2368e62c5ed0b0d7834539e31fb182bd6a8ed548b3e2405a561d
Opcode Fuzzy Hash: da072dd23435209d6bd2a729bdb83cf024ad1f71381f07026000f5a1eb15b2a4
Instruction Fuzzy Hash: 4B117C70909159CBE734CF68C544AF9BBB2FB45301F0589A6D0A18A0C1E3F4A585CB42

Function 05BBF9F0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4ba930972928c878eaf2bf1a38f6ccf3bc9a632e0234ffaaef205d22affc3f7
Instruction ID: 750baaba46152ca8af0c9e327cdb737671c547a80c70cb56238ea294bd10dcfe
Opcode Fuzzy Hash: b4ba930972928c878eaf2bf1a38f6ccf3bc9a632e0234ffaaef205d22affc3f7
Instruction Fuzzy Hash: 4F119BB5E0011A9F8B44DFADC9449AEFBF5FF8C710B10816AE919E7315E7309911CBA0

Function 05BB00BC Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2311c4c67bcc7c32f8dc0cfd97be72ffe47a71cc155d29a0fdd94827adef278d
Instruction ID: ee3d994b078a956ecd5abeac6ee54c5753326dc3254d14d601125f4ac94f53e1
Opcode Fuzzy Hash: 2311c4c67bcc7c32f8dc0cfd97be72ffe47a71cc155d29a0fdd94827adef278d
Instruction Fuzzy Hash: E11126B5C006088FDB10DF9AC444BEEFBF4EB48210F10845AD858A7210D3B8A945CFA5

Function 05BB020C Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd60f62efbcc22a6ca7e82d1f7fcb9db360bcfb14935cd9dfd01bb9c4e66a8ee
Instruction ID: 9551ffb2113f5f5ba6e8625844996f64137f4211255aa36ac5677265265acc43
Opcode Fuzzy Hash: bd60f62efbcc22a6ca7e82d1f7fcb9db360bcfb14935cd9dfd01bb9c4e66a8ee
Instruction Fuzzy Hash: 631126B5C002488FDB10DF9AC444BEEFBF5EB48210F10845AD858A7210D3B8A545CFA5

Function 05BB0D39 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef1d300d8f3c8907304f62cd4e441fb39bce99b77d1044e8b62e18eb95c6b7bf
Instruction ID: 9c991e9b1628fb1f94f063daffa3197cbc000ad9d68e129e7312d25ecbcff6bf
Opcode Fuzzy Hash: ef1d300d8f3c8907304f62cd4e441fb39bce99b77d1044e8b62e18eb95c6b7bf
Instruction Fuzzy Hash: 741104B6D002489FDB20DF9AC445BDEFBF4FB88220F14845AD859A3310D7B8A545CFA5

Function 05BB01FC Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccb5e44e1868b4f0e8c6b8c02c04074b1be4c40800cb86012ecf7bf51a198ce5
Instruction ID: 0e96a7d9ebc1ed960ad37c48e3ba55a5fd3375d79ecbe790f09694bfd2b4f422
Opcode Fuzzy Hash: ccb5e44e1868b4f0e8c6b8c02c04074b1be4c40800cb86012ecf7bf51a198ce5
Instruction Fuzzy Hash: 3001DB31B443186FEB08D6BD9855AFE7FEADB85220F1484BAA409D3341EDF4AC454295

Function 05BBE530 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a24d832af9e48b30f01a7710c5e1db9cf2f7ed2bba5069e2775e05e470b4e9fa
Instruction ID: b3f05b94cb18652a0cd468fd3f6f7734d013f68f91582b1f862378dfedc02a4a
Opcode Fuzzy Hash: a24d832af9e48b30f01a7710c5e1db9cf2f7ed2bba5069e2775e05e470b4e9fa
Instruction Fuzzy Hash: C7117C70E0121C9FDB14DBE9D9006EDBBB6AF88300F14406AD406A7394DBF4AA45CB91

Function 05BB62B1 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7956b4549018e1464b78ba39082e4258c15adf529264a328aca2fcbd96039467
Instruction ID: e9e1a4c8f5b08577e25037bb8596632a951fc82ddfb765d976dced184560110f
Opcode Fuzzy Hash: 7956b4549018e1464b78ba39082e4258c15adf529264a328aca2fcbd96039467
Instruction Fuzzy Hash: F2017C31310604CFE718DE69D845E6673AAFF84211F24C5BAD505CB360CBF5EC068A51

Function 05BB1270 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25e42a60238957e40d57b9d8f21436e449844af00dee69b71e6050cddbfe0f51
Instruction ID: efdb981747f00bf98a4ee1b008f0ef18de7bd18527d678ee96fad1fd507e0112
Opcode Fuzzy Hash: 25e42a60238957e40d57b9d8f21436e449844af00dee69b71e6050cddbfe0f51
Instruction Fuzzy Hash: 62F0A971B001295FDF0976689C59AFF7A79EB85550F200069F505E7340CAF45D0243D5

Function 05BB0418 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac961e7002c175e1b0808a8b1a05c99a0be97372f2903ce50897d755aaae905d
Instruction ID: 7f9e8b6a644d21a0b8b073751b206f6cc8951a6592ee29599f14bfbad7821b98
Opcode Fuzzy Hash: ac961e7002c175e1b0808a8b1a05c99a0be97372f2903ce50897d755aaae905d
Instruction Fuzzy Hash: AD1106B59047488FDB20DF9AC445BDEFBF4EB48320F208459D519A7300D7B9A944CFA5

Function 05BB1EA0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb461457fae4ab1c42e18eb8228eebf5bbc482c5ee7c7cc5e24ce8e30f26be19
Instruction ID: 08b3083016cddc05ba420f0d7704df55a0ef31c7787a5bf8ee60519efb3279fb
Opcode Fuzzy Hash: cb461457fae4ab1c42e18eb8228eebf5bbc482c5ee7c7cc5e24ce8e30f26be19
Instruction Fuzzy Hash: C81106B69007488FDB20DF9AD445BDEFBF4EB48320F208459D519A7300D7B8A545CFA5

Function 05BB19A4 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8441cc7f896fadf72914a91de0a106d3ecc017851960577cc619c008801ebc1
Instruction ID: 536012bbbeb60dd6e099a47da7fad0d406b2da7db86ebe5dd837249614c62033
Opcode Fuzzy Hash: a8441cc7f896fadf72914a91de0a106d3ecc017851960577cc619c008801ebc1
Instruction Fuzzy Hash: 0D1106B59047488FDB20DF9AD445BDEFBF4EB48320F208459D519A7300D7B9A944CFA5

Function 0180D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1612769983.000000000180D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0180D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180d000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88aaf547fe3220041b681f73f16c773c143f5f10a82da0a8f0b32f6e16a253b2
Instruction ID: abf61eb2d0a0b1e33fb0fa975bb301b0705e4a82e356b891aa171a0d4c0368cb
Opcode Fuzzy Hash: 88aaf547fe3220041b681f73f16c773c143f5f10a82da0a8f0b32f6e16a253b2
Instruction Fuzzy Hash: 9901203110438C9FF7524ED9CC84B66FBA8DF41364F04C619DD044E1C2D7799541CA75

Function 05BB1B68 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 571a530124b508c5caf93faeef070a9bb01edff98f5b68ed2299bd056dcba058
Instruction ID: a5f0553a77a08b8232605b91ae2aafabc743a46e12ab9c7ea535afd602201611
Opcode Fuzzy Hash: 571a530124b508c5caf93faeef070a9bb01edff98f5b68ed2299bd056dcba058
Instruction Fuzzy Hash: 62F044343441114BA729DA3E94949BE33DAAFC495130448AAE506C7360EEE5EC4587A1

Function 05BB3919 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11129cd428d9a0cb5a558bd4ac8182e63d3e32179dd81f12c4338ddfce21b1f4
Instruction ID: c497d9f84f2d2faf98c72f1518d579d72cf5eb5e069903fdc67fe9a1fe57d7a8
Opcode Fuzzy Hash: 11129cd428d9a0cb5a558bd4ac8182e63d3e32179dd81f12c4338ddfce21b1f4
Instruction Fuzzy Hash: 2C012C70E181989FDB14DB6AD894AEDBFF6EF4A300F1444AAE442E7361D6B5A900CB50

Function 05BB62C0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0269b8730453d9a32ed1c41944a9cd99583d8d1452b48f8ac4dbce8d3b67035
Instruction ID: 226e39fcf7a600f783098ac3cf5c9beebfc1dc80cafd8d426c910a7587c9acb3
Opcode Fuzzy Hash: a0269b8730453d9a32ed1c41944a9cd99583d8d1452b48f8ac4dbce8d3b67035
Instruction Fuzzy Hash: 33016D30310600CFD718DF69D840E66B3AAFF85224B64C5AAD409C7361DBF6EC068B51

Function 05BB1280 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93abdb5cfea1ae8a659291e42c276b9ff4e683ef79cd9c37192238144589ed3d
Instruction ID: 1020995f52dbe3f9b42c8d1efd47ce355212094211ed5a4555e2e73a355804d1
Opcode Fuzzy Hash: 93abdb5cfea1ae8a659291e42c276b9ff4e683ef79cd9c37192238144589ed3d
Instruction Fuzzy Hash: 37F09671B002195B9F09B6A89C585FFBBBAAB89550B200069F505A7340CAF45E0187D5

Function 05BB9CD9 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba36a78906ac5dc9c5ffe82937122abf2381e23850769ba0333dcfe17ca7e7a3
Instruction ID: 716fb9dddccfc52f3fb650f61c72d20036bd469486bc015044429cac84e9bbaf
Opcode Fuzzy Hash: ba36a78906ac5dc9c5ffe82937122abf2381e23850769ba0333dcfe17ca7e7a3
Instruction Fuzzy Hash: E0F082727001286FE7189A6EDC85E6BBBEDFBC8664B558079F608D7351DE30DC02C6A0

Function 05BB9C3C Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 246c84b901f2c725700caa78e4dd322fdefe82065503f3545457ff296da73f3a
Instruction ID: b64890a689bd6a962f6e0385fef9d520dc143b00373387434d54a9c9f9aa56fe
Opcode Fuzzy Hash: 246c84b901f2c725700caa78e4dd322fdefe82065503f3545457ff296da73f3a
Instruction Fuzzy Hash: E2011A70800219DFEB14CF69C5483EEBAF1FF48310F258669E525AA2A0D7F55A44CB90

Function 05BBF979 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8197426d0bc1c7ee4f6fe2b7ae5b8a96c99c63f2e0b0a8e6140fc01e0331412f
Instruction ID: bf8b91518b323111bcee6604bc02332c2af7e3a964b5810efa9629cdacb646c3
Opcode Fuzzy Hash: 8197426d0bc1c7ee4f6fe2b7ae5b8a96c99c63f2e0b0a8e6140fc01e0331412f
Instruction Fuzzy Hash: F7F0FC75A10505DFC710EBAED884DDEBBF8FF95310F00456AE10597360E7B0A905CBA2

Function 05BBC37D Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae7682329a1bf02963b6bbb98dfb04f7a23272fcd255a0aefa08217e15efbe17
Instruction ID: c666233d9afe8ca7a47091f798503ab8013024651fd2d67ec16c85f29f813e95
Opcode Fuzzy Hash: ae7682329a1bf02963b6bbb98dfb04f7a23272fcd255a0aefa08217e15efbe17
Instruction Fuzzy Hash: 2CF0903564414BCFEB00CE98D8846FEBBA2FB48390F801672EA03C7201E6F2AD559661

Function 0180D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1612769983.000000000180D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0180D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180d000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa476b2dbe1b1e673f662e397f653d22ee5e973a196cdaf37151425904dc55db
Instruction ID: 2679cd262add2d781395eb36a1966c2a3e3936b929628aa52a8b44378cafda47
Opcode Fuzzy Hash: fa476b2dbe1b1e673f662e397f653d22ee5e973a196cdaf37151425904dc55db
Instruction Fuzzy Hash: D1F062724043889EF7218E59CC84B66FF98EB81774F18C55AED485E286C2799845CBB1

Function 05BB6F50 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01ec7d526369c46c11f9da5ac7d26be009d3cf95d481b8543212636c10fe97fb
Instruction ID: b5d0c8cd3526b1a2430a8eba5d0a3ccb7fd8741e066879d2bfbd6174b12e9dbe
Opcode Fuzzy Hash: 01ec7d526369c46c11f9da5ac7d26be009d3cf95d481b8543212636c10fe97fb
Instruction Fuzzy Hash: 02F0E5333509119BCB25A699E881B7A77AEEFC5964F24007AF608C7350CDA59C024295

Function 05BB1CC0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eaa38c6c48c43bdc0760444a819f49c1c5c5c39926341dd5965be10cacc0d4c
Instruction ID: 4fe4e4b6c38d3d83e2c2f4bed82a38388909d81d2d06518a0b5f14d024b5540f
Opcode Fuzzy Hash: 4eaa38c6c48c43bdc0760444a819f49c1c5c5c39926341dd5965be10cacc0d4c
Instruction Fuzzy Hash: 33F0E5323409155BDB25A69D9890E7E77ABEFC5A64B2000AAF609C7351CEE5EC018295

Function 05BB9C48 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8bdaa6281482e57febf12b2e9b907e781ff8f383bd4fe61e10a498d401c39ef
Instruction ID: 8b3275a4df720c6fa63ac23d826277421ec5ca90417907281c0429152f063c80
Opcode Fuzzy Hash: e8bdaa6281482e57febf12b2e9b907e781ff8f383bd4fe61e10a498d401c39ef
Instruction Fuzzy Hash: 3401E870800219DFEB14CF6AC4483EEBAF5FF48350F208265E925AA2A4D7F55A40CB90

Function 05BB9CE8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 234df5659f2cc920a329462fef8cf0c325bdec68e62817c09f36168844d3d26a
Instruction ID: ac70d05ceb3d9ca5b8ac5f2df6a121218211a456439309946765c83041ee567c
Opcode Fuzzy Hash: 234df5659f2cc920a329462fef8cf0c325bdec68e62817c09f36168844d3d26a
Instruction Fuzzy Hash: 00E03972B002286F93149AAEDC84D6BBBEDFBCC664351807AF908D7311DA319C01C6A0

Function 05BB6338 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc21dd3be97aaea9bd930e58aefcf831b7de7c404ff8846422644350b86fbc4e
Instruction ID: d4a827423c286ed6ac84d06765269be1eaf6061cbc5ae497f62255aa3d60bc4f
Opcode Fuzzy Hash: bc21dd3be97aaea9bd930e58aefcf831b7de7c404ff8846422644350b86fbc4e
Instruction Fuzzy Hash: F1F0EC357093448FD729592AA458FFA7773FBC1211F0442BED806C3144CBF09C058751

Function 05BB78E8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28fcaedbf153438c88a5704b358ffc429b91bb946cd38affd8112c61e5330e90
Instruction ID: 2b2c1bc1c1fe2faa66cb4f0589bac0b7bed99b12aaf59988aebf272d7a11b1e8
Opcode Fuzzy Hash: 28fcaedbf153438c88a5704b358ffc429b91bb946cd38affd8112c61e5330e90
Instruction Fuzzy Hash: E3E0D8313406287FF7342598DC11BF2334EE7C6310F1100A2A681D52D0DDD2684587D1

Function 05BB2618 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8175da387076f4df52b11047e4197245ee48afdd70940512319762024f98fefe
Instruction ID: 65231221fa6a825116903a0a285bfa7217371f87c537f39bd2df15ee43e9e60f
Opcode Fuzzy Hash: 8175da387076f4df52b11047e4197245ee48afdd70940512319762024f98fefe
Instruction Fuzzy Hash: A4E09B37211620878720EB48F4418B6B3E9F7486593188556E40DC7534D6A3D813D380

Function 05BB1F97 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d976e87c5584ba29fef9331693b42ec9c8c68ee908d524f59cebf69eccc410
Instruction ID: d9f60c2506f05275cc300b1edaa06f7af720c2e1cfdffd9ce4be18a4af442470
Opcode Fuzzy Hash: b6d976e87c5584ba29fef9331693b42ec9c8c68ee908d524f59cebf69eccc410
Instruction Fuzzy Hash: 32E0927350015E6FCB02DE55D800BDA3FA8EB19215F048081F958C6112D2BAD967A7A5

Function 05BB6348 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0560d256971520bd8b1efeaf20992547309a06657bcc84c0f3c04be2e6d8f0e2
Instruction ID: 1da8e7640dd04b18da4e9b3c925835d3a504c260f2e324f59f4cb210b0b04ec9
Opcode Fuzzy Hash: 0560d256971520bd8b1efeaf20992547309a06657bcc84c0f3c04be2e6d8f0e2
Instruction Fuzzy Hash: BAE0483170431587D729592EA454FBB73ABFBC5521F04417DE01AC2144DFF0EC014791

Function 05BB78F8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d7379c72c0d65afae33625069d543a0ed4406dc40d6cf9daf8881682972e4dd
Instruction ID: acf4168b739ea9625a687604b8b531049b292b2e4f810275852459b2318618ee
Opcode Fuzzy Hash: 5d7379c72c0d65afae33625069d543a0ed4406dc40d6cf9daf8881682972e4dd
Instruction Fuzzy Hash: DDE08661351A2C7FF72426D85C10BB6339EFBCA750F1100A6E686EA2C0DDD65C458FE6

Function 05BB01BC Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99853782d368ccdda332c6be2a401db16c1963d998a2dbe933978c57ebe28320
Instruction ID: a2364f9e045e99597d4c045b26f8c1353ea86b93039d485cf34b025a09023e44
Opcode Fuzzy Hash: 99853782d368ccdda332c6be2a401db16c1963d998a2dbe933978c57ebe28320
Instruction Fuzzy Hash: 2EE0DF7210425D6BCB029F58D840EEF3FADEF09251F00C481F95886152D3FAE966EBE6

Function 05BB1456 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 285cfbc8ae0439f571c0103e89ac32819bbe5a66b7a819ef53cf5daf9c63f592
Instruction ID: 8194cc0390bb3da02bc78f01424cc5fc047d01f8a5ad0b5315612deb356f5737
Opcode Fuzzy Hash: 285cfbc8ae0439f571c0103e89ac32819bbe5a66b7a819ef53cf5daf9c63f592
Instruction Fuzzy Hash: 3BE0DF72D5020DDAEB109F85E6197FCBF70FB4521BF200062E102B2840C7F01991CFA1

Function 05BB2660 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bf7f6f11f69cd39d9ca72963c115f00ef934a26e6fefbd7a831494fe26c7808
Instruction ID: 43a35a881d28b018303498043dc5116039ae4636de1ed95b9acb6aa6c9eee20f
Opcode Fuzzy Hash: 0bf7f6f11f69cd39d9ca72963c115f00ef934a26e6fefbd7a831494fe26c7808
Instruction Fuzzy Hash: EEE02636510114AFE3105748D006BE0B7A8F704321F4684A1E20597140CBF8FC468F91

Function 05BB0730 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfcf762e6e40df9eccfd39280f7aea7e1be5ed7749aa12c888cdb25f81b287df
Instruction ID: db2529d4fdb00217021f49e00aa07953f59eae6a5e4caa5dfbeadf67e8a1c3dc
Opcode Fuzzy Hash: bfcf762e6e40df9eccfd39280f7aea7e1be5ed7749aa12c888cdb25f81b287df
Instruction Fuzzy Hash: 56E092B5A15109DFC700DFF8EA4067D7BB1FB85206B118599D809D3380EA36AE09DB02

Function 05BB0740 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efc28dda4172fbff5ae95e514b921794b8b6c62de82ac0ce69105af5af744921
Instruction ID: 9248b3488db8f4dba8143056154e53420c7156871766151660cfeec2901f3537
Opcode Fuzzy Hash: efc28dda4172fbff5ae95e514b921794b8b6c62de82ac0ce69105af5af744921
Instruction Fuzzy Hash: 57E0867090120DEFC700DFA4E84095DBBB9FB45208B108599D804D3300EA336F08EF52

Function 05BB5CD8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fac9ed9e63c826e752a0f52a80ff51bc37e069978e4cd94ca009670aa6e273a9
Instruction ID: 102b1fb4e38e120882fc912e3386c28a54c746e9ac4f4579be03348832dd50c0
Opcode Fuzzy Hash: fac9ed9e63c826e752a0f52a80ff51bc37e069978e4cd94ca009670aa6e273a9
Instruction Fuzzy Hash: 5ED0A7372101087FDB409AB0CC02FD27368EB54300F508000F6444A650C231F997D7A1

Function 05BBD0AF Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00a2809f8c6ad01bfa8e756395f49c5c3cb8dd5a359641b103742e2c3549b431
Instruction ID: 0e8137d92f915c5b73388f47a5e591677d40e96b297655ba415ee2b668dfc4f3
Opcode Fuzzy Hash: 00a2809f8c6ad01bfa8e756395f49c5c3cb8dd5a359641b103742e2c3549b431
Instruction Fuzzy Hash: E2D012716052419FEB114F709A28B657F51EB51251F89C0ABE44A83191EBB4D415CF14

Function 05BBD0C0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 050abc9dcf1eae79aa6e1905ac472c4d00000bb96e69c14aee34fdaa93c89ec0
Instruction ID: b77d1efa27f6ed3e8476cb3f8c099cd12c356a28e2a01395087d59a77cb83ec4
Opcode Fuzzy Hash: 050abc9dcf1eae79aa6e1905ac472c4d00000bb96e69c14aee34fdaa93c89ec0
Instruction Fuzzy Hash: CDD0C9306042089FEB105E71DA19B65BA99EB00691F80C07AF80582150EFF5E451D660

Function 05BBF868 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc2d7106b7c42f3a8c6b12fe94385d259f605ab3e078d94271162dbc21b6f078
Instruction ID: 9012b0cc64b87d2e198caef65eb7ad512a43c83b091a9c9cefa0edd57e33e051
Opcode Fuzzy Hash: fc2d7106b7c42f3a8c6b12fe94385d259f605ab3e078d94271162dbc21b6f078
Instruction Fuzzy Hash: 33D09239204108EFD7409FA5D985E49B765EF18320F0580A1F90D8F722C631E815AF91

Function 05BB5CE8 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c746df4cab3cef3612b50c33bedd8a14a81602e989db67e9cf6d8a770ed27e0
Instruction ID: fdbd6079a2be48d1364695d1f7acef85948f264fdfee2b175fca11a49d872db2
Opcode Fuzzy Hash: 3c746df4cab3cef3612b50c33bedd8a14a81602e989db67e9cf6d8a770ed27e0
Instruction Fuzzy Hash: 51C08C36200208BFDB80AFD4C800E6677ADAB58714F50D004FB080F201C272ECA3DBA0

Function 05BBF83E Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14bb3cea138d1f89b59a921bdefb4b9e7ac429f7b148f6fc4f3fb4c2c0e08a65
Instruction ID: 38911bc9f4880d1c744c9e8a06ccd14aa0256a6b7fd4a5c4bbc4eebb7527530c
Opcode Fuzzy Hash: 14bb3cea138d1f89b59a921bdefb4b9e7ac429f7b148f6fc4f3fb4c2c0e08a65
Instruction Fuzzy Hash: 61D0C9B58456484FC7659A75CC417DD7B20BF66220F8BAB9A8090451D2DA904184CB51

Function 05BB95C0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b55215b4da23cef1bf2ed7d5f5532a3a93c8618d41a40b69d2dcb4887512c069
Instruction ID: abcb4b076a5d0e41a9dee7cdb4903929623d8b35e2c2fbd953dd95a889ae231d
Opcode Fuzzy Hash: b55215b4da23cef1bf2ed7d5f5532a3a93c8618d41a40b69d2dcb4887512c069
Instruction Fuzzy Hash: 4FC01276208284AFC702A7A48D49C027FB0AF9260074980D6E2988A072C6A09A2CD722

Function 05BBF878 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d6f2623337c38ef8749255ff78b3cbedb78fba73e040c9434c39499d8169e63
Instruction ID: 61412fa5721fa0801f19765b42d0f6ac58f054d2697597a3f249e516f761f0d5
Opcode Fuzzy Hash: 1d6f2623337c38ef8749255ff78b3cbedb78fba73e040c9434c39499d8169e63
Instruction Fuzzy Hash: 87C00235140108AFC740DF55D445D95BBA9EB59660B1180A1F9484B722C632E9119A90

Function 05BB7A94 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1659006365.0000000005BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5bb0000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb3324970531e32559f4c07ae89d8c69c3eca0cf34872322c433be2f02c57338
Instruction ID: 57a7320fa0e13519dd8949bdfe6fe90ac82b6b3c220bb03b726b76e48a83f6e9
Opcode Fuzzy Hash: bb3324970531e32559f4c07ae89d8c69c3eca0cf34872322c433be2f02c57338
Instruction Fuzzy Hash: F0C08C35040100AF9702A7548484C6A76B5FF81300B40C881A280450219AE0D928D713

Analysis Process: Exccelworkbook.exePID: 1256, Parent PID: 1040COMMON

Execution Graph

Execution Coverage:	10.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	194
Total number of Limit Nodes:	10

Executed Functions

Function 0110FB00 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0110FB7E
GetCurrentThread.KERNEL32 ref: 0110FBBB
GetCurrentProcess.KERNEL32 ref: 0110FBF8
GetCurrentThreadId.KERNEL32 ref: 0110FC51

Memory Dump Source

Source File: 00000007.00000002.1678332023.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1100000_Exccelworkbook.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 38d56fad5e67e3eff2b913856f22736bfc6d038cc0799a8277c359f4acd4c316
Instruction ID: 0e4dd57885a8c7db405093b39926411ff0d8a4d39cb4b3454411f0ff38b2cf95
Opcode Fuzzy Hash: 38d56fad5e67e3eff2b913856f22736bfc6d038cc0799a8277c359f4acd4c316
Instruction Fuzzy Hash: DC5148B0D0074A8FDB18CFA9D549BDEBBF1EF88314F208419E419A7290D7789945CF65

Function 02C85DD4 Relevance: 1.7, APIs: 1, Instructions: 247
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 02C86016

Memory Dump Source

Source File: 00000007.00000002.1680943996.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c80000_Exccelworkbook.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: bb93f8000b20cdd5e446804249e87f69159c4957d765735fde22005d2db513ef
Instruction ID: caaf3a287524027a3a181282eb52fe509936443ef3bad76e9b6a9478c118d41d
Opcode Fuzzy Hash: bb93f8000b20cdd5e446804249e87f69159c4957d765735fde22005d2db513ef
Instruction Fuzzy Hash: 87A15A71D002598FEB20DF68C8817EDBBB2FF44318F14816AD809A7280DB799A85CF91

Function 02C85DE0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 02C86016

Memory Dump Source

Source File: 00000007.00000002.1680943996.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c80000_Exccelworkbook.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: e19ee1f7b742babf4083e521ab9c5a777e7d655e0b518483e1d459cce24db5e3
Instruction ID: 2afcb0270aaa7b721fb88f43430f3c4dae542cef084423014d050226e7a8791c
Opcode Fuzzy Hash: e19ee1f7b742babf4083e521ab9c5a777e7d655e0b518483e1d459cce24db5e3
Instruction Fuzzy Hash: E1914A71D002599FEB20DF68CC807DDBBB2FF48318F158169E809A7280DB799A85CF95

Function 01106404 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 01107D91

Memory Dump Source

Source File: 00000007.00000002.1678332023.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1100000_Exccelworkbook.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b94cccd441060baacbbadeb8544f87720942c044fc1c3bf47eb29bf0eb8edbe0
Instruction ID: 86b0ebf14d73f6265580b605d09af308072105836cb2d449524d1387cdaf79ca
Opcode Fuzzy Hash: b94cccd441060baacbbadeb8544f87720942c044fc1c3bf47eb29bf0eb8edbe0
Instruction Fuzzy Hash: A241D2B1C00719CBEB29DFA9C884BDDBBB5BF49304F20845AD408AB291D7B56946CF90

Function 01107CD5 Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 01107D91

Memory Dump Source

Source File: 00000007.00000002.1678332023.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1100000_Exccelworkbook.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: fa32cd93579f57b8163ca6885caeb5df4878c9a8faf759b669b26affd106dfdd
Instruction ID: 60092e4fb25a526e7257a9f5c5263a8f9998dc65e11bd9101e04c4944abed76d
Opcode Fuzzy Hash: fa32cd93579f57b8163ca6885caeb5df4878c9a8faf759b669b26affd106dfdd
Instruction Fuzzy Hash: 9F41C5B1C00719CFEB29CFA9C8857DDBBB2BF48304F24845AD418AB254D7B96946CF50

Function 02C85B50 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 02C85BE8

Memory Dump Source

Source File: 00000007.00000002.1680943996.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c80000_Exccelworkbook.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 18ce463f78422a64d691bee68be5284f89391c4baac9e92b126d781b89fcb676
Instruction ID: e0c122f41006f63ba9989b8495afba854f6547658515770be19486a97e22dd5c
Opcode Fuzzy Hash: 18ce463f78422a64d691bee68be5284f89391c4baac9e92b126d781b89fcb676
Instruction Fuzzy Hash: 202146B1D003599FDB10DFA9C884BEEBBF1FF48314F10842AE918A7240CB789945CB60

Function 02C85B58 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 02C85BE8

Memory Dump Source

Source File: 00000007.00000002.1680943996.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c80000_Exccelworkbook.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: f68f4f753ac6bf1b026f339f719457fea54025d5458fe7bee1120822b75061c1
Instruction ID: 28bdbe70d54f6e32f6cd4b46f08d925596bce56343a8aec938474627957fc785
Opcode Fuzzy Hash: f68f4f753ac6bf1b026f339f719457fea54025d5458fe7bee1120822b75061c1
Instruction Fuzzy Hash: 43212AB5D003499FDB10DFAAC885BEEBBF5FF48314F508429E919A7240D7789941CBA0

Function 02C85C40 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 02C85CC8

Memory Dump Source

Source File: 00000007.00000002.1680943996.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c80000_Exccelworkbook.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 6b2dc20c9e1757bc8c5265e1329b31e36dc778494e2d5628be83693be59cc445
Instruction ID: 0e512e27cdb029ecbbadb97672d8bf001191007d271a08b941e02f4a224a8fd3
Opcode Fuzzy Hash: 6b2dc20c9e1757bc8c5265e1329b31e36dc778494e2d5628be83693be59cc445
Instruction Fuzzy Hash: 68210771D007599FDB10DFAAC9817DEBBB1FF48310F50882AE958A7240D7789945CB60

Function 02C85C48 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 02C85CC8

Memory Dump Source

Source File: 00000007.00000002.1680943996.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c80000_Exccelworkbook.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 3ad5057d774ccbdc2c2abf6c80e94c2c70e116c467b37d520e7978d6fbc869de
Instruction ID: 90782fbca1cd5f79d73e1c6344cae2eff1c4355788d31a1ee9e4debc69452f4a
Opcode Fuzzy Hash: 3ad5057d774ccbdc2c2abf6c80e94c2c70e116c467b37d520e7978d6fbc869de
Instruction Fuzzy Hash: 092116B1D003599FDB10DFAAC880BEEBBF5FF48310F50842AE518A7240C7789941CBA0

Function 02C85588 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 02C85606

Memory Dump Source

Source File: 00000007.00000002.1680943996.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c80000_Exccelworkbook.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 3c14d37003dac1e8c60bf4e15f27e142ad1e632a08ac1cfb3d87c64873df5872
Instruction ID: 891fea8564939acd4d55055ed83806b4057500f44fe310a99e505d6058be74aa
Opcode Fuzzy Hash: 3c14d37003dac1e8c60bf4e15f27e142ad1e632a08ac1cfb3d87c64873df5872
Instruction Fuzzy Hash: EE2147B1D003098FDB10DFAAC4857EEBBF4EF88324F54842AD419A7240CB78A945CFA4

Function 02C85580 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 02C85606

Memory Dump Source

Source File: 00000007.00000002.1680943996.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c80000_Exccelworkbook.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: b73066db7931bdb4e88f8e3791e1626b1f352febd977b7d1c063a0f45ff68d27
Instruction ID: a888637fee5361a566502074c5fbde818d865eb150bdb744789d96d2a33d964f
Opcode Fuzzy Hash: b73066db7931bdb4e88f8e3791e1626b1f352febd977b7d1c063a0f45ff68d27
Instruction Fuzzy Hash: E62138B5D003098FDB10DFAAC5817EEBBF5EF48214F54C42AD419A7240CB789945CFA4

Function 0110FD48 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0110FDCF

Memory Dump Source

Source File: 00000007.00000002.1678332023.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1100000_Exccelworkbook.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e8831de448584c3e15dac00ff1819db59d6753a640d23b18798d050277ea828f
Instruction ID: 10bd20dd0100a9f383e6326179fcc4517091b57049d6b03e3097f145140ccb48
Opcode Fuzzy Hash: e8831de448584c3e15dac00ff1819db59d6753a640d23b18798d050277ea828f
Instruction Fuzzy Hash: AA21C4B5D002499FDB10CF9AD585ADEBBF5EB48310F14841AE918A3350D378A945CF65

Function 02C85A90 Relevance: 1.6, APIs: 1, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 02C85B06

Memory Dump Source

Source File: 00000007.00000002.1680943996.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c80000_Exccelworkbook.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a92a11a3bb5f4cabe5e4015d7b90c2f3f335abba6b332d437fe666f0fe8d67fb
Instruction ID: 90f60f71a576ab0806c1abb3e1f55970210b11940fd10eaa47ee086b18c32818
Opcode Fuzzy Hash: a92a11a3bb5f4cabe5e4015d7b90c2f3f335abba6b332d437fe666f0fe8d67fb
Instruction Fuzzy Hash: 281147729002499FDB20DFAAC444BDEBBF5EF48310F208819E519A7250CB799941CFA0

Function 02C85A98 Relevance: 1.6, APIs: 1, Instructions: 53
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 02C85B06

Memory Dump Source

Source File: 00000007.00000002.1680943996.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c80000_Exccelworkbook.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d85c0b4c7024f3e7a9ff08490868e0d5048b4e5890c6b2a7eff0d51797473c20
Instruction ID: bc0f46996482999fcff5885598b231c151b6f61ef6f9784a1806f2cfed6a147f
Opcode Fuzzy Hash: d85c0b4c7024f3e7a9ff08490868e0d5048b4e5890c6b2a7eff0d51797473c20
Instruction Fuzzy Hash: E41129719003499FDB20DFAAC844BDEBBF5EF48324F148419E519A7250CB79A941CFA4

Function 02C85099 Relevance: 1.6, APIs: 1, Instructions: 50
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE(?), ref: 02C85102

Memory Dump Source

Source File: 00000007.00000002.1680943996.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c80000_Exccelworkbook.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: ddb3b27618ff696c74f45785630c954bfce5967ce7f30ec021886ecfdec964b3
Instruction ID: 81dee74573a85c19b54d848a3f0ca8722776ddc326ce0c86ab8d5f19cff4ef50
Opcode Fuzzy Hash: ddb3b27618ff696c74f45785630c954bfce5967ce7f30ec021886ecfdec964b3
Instruction Fuzzy Hash: E0112EB1D003498FDB20DFAAC4857EEBBF5EF88314F148459D419A7240CB795545CFA4

Function 02C850A0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 02C85102

Memory Dump Source

Source File: 00000007.00000002.1680943996.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c80000_Exccelworkbook.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: a13c795338d481913b6cba4286ec7ddc3d443b8f48a0bccae5569ff13aea1dfa
Instruction ID: 63194a45b6fbda72f7c3a4bda11adf4f59afedddae1783ae738a4d1338919bfb
Opcode Fuzzy Hash: a13c795338d481913b6cba4286ec7ddc3d443b8f48a0bccae5569ff13aea1dfa
Instruction Fuzzy Hash: C511FB75D003498FDB20DFAAC4457DEFBF5EB88324F248419D519A7240CB79A545CBA4

Function 02C843D8 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 02C88185

Memory Dump Source

Source File: 00000007.00000002.1680943996.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c80000_Exccelworkbook.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: de10fc273e8c6bfcda7adbb2c4adb02ad7abc87d0969da429de535dfc4338496
Instruction ID: 5915fd25c2cd63ac6245614b9c666e645f02db1b0eb122c4fd449d7a62a9124d
Opcode Fuzzy Hash: de10fc273e8c6bfcda7adbb2c4adb02ad7abc87d0969da429de535dfc4338496
Instruction Fuzzy Hash: BA1106B590034D9FDB20DF9AC885BEEFBF8EB48314F108819E518A7600C379A944CFA5

Function 0110DA60 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0110DAC6

Memory Dump Source

Source File: 00000007.00000002.1678332023.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1100000_Exccelworkbook.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f444f2949f2ac138fcd7a76818c20f8a0af2692214c31669be466ac774e50679
Instruction ID: e018c1bd653d7a9924f5a4cb56566a72bee1e069f6a5dba61a500e0d64b44812
Opcode Fuzzy Hash: f444f2949f2ac138fcd7a76818c20f8a0af2692214c31669be466ac774e50679
Instruction Fuzzy Hash: F11110B6C00249CFDB24DF9AD444BDEFBF4EB88220F10841AD929B7250C379A545CFA1

Function 02C88120 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 02C88185

Memory Dump Source

Source File: 00000007.00000002.1680943996.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2c80000_Exccelworkbook.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: fd87c1e0b8421753f7eb46a0a9a21532acc0f213e8af4858a66207444f9dc951
Instruction ID: db5567efafc34c537d2851c9bb9413ed9d74439b4b7b41b709cc2eb246eda5ad
Opcode Fuzzy Hash: fd87c1e0b8421753f7eb46a0a9a21532acc0f213e8af4858a66207444f9dc951
Instruction Fuzzy Hash: 151103B5900349CFDB10DF99C985BEEBBF4FB48314F20885AD918A7600C379A944CFA0

Function 010AD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1677658649.00000000010AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10ad000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dae734ed2fe46efeb6adc02835812bb32d30b0f6fa1a89604248400147d3b57d
Instruction ID: 428ddc6a68ca323d25f3c868a9ae94a9e0ca75dcfb3feaea9224c228959eade9
Opcode Fuzzy Hash: dae734ed2fe46efeb6adc02835812bb32d30b0f6fa1a89604248400147d3b57d
Instruction Fuzzy Hash: 1F212572500304DFDB05DF94D9C0F5ABFA5FB88324F60C1A9E9490B656C73AE456CBA2

Function 010BD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1677824493.00000000010BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10bd000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05c34d269a6e87cf0b1089fcde68da05acd1fcb4021849ecfbdae77c20aed258
Instruction ID: a5d8fc45943c59c1674166a5c33d85623a4f11d7a9e99999219fbc915e2b2787
Opcode Fuzzy Hash: 05c34d269a6e87cf0b1089fcde68da05acd1fcb4021849ecfbdae77c20aed258
Instruction Fuzzy Hash: 4F212271614300DFDB15DF94D8C0B56FBA1EB88358F20C5ADE88A0B242C33AD847CB62

Function 010BD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1677824493.00000000010BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10bd000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bd7e7e28186a780ea443d7b39b6f02acc52d3dc87f021c0f2ee86e1874ffaa0
Instruction ID: 3255525d6c4e7c70f859c9bc97d3a3cf670ec0b2ed339f992302d9d77c6226d4
Opcode Fuzzy Hash: 2bd7e7e28186a780ea443d7b39b6f02acc52d3dc87f021c0f2ee86e1874ffaa0
Instruction Fuzzy Hash: 1821F571504384EFDB05DF94D5C0B55FBA5FB94328F20C5ADD8894B252C336D846CB61

Function 010BD006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1677824493.00000000010BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10bd000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74c034c4993796f0a0c3b9283d4e444a961cbe9140dee0361f2cde3aec36ce93
Instruction ID: 63aa3140d354fce299f927c1292de087e45fdee6ba2b014560c75af5d019edb2
Opcode Fuzzy Hash: 74c034c4993796f0a0c3b9283d4e444a961cbe9140dee0361f2cde3aec36ce93
Instruction Fuzzy Hash: DC2183755083809FCB02CF54D9D4711BFB1EB46214F28C5DAD8898F2A7C33A9816CB62

Function 010AD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1677658649.00000000010AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10ad000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1166f709330a6c50fb0ccab333658baa4cf0de4601631cd9e1789cef95a599a7
Instruction ID: 2568b3e444050d429bfbd74bc664516e71e91920bcb6a5cfcf51f98f81dde398
Opcode Fuzzy Hash: 1166f709330a6c50fb0ccab333658baa4cf0de4601631cd9e1789cef95a599a7
Instruction Fuzzy Hash: C311E176404240CFDB06CF84D5C4B56BFB1FB84324F24C2A9D8490B657C33AE456CBA1

Function 010BD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1677824493.00000000010BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10bd000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5930c3722e95abe2067eb95ddfb8aa1848112c8b53b048d5b6b565b5491e75cf
Instruction ID: f3813b8c20686dfc0ffa760ca2984abdd8c1f550196b46fedecc9ab62d8f6bc8
Opcode Fuzzy Hash: 5930c3722e95abe2067eb95ddfb8aa1848112c8b53b048d5b6b565b5491e75cf
Instruction Fuzzy Hash: A411BB75504280DFCB06CF54C5C0B15FFA1FB84228F24C6A9D8894B296C33AD80ACB61

Function 010AD745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1677658649.00000000010AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10ad000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca3f46f0262faa3be877d55ef7a2f530b5b9da76c9e5e3e7d2d63f0d8aed7600
Instruction ID: 672e125061dad46cbe7b9fb6c72605fa87d30b8965dc8e1aeb292d4548f5e04d
Opcode Fuzzy Hash: ca3f46f0262faa3be877d55ef7a2f530b5b9da76c9e5e3e7d2d63f0d8aed7600
Instruction Fuzzy Hash: 8301F7311043809AF7259AD5CC84B6EBFE8FF41264F44C55AEE490A682E7799841CBB5

Function 010AD744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1677658649.00000000010AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10ad000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d9c4a9fc4a34c8c33397e30f2c650d2490616f25d7d34cc36cb99c120fbd78f
Instruction ID: 413c6ed84a35f23e36e172fd427e0b05fc8b7476493c7adb35330142fdcb4e83
Opcode Fuzzy Hash: 3d9c4a9fc4a34c8c33397e30f2c650d2490616f25d7d34cc36cb99c120fbd78f
Instruction Fuzzy Hash: 1EF0C231404384AEE7248E59C8C4B6AFFE8EB41274F18C45AED480E696D2799841CBB1

Analysis Process: Exccelworkbook.exePID: 6188, Parent PID: 5908COMMON

Execution Graph

Execution Coverage:	9.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	88
Total number of Limit Nodes:	11

Executed Functions

Function 0803B6D0 Relevance: 3.2, Strings: 2, Instructions: 719
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(q, xrefs: 0803B890
(q, xrefs: 0803BEDB

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID: (q$(q
API String ID: 0-2485164810
Opcode ID: 2accf3a268824b9379a366ec487827b8c2517a5771152efa7f56f633052cbb59
Instruction ID: 30847bb37f26686cb03bc3a789a0f4dd9595adcb8d8421ad4a64c98a24f5b94c
Opcode Fuzzy Hash: 2accf3a268824b9379a366ec487827b8c2517a5771152efa7f56f633052cbb59
Instruction Fuzzy Hash: C5428A74B007168FCB18DF69C4A466EFBF6FF88315F148929E55A97391DB34A802CB84

Function 08039700 Relevance: 9.2, Strings: 7, Instructions: 409
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(q, xrefs: 08039ED8
(q, xrefs: 08039A48
Hq, xrefs: 08039BFD
(q, xrefs: 08039BA6
Hq, xrefs: 08039BD2
(q, xrefs: 080399DE
(q, xrefs: 08039B7A

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID: (q$(q$(q$(q$(q$Hq$Hq
API String ID: 0-1366513505
Opcode ID: 14edf6adbe278357f2a3c29578b21a69af1b1d90f717ad5bbaaffe020c77045c
Instruction ID: e4b7abc4f56d47610ee2f1b27d023fcfe32028a92b514ba2af93268536addc13
Opcode Fuzzy Hash: 14edf6adbe278357f2a3c29578b21a69af1b1d90f717ad5bbaaffe020c77045c
Instruction Fuzzy Hash: 64E1E030604B15CFD715CB68D48466EBBE7FF86216B548A1DD486CB785CB70EC02CB94

Function 015D6518 Relevance: 6.1, APIs: 4, Instructions: 142
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 015D65BE
GetCurrentThread.KERNEL32 ref: 015D65FB
GetCurrentProcess.KERNEL32 ref: 015D6638
GetCurrentThreadId.KERNEL32 ref: 015D6691

Memory Dump Source

Source File: 0000000A.00000002.3977519997.00000000015D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_15d0000_Exccelworkbook.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 1ecaf609b9e9ef057d72897ddf3824b3705946eb6e1972005036d097fd8c7ff6
Instruction ID: 9e073c215dfbc3fe16b0017abf44da0dbcccea6d281d20a4a3b9802fcfa356b8
Opcode Fuzzy Hash: 1ecaf609b9e9ef057d72897ddf3824b3705946eb6e1972005036d097fd8c7ff6
Instruction Fuzzy Hash: F55166B09103498FEB14CFA9D549BDEBFF1FF48314F24845AE409AB290DB38A945CB65

Function 015D6540 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 015D65BE
GetCurrentThread.KERNEL32 ref: 015D65FB
GetCurrentProcess.KERNEL32 ref: 015D6638
GetCurrentThreadId.KERNEL32 ref: 015D6691

Memory Dump Source

Source File: 0000000A.00000002.3977519997.00000000015D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_15d0000_Exccelworkbook.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 4041580eca081661518e0abdcf092acf043a18d05b7003dd5dc14c9ebafadb79
Instruction ID: 6157b2007968576a82eb6fa45652ee2dde23e4f436a0b7525581bf92284ff8cf
Opcode Fuzzy Hash: 4041580eca081661518e0abdcf092acf043a18d05b7003dd5dc14c9ebafadb79
Instruction Fuzzy Hash: 945145B0900309CFDB24CFA9D588B9EBBF1FF88314F24855AE419A7350DB786945CB65

Function 080328A0 Relevance: 4.1, Strings: 3, Instructions: 365
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(q, xrefs: 080329C9
Hq, xrefs: 08032A21
(q, xrefs: 080329F5

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID: (q$(q$Hq
API String ID: 0-2914423630
Opcode ID: 5d4e8b4bce9875c85d80adc3d48a84a4a3e740c05aa4385a300be990075f4fb6
Instruction ID: a147cf3f65ce8c0fe4c9506e4c272d41139f12badcc034b33acf4e0a79741940
Opcode Fuzzy Hash: 5d4e8b4bce9875c85d80adc3d48a84a4a3e740c05aa4385a300be990075f4fb6
Instruction Fuzzy Hash: 01E1A634A00219DFCB58EFA4D5949AEB7B6FF89301F118569E402AB364DF34ED42CB91

Function 015D7364 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 015D7421

Strings

U, xrefs: 015D736D

Memory Dump Source

Source File: 0000000A.00000002.3977519997.00000000015D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_15d0000_Exccelworkbook.jbxd

Similarity

API ID: Create
String ID: U
API String ID: 2289755597-3372436214
Opcode ID: e294e25afb3f6e5b8d7adda58ecc670f208f87e2d8c8d25f268b3e7979c26696
Instruction ID: cc6a61a7667ec9b837c6220919e83e782b5a57a2c865133dafd40837bacdd122
Opcode Fuzzy Hash: e294e25afb3f6e5b8d7adda58ecc670f208f87e2d8c8d25f268b3e7979c26696
Instruction Fuzzy Hash: 7341B170C00719CFEB25CFA9C884BDDBBB5BF49318F20846AD419AB251DB796946CF90

Function 0803BF90 Relevance: 2.9, Strings: 2, Instructions: 434
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(q, xrefs: 0803C26B
Hq, xrefs: 0803C297

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID: (q$Hq
API String ID: 0-1154169777
Opcode ID: 2662286b0077e1ae8e1b9d5fc9a20eb387de886d30925edc1e70d436ddb83387
Instruction ID: e3dd5eeb8a18c107bca041541d04b8cf3bb80b5912108daba80f58bfc5e67363
Opcode Fuzzy Hash: 2662286b0077e1ae8e1b9d5fc9a20eb387de886d30925edc1e70d436ddb83387
Instruction Fuzzy Hash: 7DE1DE30B003168FDB289B69C45026EBBF7FFC5214B24892ED44ADB791DE35E802DB84

Function 0803AE30 Relevance: 2.7, Strings: 2, Instructions: 175
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(q, xrefs: 0803AF55
Hq, xrefs: 0803AF81

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID: (q$Hq
API String ID: 0-1154169777
Opcode ID: 5492b79992acc81fffa9e99d35bfe7ebdd20154819057bd3d2fac6d74f8ad667
Instruction ID: 0f7c95f8a2c4004e77468bc8f77a801b8f750feef95ca50d42c47324c5b3ac33
Opcode Fuzzy Hash: 5492b79992acc81fffa9e99d35bfe7ebdd20154819057bd3d2fac6d74f8ad667
Instruction Fuzzy Hash: 1D51F231300B219FE725DF2AC840B5BB7EAEF85720F10852EE55A8B390DB78D945CB91

Function 08037238 Relevance: 2.7, Strings: 2, Instructions: 164
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(q, xrefs: 080372B1
,q, xrefs: 08037251

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID: (q$,q
API String ID: 0-275420656
Opcode ID: cdf2a13aadb54f938956dd4633fa87bc5857dc8ecf5a6575a34c697fb7d25ec3
Instruction ID: e6a1097930d89ce373afb70273c1da54b2a1063d2c6f265ef207f7c37ddf67bf
Opcode Fuzzy Hash: cdf2a13aadb54f938956dd4633fa87bc5857dc8ecf5a6575a34c697fb7d25ec3
Instruction Fuzzy Hash: BE41D6327001596FDF159EEA9C509FFBBEEEF88111F14403AFA15E3241DA35C92597A0

Function 015DBFF0 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 015DC256

Memory Dump Source

Source File: 0000000A.00000002.3977519997.00000000015D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_15d0000_Exccelworkbook.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 993b57cd4ce966f0f7cd78f3e8869aaa6ea3ffc468f78e4e2486031315be58d2
Instruction ID: 70f7fcadc2114f8f32b850279ff9023be16f99edfb229be0210b2a90730bc1a5
Opcode Fuzzy Hash: 993b57cd4ce966f0f7cd78f3e8869aaa6ea3ffc468f78e4e2486031315be58d2
Instruction Fuzzy Hash: FA8139B0A00B058FE725DF6DC44075ABBF5FF88204F04896ED49ADBA50DB75E846CB91

Function 015D6414 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 015D7421

Memory Dump Source

Source File: 0000000A.00000002.3977519997.00000000015D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_15d0000_Exccelworkbook.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 03facec97920fbb6cbe3c761ab3e6d85b72e259a2f929b3021a1c0148132a317
Instruction ID: 9f935b68cf92d81e782d49a4b544d2a2c768743d81b4feededdd6b70c0fcba9e
Opcode Fuzzy Hash: 03facec97920fbb6cbe3c761ab3e6d85b72e259a2f929b3021a1c0148132a317
Instruction Fuzzy Hash: 1841C170C00719CBEB25DFA9C884B9DBBF5BF48318F20805AD409AB251DB796946CF90

Function 015D6780 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 015D680F

Memory Dump Source

Source File: 0000000A.00000002.3977519997.00000000015D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_15d0000_Exccelworkbook.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: be9077cacf3af3153d187223ed5b07e6c4a2fe6d8c1188b2178b0610d64a5711
Instruction ID: af81af42c9dbd3fbca5f68799fc57f03c16e42a3fff1e13e3a8aa5e92f80b8fd
Opcode Fuzzy Hash: be9077cacf3af3153d187223ed5b07e6c4a2fe6d8c1188b2178b0610d64a5711
Instruction Fuzzy Hash: A821F4B5D003499FDB10CFAAD985ADEBBF4FB48320F14841AE914A7311D778AA45CFA1

Function 015D6788 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 015D680F

Memory Dump Source

Source File: 0000000A.00000002.3977519997.00000000015D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_15d0000_Exccelworkbook.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 06711211f80dc80f82aa5117cfa49865f50ea55e035af7225af21c0e476667b9
Instruction ID: 0adc83e25e5c2c9bce190a1f1870c9c6ed661f310d21c1e4f92b0d8689721e2e
Opcode Fuzzy Hash: 06711211f80dc80f82aa5117cfa49865f50ea55e035af7225af21c0e476667b9
Instruction Fuzzy Hash: 6F21E4B5D003489FDB10CF9AD984ADEBBF5FB48310F14841AE918A7310D778A941CFA1

Function 015DC1F0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 015DC256

Memory Dump Source

Source File: 0000000A.00000002.3977519997.00000000015D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_15d0000_Exccelworkbook.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 8ef5eabe378047a398f55419826d6ee779ef03a0f4e02412d8fcf2329469a916
Instruction ID: 0c1509d5ec712b21a9570b9705bac1836739aded12be55d69306a99ebfc1b7b4
Opcode Fuzzy Hash: 8ef5eabe378047a398f55419826d6ee779ef03a0f4e02412d8fcf2329469a916
Instruction Fuzzy Hash: 4711E0B5C003498FDB20DF9AC444BDEFBF5EF88214F10851AD969A7210D379A545CFA1

Function 08030F18 Relevance: 1.4, Strings: 1, Instructions: 171
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hq, xrefs: 08030FB5

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID: Hq
API String ID: 0-1594803414
Opcode ID: 4699780b2dc18fa0db91ae48b3d40ffe033c3288a506ad702388abf1155f565d
Instruction ID: bf5ea157bbde011cfedcdd51dd0e198b8d2163800a52dc1f054e441e05cc8543
Opcode Fuzzy Hash: 4699780b2dc18fa0db91ae48b3d40ffe033c3288a506ad702388abf1155f565d
Instruction Fuzzy Hash: 5951A274B00A168FCB54EF68C954A6EB7FAFF89310B10416AE506DB360DB30ED06CB91

Function 080330A8 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

(q, xrefs: 08033105

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID: (q
API String ID: 0-2414175341
Opcode ID: 12d341ddb9841c7f785a7f443ae398449bfbc31865a18f3ef042d6ebc36b2d0b
Instruction ID: 2970013ead369e1a660f09a71f88d9e87d670494f8dace122c274c80a2aa0e97
Opcode Fuzzy Hash: 12d341ddb9841c7f785a7f443ae398449bfbc31865a18f3ef042d6ebc36b2d0b
Instruction Fuzzy Hash: 6B21C032604214AFC70A8F65D804D59BFB7FF8922071680AAE109DB332DB35D811DB95

Function 08030E88 Relevance: 1.3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

Strings

(q, xrefs: 08030ED6

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID: (q
API String ID: 0-2414175341
Opcode ID: fddcd9788eea93df3531375c44f72d2693addd0ead9ca5ab0b345d3eb14487f0
Instruction ID: 0cfaa7a43b1b213acfc2ca7b2147f3b62b5cd6471eec754a377da2bf22062d64
Opcode Fuzzy Hash: fddcd9788eea93df3531375c44f72d2693addd0ead9ca5ab0b345d3eb14487f0
Instruction Fuzzy Hash: 6A01F2213087628FD75A2628582077E3ADB9FC6601F15406EE942DB382DE799C06C3A6

Function 0803A550 Relevance: 1.3, Strings: 1, Instructions: 27COMMON

Download Yara Rule

Strings

xq, xrefs: 0803A550

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID: xq
API String ID: 0-3670251435
Opcode ID: fcbd393072c6dffbc83529833215acc2354cd1aeae700dc8b3cdd512e251a3c7
Instruction ID: 1a8a42cef3e134ffd92ff6e73dc6abc42eb49b5137ff9ec9aac30a8eead273bf
Opcode Fuzzy Hash: fcbd393072c6dffbc83529833215acc2354cd1aeae700dc8b3cdd512e251a3c7
Instruction Fuzzy Hash: 17F0A0347001109FDB04CB18D941A99B7F5FF88614F158199E50A9F361C772FC028F90

Function 080321B0 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d07841b9025a4d639f7ec9971ad7b0ee9ec8b8038c1eaf97047618567681b17e
Instruction ID: 38750b8add1e290c0a9c7cd357e511be034742f03241670d4e747c663995ea70
Opcode Fuzzy Hash: d07841b9025a4d639f7ec9971ad7b0ee9ec8b8038c1eaf97047618567681b17e
Instruction Fuzzy Hash: 04125C34A002288FCB54EF68C994B9DB7B6BF89301F5185A9D54AAB365DF30ED85CF40

Function 080378F1 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c69e1a6f7d26408542b83891732039c9634c563c2a17e902dc0c10a7da6b8b1
Instruction ID: e70da828c3d0ef3224c9343417c426dab31d4ede5a66c4748400d1164b83f055
Opcode Fuzzy Hash: 1c69e1a6f7d26408542b83891732039c9634c563c2a17e902dc0c10a7da6b8b1
Instruction Fuzzy Hash: 84D13E75B00228CFDB44EFA4C994AADB7B6FF88301F114169E502AB3A1DB75EC42CB50

Function 08035988 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7deffd0712991f362154757327c606fa4fcb4c8d9ec46000f77aa2446dcd3735
Instruction ID: d17e389c485ceb6fd1a6a32607d7e51d3039a591356ab3ad752a8aaada4507fd
Opcode Fuzzy Hash: 7deffd0712991f362154757327c606fa4fcb4c8d9ec46000f77aa2446dcd3735
Instruction Fuzzy Hash: E9C1D334B006258FDB65EF64D854BAE7BF7AF84301F10852DD5019B3A0DB74AD42CB91

Function 08036680 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b075113101706b63a9c13f870e15c1f24c7590f348bed0b442f48b1581ff9a5
Instruction ID: 7f7b123f8f703901a5ac2c42825cd28fa1fc5d32799fc7affdc57e9a9a1bb87b
Opcode Fuzzy Hash: 3b075113101706b63a9c13f870e15c1f24c7590f348bed0b442f48b1581ff9a5
Instruction Fuzzy Hash: 00D11F34B11228AFDB44EFA4D994E9EB7B7FF88701F118059E502AB3A5DB75AC01CB50

Function 08036B14 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8fc183ab35e9d2c2baed2cf618bbd9c14094442a420649564467f7ac3eb41b7
Instruction ID: 8112d6aa256b17c38159c41c9eda1945eeba73a2a60a5c884d9de921ee70bc34
Opcode Fuzzy Hash: e8fc183ab35e9d2c2baed2cf618bbd9c14094442a420649564467f7ac3eb41b7
Instruction Fuzzy Hash: 2EB1BF347006248FCB44EF68C8A0AAE7BF7BF89700B104569E5129B3A1DF75EC46DB91

Function 08037920 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a76ff65923c068d5125bc6fc12f8bd12e65afbedf9f3bfb8a4ddba8907e93a8
Instruction ID: 6e616bc869152b63111ad0e51da24178876b5b3c403da0b20b3dd0639aae5e4e
Opcode Fuzzy Hash: 2a76ff65923c068d5125bc6fc12f8bd12e65afbedf9f3bfb8a4ddba8907e93a8
Instruction Fuzzy Hash: 53C1E874B00628CFDB44EFA4C994AADB7B6BF88301F104169E506AB3A5DB71AC42CB50

Function 08036653 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90eca9cad1da9b42bd2a47afcf411e7391e002b6913dba9b3847f89d97fa896e
Instruction ID: bc97388e2041c0f89024bdfd864e2a1e16729ac20c01723dbd5c4eeadf965623
Opcode Fuzzy Hash: 90eca9cad1da9b42bd2a47afcf411e7391e002b6913dba9b3847f89d97fa896e
Instruction Fuzzy Hash: 03B13034B112289FDB44EFA8D994F9EBBB7BF88701F104159E502AB3A5DB75AC01CB50

Function 08036B48 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d42e5cc69ae4e078dc7a9b0f50ae000c9e2668cab7e929f5175cdd612fced59
Instruction ID: 4dbd5ee4031c68bd387f4062795dd5ab4a4dd5d7434db0d7e22f7d567c0bf75e
Opcode Fuzzy Hash: 1d42e5cc69ae4e078dc7a9b0f50ae000c9e2668cab7e929f5175cdd612fced59
Instruction Fuzzy Hash: ECA18D347006188FCB44EF68C8A4AAE77B7BF89700F008569E5129B3A4DF75AD46DB91

Function 08033170 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 898d61b0eb7d23cb89abf4974138cb4f5ef6ff05b72f02cc3fbf9b0f041d7f25
Instruction ID: 8bec067fc7aef8ca0030c570763aa4ed265bd029c01645e650c2f6cb1f605268
Opcode Fuzzy Hash: 898d61b0eb7d23cb89abf4974138cb4f5ef6ff05b72f02cc3fbf9b0f041d7f25
Instruction Fuzzy Hash: C7913C34700215CFCB54EF68D894AADB7BABF89711F1581A9E506DB3A1CB34EC41CB90

Function 0803B2B0 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e52a1a8d1d365d7a6222c28bf91917682d41bcbe5c4d7eaf8f939d8630f2f05a
Instruction ID: ca9c7d24160b1af1552111207d25b3afdb46bdb4d86599e201d9b6572eea1b20
Opcode Fuzzy Hash: e52a1a8d1d365d7a6222c28bf91917682d41bcbe5c4d7eaf8f939d8630f2f05a
Instruction Fuzzy Hash: 6171B7717002648FDB398B28C0657297BEBBB8532AF19956DE48B8B391CB34DC42D748

Function 0803A6C3 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d07339bbf22c93f040662dfa848dfee168b8e78d2d38fa0f3c5d37198cd5e020
Instruction ID: 350dd30097bf89e43ac18db0cd9a0c7de65d2ab133a36059ef1dcd73450e6845
Opcode Fuzzy Hash: d07339bbf22c93f040662dfa848dfee168b8e78d2d38fa0f3c5d37198cd5e020
Instruction Fuzzy Hash: EA81F274B21628EFDB54CF98D980EAEB7B6BF48310F124159E545AB361E731EC41CB40

Function 08031ED7 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61d2bf32de29c1e3fabb70f484e0b5516b0e293a5acaf5c5f80602738b4a37d0
Instruction ID: 7448481055de15576226cd89a56247ea2123eef6eef682a333bc5563e2bd599d
Opcode Fuzzy Hash: 61d2bf32de29c1e3fabb70f484e0b5516b0e293a5acaf5c5f80602738b4a37d0
Instruction Fuzzy Hash: 35517B31A003618FD716EB28C4E579DBBFEAF89200F14841FD4419F292DF78580AC7A6

Function 08033160 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bf568a6dc7bf6086f246bca8fd28b9b9ba7fc8c0df646b43126de8752ce9897
Instruction ID: 8bfdc94ab7450a702669f721558005c8bbd50d54f77e212f2ee53f098f6758f8
Opcode Fuzzy Hash: 0bf568a6dc7bf6086f246bca8fd28b9b9ba7fc8c0df646b43126de8752ce9897
Instruction Fuzzy Hash: 17613C34B10614DFCB44EF68D894AADB7FABF88711F158169E5169B3A5CB30EC41CB90

Function 08032E38 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c65200e9d66fe6f3c4ec23012d5437e56236566cc025da860e15b99364ba3ab
Instruction ID: 2973ff415e23b9d89559ccd0ff698267c7c157b071bfc314791ce4a960dfab11
Opcode Fuzzy Hash: 4c65200e9d66fe6f3c4ec23012d5437e56236566cc025da860e15b99364ba3ab
Instruction Fuzzy Hash: BA416D353006119FD7699B28C894B3A77A7EFC9702F14856CE6068F7A5DB76EC42CB80

Function 08031F70 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6875586be56733bc96d50527196b68d65dbc30ac7af7315b8961382f396dd633
Instruction ID: 1da434d09309b3cbd191f024d4616185e61ef7f2a5f779387118ff71a2cb199f
Opcode Fuzzy Hash: 6875586be56733bc96d50527196b68d65dbc30ac7af7315b8961382f396dd633
Instruction Fuzzy Hash: 0A41A534B102148FCB94BB64C8A49ADB7BBBFC9701F10441AE503AB394CF749C46CB91

Function 0803AA68 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce963aff69fdc429184c697878aa431a8142fe2a1d9b0cdea09e31b6d047c8ae
Instruction ID: 74b4e39d0baccdd6d655e11a087dd581812dfe4de32eba8fdd246dca8a7c18fe
Opcode Fuzzy Hash: ce963aff69fdc429184c697878aa431a8142fe2a1d9b0cdea09e31b6d047c8ae
Instruction Fuzzy Hash: CD41EF32B006159FC714DF68C844A9EBBF6FFC8210B2481AAD249EB361DB71EC01CB90

Function 0803B148 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 700d0f143cea427a3fee5b4dd3e7b9b2a3eee711217ce59013ba2e996cc8e02f
Instruction ID: 8edeedb39545ba843cf6bcb96082866187cc2a2fd5f19c80e0e8b72533e0c195
Opcode Fuzzy Hash: 700d0f143cea427a3fee5b4dd3e7b9b2a3eee711217ce59013ba2e996cc8e02f
Instruction Fuzzy Hash: F941CE31B00B258FDB75DB78D45029FBBF6EF84224B44896ED45ACBA90DA30E941CB85

Function 08033CC0 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f6cd24614f6eebcd3f3601d3cd76b7b67086df63e2c1b5140d7919a7f0ee9ba
Instruction ID: 48eb19ca29d547613424cd86ed592b6f89487e3c49f84b9992776d66a874f46e
Opcode Fuzzy Hash: 7f6cd24614f6eebcd3f3601d3cd76b7b67086df63e2c1b5140d7919a7f0ee9ba
Instruction Fuzzy Hash: C1419D353006209FE358DB29D894B2B77EAAFC8701F114468E6068F7A1DFB5EC42CB91

Function 0803B578 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b6d663f58da672b959be921571bfd97ab475ff0129472c388d7614a8f60c102
Instruction ID: 183b6c1a757423553ca1b796f9361742452260e3da85fbc6483399a3ff3d5f4b
Opcode Fuzzy Hash: 6b6d663f58da672b959be921571bfd97ab475ff0129472c388d7614a8f60c102
Instruction Fuzzy Hash: 5F41AB75A00B14CFCB20CF69C954A6ABBF2FF88315F18891DE48697A61DB35EA04CF51

Function 08033CE8 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68bda64b6e9ba9e896c9e663e03d005486a5965be987aa87a9c00a2a40cc53e8
Instruction ID: 2c66d6a8a2bebb584375752b191e56d131d8f490261593dfdb04d9a1ca33cb21
Opcode Fuzzy Hash: 68bda64b6e9ba9e896c9e663e03d005486a5965be987aa87a9c00a2a40cc53e8
Instruction Fuzzy Hash: 86318E353006249FE358DB29D894F2B77EAAFC8745F114468E2068B7A1DF75EC42CB91

Function 08035E11 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7605556b728251ef89d1acd737cd73698fcfc1e4a5c0d4d353d348e9534d885d
Instruction ID: 464b5cd12cefc94e817caaee1ff9132ddde7b8dbff0e0db1809826f07629e67f
Opcode Fuzzy Hash: 7605556b728251ef89d1acd737cd73698fcfc1e4a5c0d4d353d348e9534d885d
Instruction Fuzzy Hash: DB31BF34B106288FCB45EF24C8546AEBBBBAF89301F10855AE5029B361DB749D06CB91

Function 080334A0 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 576f09bcad1c3631a7995f6cd251023ee70849da516922ec9b75ff61338d5615
Instruction ID: f9d0d1abff14dacc794da3f36f4fa6b7c56d7f4996ef55053dac115945e1f300
Opcode Fuzzy Hash: 576f09bcad1c3631a7995f6cd251023ee70849da516922ec9b75ff61338d5615
Instruction Fuzzy Hash: 16310A35A001189FDF54DFA8D895AEEB7BAFF88311F108169E901B7394CB75AD05CBA0

Function 08035E28 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93757b4271d7d51ddf2f969ac93b7f1ba81cf2fbb5f216f48e4957455040c626
Instruction ID: 0c7f816b510acf6ba72f3913567c18a822c3ee26a2be21dd53c71235f82bcf45
Opcode Fuzzy Hash: 93757b4271d7d51ddf2f969ac93b7f1ba81cf2fbb5f216f48e4957455040c626
Instruction Fuzzy Hash: FC315C34B106188FCB44FF64C994AAEB7BAAFC9701B10855AE5129B364DF7099029BD1

Function 0138D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3975230924.000000000138D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0138D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_138d000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cb95d37d7a2e11248528804ec04e798f7df18cfdbad174dc9b3c77a52be9f74
Instruction ID: 3c40a474d18112940d4d4b192ddbc5707fd0b70ffb8c63f6959580f3dba9317f
Opcode Fuzzy Hash: 0cb95d37d7a2e11248528804ec04e798f7df18cfdbad174dc9b3c77a52be9f74
Instruction Fuzzy Hash: 602134B1604304DFDB15EF94D8C0B16BB65FB88358F20C56DD80A4B386C33AD847CA62

Function 0803ABB0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81d0093fe9c74213608bc26a0813f2e9ebc1e0f53834e2c32ce717413b33238f
Instruction ID: 8a6d5530050a935588ba40ee5c8b2caa4cdcad44738bde6ccfc3b31a80fa5b59
Opcode Fuzzy Hash: 81d0093fe9c74213608bc26a0813f2e9ebc1e0f53834e2c32ce717413b33238f
Instruction Fuzzy Hash: 9B21AE31A10229DFCB149FA8C854AEE7BBBFF8C321F148529E811A7390DB749841CB90

Function 0803ABC0 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7d78375510cf8422815e9690568065e1b42c6ceefc53ded85a685f0828375d0
Instruction ID: 05fa6740b4e8662bae368876b82b660b33af05a48c87b2c18cdf73c0beaab8b5
Opcode Fuzzy Hash: f7d78375510cf8422815e9690568065e1b42c6ceefc53ded85a685f0828375d0
Instruction Fuzzy Hash: F1217C31A102289FCB159FA9C844AEE7BBBFF8C321F148529E915A7390DB719841CB90

Function 08032D78 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 271014292af92fc98e206a09c11575dfee07c33015d95960fd2265c931d46fb6
Instruction ID: 2794962a514d93222d8ec2ac9165acfdeebea1f5c0d64845239280db42d99351
Opcode Fuzzy Hash: 271014292af92fc98e206a09c11575dfee07c33015d95960fd2265c931d46fb6
Instruction Fuzzy Hash: D421CA347003048FCB54EF28D994AAEB7F6FF89301F1445AAE5029B361DB70AD05CBA1

Function 08038F09 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fd44618b4774c71954e5811e72d9018516aef8e31be7e5178e37628c9dd48ca
Instruction ID: c3d748faff89acb610ee60bed9f2c47af1a758fc76dc0b845a4e9c91b49f1cde
Opcode Fuzzy Hash: 8fd44618b4774c71954e5811e72d9018516aef8e31be7e5178e37628c9dd48ca
Instruction Fuzzy Hash: F011D331A08755AFCB55CBA9C480699BFF6EF06314F14C1EEE459DB282D335A943CB41

Function 08032D88 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffc5ed8e1e4701dc00ab3e4c7959847a5b7a1bfa160f8374d39015f290aaeb4e
Instruction ID: 5690d56da5f4e6276ad903b4abc06268ddc4bc451f6a4108ec5510d3b0b8dd43
Opcode Fuzzy Hash: ffc5ed8e1e4701dc00ab3e4c7959847a5b7a1bfa160f8374d39015f290aaeb4e
Instruction Fuzzy Hash: 8D119D34B006048FCB54EF68D994AAEB7F6FF88301F14456AE5069B360DB70ED05CBA1

Function 0138D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3975230924.000000000138D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0138D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_138d000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5930c3722e95abe2067eb95ddfb8aa1848112c8b53b048d5b6b565b5491e75cf
Instruction ID: 81339b8ddfbdf38a61ff63fd058a96a655984a874905c515a674a0880ffb28d8
Opcode Fuzzy Hash: 5930c3722e95abe2067eb95ddfb8aa1848112c8b53b048d5b6b565b5491e75cf
Instruction Fuzzy Hash: D611BBB5504380CFDB16DF54D5C4B15BFA2FB88318F24C6AAD8494B696C33AD40BCBA2

Function 080335DB Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39844d0a67908ee46d2e672c94b8b5bee5998e4da32fbd3d6ea5d6eb817adfc8
Instruction ID: ebf411cd276878dd9c24b47f0d1679648722e4bffa9a3f8d1ea3f036dc8c3d67
Opcode Fuzzy Hash: 39844d0a67908ee46d2e672c94b8b5bee5998e4da32fbd3d6ea5d6eb817adfc8
Instruction Fuzzy Hash: BC0126343007509FC7269B24D890A3B7BABABC5311F14856DE5528B7A1CB75ED02DB80

Function 0803A8C0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e4a7e6100e60ab8debdc60c1c765ebd0b47644d4242a69afdb78888e6007453
Instruction ID: 354d3eefb79a10717414f8f50656b50474aaff8225880e603160dda85f71f2a2
Opcode Fuzzy Hash: 9e4a7e6100e60ab8debdc60c1c765ebd0b47644d4242a69afdb78888e6007453
Instruction Fuzzy Hash: 7E117030A11229DFCB55CF58D894EADB7F6FF49220F06015AF555AB3A2CB799C41CB40

Function 08030991 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 438519a03e88c2520985ea12c7e4103586740c9d54295d83f6b51b87b367f23f
Instruction ID: 14a31af026348cdc75457b39488b307479183a6105448e29a242f3dd886c53db
Opcode Fuzzy Hash: 438519a03e88c2520985ea12c7e4103586740c9d54295d83f6b51b87b367f23f
Instruction Fuzzy Hash: 62018479300920DFC7189B24D814F2AB7A7EFC8751B108129EA058B790CF75EC02CBD6

Function 0803B6C0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95e391af9c461af07b8769039c58821d5f27b8f2f1105691910185ee70c1a5b6
Instruction ID: fc42673830e0480aa80a12e54ed5fea9e65090cd74470db49c3187aa81cfcba7
Opcode Fuzzy Hash: 95e391af9c461af07b8769039c58821d5f27b8f2f1105691910185ee70c1a5b6
Instruction Fuzzy Hash: EB014035E006199FC711DF69D5159AEBBF9EF89311F10856AE415E3310EB30AA04CF61

Function 080335E8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e4ad5674285f46b43a3e96bf5cba15caea03e91d20726042e61d4e9cb6f3cc4
Instruction ID: 1e6e654b2949d00cb637b4709d4e614e168cc9c571d23889fe5920418ea04860
Opcode Fuzzy Hash: 9e4ad5674285f46b43a3e96bf5cba15caea03e91d20726042e61d4e9cb6f3cc4
Instruction Fuzzy Hash: 2B01D8353006149FD3299B24D494A3BBBEBEBC5311F14856CE5564B7A0CF79EC42DB80

Function 08030718 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c55ecef7e544c07fcede1f745bf986cb1a92bd9bc552d4e0ab9f8df82cae82e0
Instruction ID: 6db8a3a44574cdd71bbb212cbac8d678814e0cc6ca15b0bbf80a3b68e8d78653
Opcode Fuzzy Hash: c55ecef7e544c07fcede1f745bf986cb1a92bd9bc552d4e0ab9f8df82cae82e0
Instruction Fuzzy Hash: A901A4353413509FC7059B25C854D6ABBBBEF8A761B0585EEF942CB361CA31DC42CB91

Function 080309A0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aca6db1ff7d77783c6f37abdc59a4d8900d054f034dcaa4ab9371643f200961
Instruction ID: d5d9cd93c388f73903d16072e1301c6235b93eebcc124cfadd6cd10551fb039c
Opcode Fuzzy Hash: 5aca6db1ff7d77783c6f37abdc59a4d8900d054f034dcaa4ab9371643f200961
Instruction Fuzzy Hash: 07013179300520DFC7199B24D46892AB7A7EFCC751B108169EA168B790CF75EC02CBD6

Function 0137D603 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3975174158.000000000137D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0137D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_137d000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0c06128fad1f27b4a868564f05259d93c5bcd3f753bda2eacacc574b429a31b
Instruction ID: 73606e3a907e76ca38dd73be771b6eb6c5e02c52597b350f56a4bf8284eb462d
Opcode Fuzzy Hash: f0c06128fad1f27b4a868564f05259d93c5bcd3f753bda2eacacc574b429a31b
Instruction Fuzzy Hash: A3F0E776200604AFD7208F0AD984C23FBAEEFD4674715C59AE94A4B652D675FC41CAA0

Function 08030E78 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9253e05f18d14e20c9763c3e9f73f259a63028fab6c141538ab63a2f3c9f8a3e
Instruction ID: b6f8854b9fd110d15903cab500127452350273b81b63f83e71df743cbdababd6
Opcode Fuzzy Hash: 9253e05f18d14e20c9763c3e9f73f259a63028fab6c141538ab63a2f3c9f8a3e
Instruction Fuzzy Hash: CCF0A076301A26A7C794251D9811B7F77DF9FC6662F10402AF9418B280DFB9D91283E6

Function 0137D5F4 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3975174158.000000000137D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0137D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_137d000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d9f691bb31be19d38dd8fbb49d06bc21abbd271e9ac55f5391cc31c0fe430db
Instruction ID: 3456b9010007b0c5aac49941e903268ebbcd0f7211f57dadafad8169916c2cf2
Opcode Fuzzy Hash: 2d9f691bb31be19d38dd8fbb49d06bc21abbd271e9ac55f5391cc31c0fe430db
Instruction Fuzzy Hash: 5BF03775104680AFD725CF06CD84C23BBB9EF896647198489E89A8B762C735FC42CFA0

Function 08030728 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 549fcb40dae0417209e7ae7f923b42073a2f16c20e26afdd70761aedd58283d5
Instruction ID: 7587d48ce97030914b9bd96480669032c853907a14461c9061b7c583719ea50d
Opcode Fuzzy Hash: 549fcb40dae0417209e7ae7f923b42073a2f16c20e26afdd70761aedd58283d5
Instruction Fuzzy Hash: 9AF05E353003109FC704DB19D854D2A77AAFFC9761B1581A9FA46CB360CA71EC42CB90

Function 0803AA18 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f8600a729cfb1bd3329dd2ee3472636c9286d17e9f13f39ee139763ef8059e2
Instruction ID: 66ceaceb0f367ea76862b225a554b936055a3a0635266ae9d131a2eb0d5dfb10
Opcode Fuzzy Hash: 2f8600a729cfb1bd3329dd2ee3472636c9286d17e9f13f39ee139763ef8059e2
Instruction Fuzzy Hash: 5EE0CDA13493949FD306A3BD5C1056A3FEFDF8A25071440BBD455C7751C9785C0287B9

Function 0803A964 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52246f56e331d506cf04c8c1d7fbcac86e3b3c375997e22c948c6c910e7153ff
Instruction ID: ffcab3dd58a55119a2da7d80436357bf932755abb7007bd7c60b5543442d92b6
Opcode Fuzzy Hash: 52246f56e331d506cf04c8c1d7fbcac86e3b3c375997e22c948c6c910e7153ff
Instruction Fuzzy Hash: 39F03970A0122ADFCB65DF44C999AFDBBFAFF48311F02404AE041A7261CB385C46DB00

Function 0803BF81 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b169f9254e9f8f31841cfca922cda9e9eb8b9f932ac1933d5b45eccf6f2091e9
Instruction ID: 866f75278050f0fd9a7a10eb4566cc4bfb10040645e7d035e3fdfbd75902d236
Opcode Fuzzy Hash: b169f9254e9f8f31841cfca922cda9e9eb8b9f932ac1933d5b45eccf6f2091e9
Instruction Fuzzy Hash: 90D0A7312143315BD730551AE401766B7DDDB02676F20502DF849CA240DF5394209B97

Function 08039F68 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9aff05f32634f820a46ec79cbcc2425ac5c84b6c038103314c7e35bdce39d99
Instruction ID: b4dd44e4a21c3f7b558c8d2361769215da3b86414faa20466a2e46a07c3f61fd
Opcode Fuzzy Hash: c9aff05f32634f820a46ec79cbcc2425ac5c84b6c038103314c7e35bdce39d99
Instruction Fuzzy Hash: 55D0A930000329EFE7B05A90E80A7627FECEB0532BF2112ACEC080020197B384A2EA42

Function 0803AA28 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91eeb5d958b4fa37d337bce7d7132992e4aaccdb77c88c4635e0cebe6846112f
Instruction ID: 61e42a6afd624ae3e9930826b16385b238a05b6207fa1b6e6f72e30fa23bfbfd
Opcode Fuzzy Hash: 91eeb5d958b4fa37d337bce7d7132992e4aaccdb77c88c4635e0cebe6846112f
Instruction Fuzzy Hash: 5AD0C9B53002685BC649A6BAA81456F76DFABC9650B15802BD51AC3B44CE789C0246A9

Function 080306F0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a21fa0da155ade6526e0f1dc36dd2f48753b63174329cb853a06b35a923f464e
Instruction ID: 08d782c1bb9dd15f18392791c228caef23790502a164c3782e1ffdd815a567c2
Opcode Fuzzy Hash: a21fa0da155ade6526e0f1dc36dd2f48753b63174329cb853a06b35a923f464e
Instruction Fuzzy Hash: 43D0C9B5144206EFC7008B14E546B85B7A8EF14365F114050F9154A232D7359971EA41

Function 0803B110 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c35359c2da8ef5cd6acda28f5a63f1684f724ec0b6d8d58d127bd8479dddf629
Instruction ID: 69cc2a6d22c17af08a4f209d94b5fe485e733356899909aca8cecaed76176dd1
Opcode Fuzzy Hash: c35359c2da8ef5cd6acda28f5a63f1684f724ec0b6d8d58d127bd8479dddf629
Instruction Fuzzy Hash: 32D01234100205DFD340DB10C945F02F7A5FF88704F28C89CA84547242C7339833EB04

Function 080338B0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f8b504f680e1d621255ccb8a189f94d00aee267cad831ec42446ca50fe7399b
Instruction ID: 64bb4fea72ac6aad7ad681a183ae61caa1134695cb3c7882b66fe96ae91d92b8
Opcode Fuzzy Hash: 4f8b504f680e1d621255ccb8a189f94d00aee267cad831ec42446ca50fe7399b
Instruction Fuzzy Hash: B4D08C7100430AEBC3216F48DA01B4ABBBEEF08B04F108029FD4802402D737A832EB85

Function 08030E50 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a387eaa6fc82bc56fce5cdcbfda6455df2b48fa23c3f6be5d74e3254607d0609
Instruction ID: 6b192cdf5a1e5796b687024752bde1fd2ef8bcf48ffda47bc75bbb80fa1a67d0
Opcode Fuzzy Hash: a387eaa6fc82bc56fce5cdcbfda6455df2b48fa23c3f6be5d74e3254607d0609
Instruction Fuzzy Hash: FBD0C971501306DFEB044B10D10275677A2EFA1702F118924FA0145154D3394831EB01

Function 08030700 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Function 080338C0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4012511399.0000000008030000.00000040.00000800.00020000.00000000.sdmp, Offset: 08030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_8030000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38c26fe24b6533abd9040f46d6fec90de48124fdc5c2251906c534fac27b7938
Instruction ID: 738b200ed90ea01297b059036f44b0eca420b9db23ba159835437abf3fd6c120
Opcode Fuzzy Hash: 38c26fe24b6533abd9040f46d6fec90de48124fdc5c2251906c534fac27b7938
Instruction Fuzzy Hash: 6CB09232004208ABC604AA84E904859BB6DAB58700B008066B649061118B33A822DB94

Analysis Process: Exccelworkbook.exePID: 3844, Parent PID: 1256COMMON

Execution Graph

Execution Coverage:	7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	97
Total number of Limit Nodes:	11

Executed Functions

Function 0136C000 Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.1700531674.0000000001360000.00000040.00000800.00020000.00000000.sdmp, Offset: 01360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1360000_Exccelworkbook.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 5851616ff090fff586a4778b064aa12f8d854606f4746d44f8ef8765d6f3e7b7
Instruction ID: ca4b26208d9b10a1f0f517afe11466f6e4470d07ccb68c7f319768c7aafc4fd1
Opcode Fuzzy Hash: 5851616ff090fff586a4778b064aa12f8d854606f4746d44f8ef8765d6f3e7b7
Instruction Fuzzy Hash: 61715A70A00B058FD724DF69C44079ABBF5FF48608F008A2DD58AD7B44DB75E845CB91

Function 01366414 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 01367421

Memory Dump Source

Source File: 0000000E.00000002.1700531674.0000000001360000.00000040.00000800.00020000.00000000.sdmp, Offset: 01360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1360000_Exccelworkbook.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: f8c993eb2fab2d9468234292159da41854ffcc06ceb75bdad3936d99ffea3340
Instruction ID: 61be23c9410b19b3d590ea18f3c02476595e7678b6fcf7f898ca0107bc632fe3
Opcode Fuzzy Hash: f8c993eb2fab2d9468234292159da41854ffcc06ceb75bdad3936d99ffea3340
Instruction Fuzzy Hash: D241B170C0071DCBEB25CFA9C888BDDBBB5BF48308F60805AD418AB255D7B96946CF90

Function 01367364 Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 01367421

Memory Dump Source

Source File: 0000000E.00000002.1700531674.0000000001360000.00000040.00000800.00020000.00000000.sdmp, Offset: 01360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1360000_Exccelworkbook.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: fa687f1719dc5539f7b64e76d7d79d771fb0755fdb03ec69625384c4c06848d5
Instruction ID: 8de91b4864e4f5c0bf42eb4bda7494c7301d076e3b169448aac913e5bd8ab9bd
Opcode Fuzzy Hash: fa687f1719dc5539f7b64e76d7d79d771fb0755fdb03ec69625384c4c06848d5
Instruction Fuzzy Hash: 1D41D2B1C00719CFEB25CFA9C884BCDBBB5BF48308F64815AD418AB255D779694ACF90

Function 0136611C Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0136674E,?,?,?,?,?), ref: 0136680F

Memory Dump Source

Source File: 0000000E.00000002.1700531674.0000000001360000.00000040.00000800.00020000.00000000.sdmp, Offset: 01360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1360000_Exccelworkbook.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0a8af779bb32f0e0e21ea8624d086adddf0483d4ac77bf85e3bcbee0594808e6
Instruction ID: a99d4146f9db7d50f75ada267230201369f2c564032eaac15703fb91140c3bb5
Opcode Fuzzy Hash: 0a8af779bb32f0e0e21ea8624d086adddf0483d4ac77bf85e3bcbee0594808e6
Instruction Fuzzy Hash: FD21D4B59002499FDB10CFAAD485ADEBFF8EB48310F14841AE915A3310D378A944CFA5

Function 01366780 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0136674E,?,?,?,?,?), ref: 0136680F

Memory Dump Source

Source File: 0000000E.00000002.1700531674.0000000001360000.00000040.00000800.00020000.00000000.sdmp, Offset: 01360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1360000_Exccelworkbook.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: abf88f74a41e990ff291d2b91b57fed31754634842dc3ab7fb4cde4b3017a328
Instruction ID: c7662ece3de357306f00d9326ef5a17610561863fbec70671fb478672718e87a
Opcode Fuzzy Hash: abf88f74a41e990ff291d2b91b57fed31754634842dc3ab7fb4cde4b3017a328
Instruction Fuzzy Hash: C021E3B5D002499FDB10CFAAD885ADEBFF8FB48314F14841AE918A3311D378A944CFA5

Function 0136AF60 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,0136C01C), ref: 0136C256

Memory Dump Source

Source File: 0000000E.00000002.1700531674.0000000001360000.00000040.00000800.00020000.00000000.sdmp, Offset: 01360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_1360000_Exccelworkbook.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: bb3a60153056d86cfd0a190f734f4d5db82540a9f5930e038d45f0ba62d78513
Instruction ID: de00d9b5f19c51cff672717ab38fad20303f34689feea25a58157b90d7f46bed
Opcode Fuzzy Hash: bb3a60153056d86cfd0a190f734f4d5db82540a9f5930e038d45f0ba62d78513
Instruction Fuzzy Hash: B6110FB5C006498FDB20DF9AC444BDEFBF8EB88614F10842AD969B7301D379A546CFA5

Function 012DD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1699929368.00000000012DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_12dd000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 700708274121bc6b48bbffc78736b279d1d37089b75c4aecd2af5ce05b627ce4
Instruction ID: 0587866b3d12cc656d1990304a4b491bd4023b4b9ff7327900d05ffc346786cf
Opcode Fuzzy Hash: 700708274121bc6b48bbffc78736b279d1d37089b75c4aecd2af5ce05b627ce4
Instruction Fuzzy Hash: B4214271614708DFDB15DF64D8C0B16BB61EBC8315F20C56DD90A0B282C37AD807CA62

Function 012DD006 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1699929368.00000000012DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_12dd000_Exccelworkbook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92375054b48839098de7e31f2bf0b092bee76e4c68da36b6a416589c54b83fbe
Instruction ID: 9dd42c8a01553f4edc03492c7fb7765f53426e0e02f20d9e2a2d0712dbebf99f
Opcode Fuzzy Hash: 92375054b48839098de7e31f2bf0b092bee76e4c68da36b6a416589c54b83fbe
Instruction Fuzzy Hash: 6521F3755083848FCB03CF24C990705BF71EB86314F28C5EAD9498B2A7C33AD80ACB62

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report QUOTATION-9044456778.pdf (83kb).com.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Quasar

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Exccelworkbook.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\QUOTATION-9044456778.pdf (83kb).com.exe.log

C:\Users\user\AppData\Roaming\SubDir\Exccelworkbook.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Windows Analysis Report
QUOTATION-9044456778.pdf (83kb).com.exe

Function 052B5DE0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 243
processCOMMON

Function 052B5DDF Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241
processCOMMON

Function 03066404 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96
COMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre