Edit tour

Windows Analysis Report
hiYc6Vnppc.exe

Overview

General Information

Sample Name:	hiYc6Vnppc.exe
Analysis ID:	582342
MD5:	0c84297632dffe68994d744487849fd5
SHA1:	e91fc4c3a570950f7cebb691b75ba57990f0ee74
SHA256:	6ccf16f1d1a495de9f5e7c1b60dd09da612ba2355887ebeb56cc1cacb5d64a5e
Tags:	exe
Infos:

Detection

Allcome clipbanker

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Allcome clipbanker

PE file has nameless sections

Machine Learning detection for sample

Contains functionality to detect sleep reduction / modifications

Uses 32bit PE files

Sample file is different than original file name gathered from version info

One or more processes crash

PE file contains an invalid checksum

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Uses code obfuscation techniques (call, push, ret)

Checks if the current process is being debugged

PE file contains sections with non-standard names

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Contains functionality to call native functions

Contains functionality to communicate with device drivers

May check if the current machine is a sandbox (GetTickCount - Sleep)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

hiYc6Vnppc.exe (PID: 2328 cmdline: "C:\Users\user\Desktop\hiYc6Vnppc.exe" MD5: 0C84297632DFFE68994D744487849FD5)

WerFault.exe (PID: 5504 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 412 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

cleanup

Malware Configuration

Threatname: Allcome clipbanker

{"C2 url": "http://dba692117be7b6d3480fe5220fdd58b38bf.xyz/API/Clipper/configure.php?cf6zrlhn=QWERTY", "Wallet": ["DPUnu15wbXcvTwEuQssdD48Q9iZUModBEG", "rh2nM92mFC5XfDXu9AcAUvzivX4ZQerLx4", "0xAC63c256f3F5F03d63F4F206F8E030232461e8d5", "Xaume5k7mVQqgDfJyTtysF721e6gvTkY7M", "TMSpq8DHdUeJ8KzVj8bnNuQKB6fEWYhR5i", "t1P9vxqf7nYQ4tHpo7TUfsXMpiQq14RMpC5", "GAGATITC6CREAQAVLZNORIHVBB4P6SXHTXPF7FYBR3VOSSUDVBT5TIV3", "qpm92rqxzejjn0ur9tl53gk87u7nlzw2zs6qz8djkn", "bc1q6sjafgxlmrxwdhh0v5zu58f48pvaqc04hvedl0", "0xAC63c256f3F5F03d63F4F206F8E030232461e8d5", "ltc1qn66m2mfk4txmgvz9lhm6q8ffetklqf2rak4qqc"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.328776321.0000000000430000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Allcomeclipbanker	Yara detected Allcome clipbanker	Joe Security
00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Allcomeclipbanker	Yara detected Allcome clipbanker	Joe Security
00000000.00000000.332292030.0000000000430000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Allcomeclipbanker	Yara detected Allcome clipbanker	Joe Security
Process Memory Space: hiYc6Vnppc.exe PID: 2328	JoeSecurity_Allcomeclipbanker	Yara detected Allcome clipbanker	Joe Security

Unpacked PEs

Source	Rule	Description	Author
0.0.hiYc6Vnppc.exe.43056c.2.raw.unpack	JoeSecurity_Allcomeclipbanker	Yara detected Allcome clipbanker	Joe Security
0.0.hiYc6Vnppc.exe.43056c.2.unpack	JoeSecurity_Allcomeclipbanker	Yara detected Allcome clipbanker	Joe Security
0.0.hiYc6Vnppc.exe.43056c.4.raw.unpack	JoeSecurity_Allcomeclipbanker	Yara detected Allcome clipbanker	Joe Security
0.2.hiYc6Vnppc.exe.43056c.1.unpack	JoeSecurity_Allcomeclipbanker	Yara detected Allcome clipbanker	Joe Security
0.2.hiYc6Vnppc.exe.43056c.1.raw.unpack	JoeSecurity_Allcomeclipbanker	Yara detected Allcome clipbanker	Joe Security
0.0.hiYc6Vnppc.exe.43056c.4.unpack	JoeSecurity_Allcomeclipbanker	Yara detected Allcome clipbanker	Joe Security
Click to see the 1 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: hiYc6Vnppc.exe

Avira: detected

Found malware configuration

Source: 0.2.hiYc6Vnppc.exe.43056c.1.raw.unpack

Malware Configuration Extractor: Allcome clipbanker {"C2 url": "http://dba692117be7b6d3480fe5220fdd58b38bf.xyz/API/Clipper/configure.php?cf6zrlhn=QWERTY", "Wallet": ["DPUnu15wbXcvTwEuQssdD48Q9iZUModBEG", "rh2nM92mFC5XfDXu9AcAUvzivX4ZQerLx4", "0xAC63c256f3F5F03d63F4F206F8E030232461e8d5", "Xaume5k7mVQqgDfJyTtysF721e6gvTkY7M", "TMSpq8DHdUeJ8KzVj8bnNuQKB6fEWYhR5i", "t1P9vxqf7nYQ4tHpo7TUfsXMpiQq14RMpC5", "GAGATITC6CREAQAVLZNORIHVBB4P6SXHTXPF7FYBR3VOSSUDVBT5TIV3", "qpm92rqxzejjn0ur9tl53gk87u7nlzw2zs6qz8djkn", "bc1q6sjafgxlmrxwdhh0v5zu58f48pvaqc04hvedl0", "0xAC63c256f3F5F03d63F4F206F8E030232461e8d5", "ltc1qn66m2mfk4txmgvz9lhm6q8ffetklqf2rak4qqc"]}

Multi AV Scanner detection for submitted file

Source: hiYc6Vnppc.exe	Virustotal: Detection: 65%	Perma Link
Source: hiYc6Vnppc.exe	Metadefender: Detection: 23%	Perma Link
Source: hiYc6Vnppc.exe	ReversingLabs: Detection: 79%

Machine Learning detection for sample

Source: hiYc6Vnppc.exe

Joe Sandbox ML: detected

Source: hiYc6Vnppc.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Source:

Binary string: C:\Users\youar\Desktop\Allcome\Source code\Build\Release\Build.pdb source: hiYc6Vnppc.exe, 00000000.00000000.328776321.0000000000430000.00000040.00000001.01000000.00000003.sdmp

Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_0040AF20 FindFirstFileExW,	0_2_0040AF20
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_0040AFFB FindFirstFileExW,_free,	0_2_0040AFFB
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_021975C8 FindFirstFileA,	0_2_021975C8
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_021976A4 FindFirstFileA,GetLastError,	0_2_021976A4

Source: hiYc6Vnppc.exe, 00000000.00000000.328776321.0000000000430000.00000040.00000001.01000000.00000003.sdmp

String found in binary or memory: https://steamcommunity.com/tradeoffer

System Summary

PE file has nameless sections

Source: hiYc6Vnppc.exe	Static PE information: section name:
Source: hiYc6Vnppc.exe	Static PE information: section name:
Source: hiYc6Vnppc.exe	Static PE information: section name:
Source: hiYc6Vnppc.exe	Static PE information: section name:

Source: hiYc6Vnppc.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Source: hiYc6Vnppc.exe	Binary or memory string: OriginalFilename vs hiYc6Vnppc.exe
Source: hiYc6Vnppc.exe, 00000000.00000000.333294097.0000000002191000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs hiYc6Vnppc.exe
Source: hiYc6Vnppc.exe, 00000000.00000000.333294097.0000000002191000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSV vs hiYc6Vnppc.exe

Source: C:\Users\user\Desktop\hiYc6Vnppc.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 412

Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_0040E890	0_2_0040E890
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_00411D7C	0_2_00411D7C
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_0040ED28	0_2_0040ED28
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_00406644	0_2_00406644
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_00413682	0_2_00413682
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_00411E9C	0_2_00411E9C
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_021B62D8	0_2_021B62D8
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_021AC980	0_2_021AC980
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_021AB1D8	0_2_021AB1D8

Source: C:\Users\user\Desktop\hiYc6Vnppc.exe

Code function: String function: 00403290 appears 34 times

Source: C:\Users\user\Desktop\hiYc6Vnppc.exe

Code function: 0_2_021BDB00 SetFocus,SendMessageA,DestroyWindow,DestroyWindow,DestroyWindow,DestroyWindow,NtdllDefWindowProc_A,

0_2_021BDB00

Source: C:\Users\user\Desktop\hiYc6Vnppc.exe

Code function: 0_2_021B02C0: CreateFileA,DeviceIoControl,CloseHandle,

0_2_021B02C0

Source: hiYc6Vnppc.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

Source: hiYc6Vnppc.exe	Static PE information: Section: ZLIB complexity 1.00047692587
Source: hiYc6Vnppc.exe	Static PE information: Section: ZLIB complexity 1.00079571759
Source: hiYc6Vnppc.exe	Static PE information: Section: ZLIB complexity 1.004296875
Source: hiYc6Vnppc.exe	Static PE information: Section: .rsrc ZLIB complexity 0.998780708092

Source: hiYc6Vnppc.exe	Virustotal: Detection: 65%
Source: hiYc6Vnppc.exe	Metadefender: Detection: 23%
Source: hiYc6Vnppc.exe	ReversingLabs: Detection: 79%

Source: C:\Users\user\Desktop\hiYc6Vnppc.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\hiYc6Vnppc.exe

Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\hiYc6Vnppc.exe "C:\Users\user\Desktop\hiYc6Vnppc.exe"
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 412

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2328

Source: C:\Users\user\Desktop\hiYc6Vnppc.exe

Code function: 0_2_00401B30 CreateThread,Sleep,GetSystemInfo,FindResourceA,LoadResource,SizeofResource,ExitProcess,ExitProcess,LockResource,VirtualProtect,LdrInitializeThunk,

0_2_00401B30

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERBBF4.tmp

Jump to behavior

Source: classification engine

Classification label: mal84.troj.evad.winEXE@2/4@0/0

Source: C:\Users\user\Desktop\hiYc6Vnppc.exe

Code function: 0_2_02197878 GetDiskFreeSpaceA,

0_2_02197878

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: hiYc6Vnppc.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: C:\Users\youar\Desktop\Allcome\Source code\Build\Release\Build.pdb source: hiYc6Vnppc.exe, 00000000.00000000.328776321.0000000000430000.00000040.00000001.01000000.00000003.sdmp

Source: hiYc6Vnppc.exe

Static PE information: real checksum: 0x53bcc should be: 0x805ec

Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_0045145C push 021EE000h; ret	0_2_00451627
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_0041D846 push ds; ret	0_2_0041D847
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_0041D804 push ds; ret	0_2_0041D81B
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_0041C80E push ds; ret	0_2_0041C80F
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_0045100A push ebp; ret	0_2_0045100D
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_0041D81C push ds; ret	0_2_0041D823
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_0041D824 push ds; ret	0_2_0041D82B
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_0041D82C push ds; ret	0_2_0041D833
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_0041D834 push ds; ret	0_2_0041D83B
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_0041D83C push ds; ret	0_2_0041D843
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_0041627C push esp; ret	0_2_0041627D
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_0041DBC4 push ds; ret	0_2_0041DBDF
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_0041DBE0 push ds; ret	0_2_0041DBE7
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_0041DBEA push ds; ret	0_2_0041DBEB
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_00419CFD push esi; ret	0_2_00419D06
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_0041BE9F push es; ret	0_2_0041BEA6
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_0041D754 push ds; ret	0_2_0041D767
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_0041D760 push ds; ret	0_2_0041D767
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_0041D768 push ds; ret	0_2_0041D7CB
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_0041D73C push ds; ret	0_2_0041D753
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_0041D7CC push 0000006Ah; ret	0_2_0041D7CF
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_0041D7D0 push ds; ret	0_2_0041D7E3
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_0041D7E4 push ds; ret	0_2_0041D7EB
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_0041D7EC push ds; ret	0_2_0041D7F3
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_0041D7F4 push ds; ret	0_2_0041D7FB
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_0041D7FC push ds; ret	0_2_0041D803
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_021B6A18 push ecx; mov dword ptr [esp], edx	0_2_021B6A1C
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_021ADA20 push 021ADA4Ch; ret	0_2_021ADA44
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_0219D294 push 0219D2C0h; ret	0_2_0219D2B8
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_021A72BC push 021A72E8h; ret	0_2_021A72E0
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_021A9AA4 push 021A9AD0h; ret	0_2_021A9AC8

Source: hiYc6Vnppc.exe	Static PE information: section name:
Source: hiYc6Vnppc.exe	Static PE information: section name:
Source: hiYc6Vnppc.exe	Static PE information: section name:
Source: hiYc6Vnppc.exe	Static PE information: section name:
Source: hiYc6Vnppc.exe	Static PE information: section name: .adata

Source: initial sample	Static PE information: section name: entropy: 7.99567995228
Source: initial sample	Static PE information: section name: entropy: 7.98696648963
Source: initial sample	Static PE information: section name: entropy: 7.92802135641
Source: initial sample	Static PE information: section name: .rsrc entropy: 7.99660500201
Source: initial sample	Static PE information: section name: .data entropy: 7.86896555158

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\Desktop\hiYc6Vnppc.exe

Code function: 0_2_00401AE0

0_2_00401AE0

Source: C:\Users\user\Desktop\hiYc6Vnppc.exe

Code function: 0_2_00401AE0

0_2_00401AE0

Source: C:\Users\user\Desktop\hiYc6Vnppc.exe

Code function: 0_2_021C0A10 rdtsc

0_2_021C0A10

Source: C:\Users\user\Desktop\hiYc6Vnppc.exe

Code function: 0_2_00401B30 CreateThread,Sleep,GetSystemInfo,FindResourceA,LoadResource,SizeofResource,ExitProcess,ExitProcess,LockResource,VirtualProtect,LdrInitializeThunk,

0_2_00401B30

Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_0040AF20 FindFirstFileExW,	0_2_0040AF20
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_0040AFFB FindFirstFileExW,_free,	0_2_0040AFFB
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_021975C8 FindFirstFileA,	0_2_021975C8
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_021976A4 FindFirstFileA,GetLastError,	0_2_021976A4

Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	API call chain: ExitProcess graph end node			graph_0-21115
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	API call chain: ExitProcess graph end node			graph_0-21465

Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_00407A6D mov eax, dword ptr fs:[00000030h]		0_2_00407A6D
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_0040C39C mov eax, dword ptr fs:[00000030h]		0_2_0040C39C

Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\hiYc6Vnppc.exe

Code function: 0_2_0040CE43 GetProcessHeap,

0_2_0040CE43

Source: C:\Users\user\Desktop\hiYc6Vnppc.exe

Code function: 0_2_021C0A10 rdtsc

0_2_021C0A10

Source: C:\Users\user\Desktop\hiYc6Vnppc.exe

Code function: 0_2_00401B30 CreateThread,Sleep,GetSystemInfo,FindResourceA,LoadResource,SizeofResource,ExitProcess,ExitProcess,LockResource,VirtualProtect,LdrInitializeThunk,

0_2_00401B30

Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_004031C0 SetUnhandledExceptionFilter,	0_2_004031C0
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_0040305E SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0040305E
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_004058B3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004058B3
Source: C:\Users\user\Desktop\hiYc6Vnppc.exe	Code function: 0_2_004034F4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004034F4

Source: C:\Users\user\Desktop\hiYc6Vnppc.exe

Code function: RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpy,GetLocaleInfoA,lstrlen,lstrcpy,LoadLibraryExA,lstrcpy,LoadLibraryExA,lstrcpy,LoadLibraryExA,

0_2_02194CB8

Source: C:\Users\user\Desktop\hiYc6Vnppc.exe

Code function: 0_2_00403314 cpuid

0_2_00403314

Source: C:\Users\user\Desktop\hiYc6Vnppc.exe

Code function: 0_2_021C030C GetVersionExA,GetVersionExA,

0_2_021C030C

Source: C:\Users\user\Desktop\hiYc6Vnppc.exe

Code function: 0_2_0219D318 GetLocalTime,

0_2_0219D318

Stealing of Sensitive Information

Yara detected Allcome clipbanker

Source: Yara match	File source: 0.0.hiYc6Vnppc.exe.43056c.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.hiYc6Vnppc.exe.43056c.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.hiYc6Vnppc.exe.43056c.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hiYc6Vnppc.exe.43056c.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hiYc6Vnppc.exe.43056c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.hiYc6Vnppc.exe.43056c.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.328776321.0000000000430000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.332292030.0000000000430000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hiYc6Vnppc.exe PID: 2328, type: MEMORYSTR

Remote Access Functionality

Yara detected Allcome clipbanker

Source: Yara match	File source: 0.0.hiYc6Vnppc.exe.43056c.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.hiYc6Vnppc.exe.43056c.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.hiYc6Vnppc.exe.43056c.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hiYc6Vnppc.exe.43056c.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hiYc6Vnppc.exe.43056c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.hiYc6Vnppc.exe.43056c.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.328776321.0000000000430000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.332292030.0000000000430000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hiYc6Vnppc.exe PID: 2328, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	2 Software Packing	LSASS Memory	14 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Deobfuscate/Decode Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	25 System Information Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
hiYc6Vnppc.exe	66%	Virustotal		Browse
hiYc6Vnppc.exe	24%	Metadefender		Browse
hiYc6Vnppc.exe	79%	ReversingLabs	Win32.Trojan.AgentTesla
hiYc6Vnppc.exe	100%	Avira	TR/Crypt.Agent.lshmn
hiYc6Vnppc.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
0.2.hiYc6Vnppc.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1230732	Download File
0.2.hiYc6Vnppc.exe.43056c.1.unpack	100%	Avira	HEUR/AGEN.1215503	Download File
0.0.hiYc6Vnppc.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1215824	Download File
0.0.hiYc6Vnppc.exe.400000.1.unpack	100%	Avira	HEUR/AGEN.1215824	Download File
0.0.hiYc6Vnppc.exe.400000.3.unpack	100%	Avira	HEUR/AGEN.1215824	Download File

Name	Source	Malicious	Antivirus Detection	Reputation
https://steamcommunity.com/tradeoffer	hiYc6Vnppc.exe, 00000000.00000000.328776321.0000000000430000.00000040.00000001.01000000.00000003.sdmp	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	582342
Start date:	03.03.2022
Start time:	12:30:57
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	hiYc6Vnppc.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.troj.evad.winEXE@2/4@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 78% Number of executed functions: 24 Number of non-executed functions: 65
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WerFault.exe, WMIADAP.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 104.208.16.94
Excluded domains from analysis (whitelisted): blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, watson.telemetry.microsoft.com, onedsblobprdcus16.centralus.cloudapp.azure.com
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
12:32:07	API Interceptor	1x Sleep call for process: hiYc6Vnppc.exe modified
12:32:27	API Interceptor	1x Sleep call for process: WerFault.exe modified

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_hiYc6Vnppc.exe_b0d78236e65c5dc4ede9cda029eafd3eac4aca1b_983f6238_15bdd112\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7760010118857009
Encrypted:	false
SSDEEP:	96:rDOVgFw5fCPn2Y0Lh457df0pXIQcQvc6QcEDMcw3Dj+HbHg/8BRTf3+kEJ8ImOyZ:ygUfin2YcHBUZMXAjcK/u7s0S274ItU
MD5:	55B1BA3A1951AC21064E16CEA531C3BA
SHA1:	C5675C7FA6613D25DDFA61B520DEED700FE558B1
SHA-256:	865E8AE2EFF8EA9370444CF2502612D21CD1DE3F7820FC2D78C0E423DC95ED58
SHA-512:	0CF1ADBBF9378850364800A216118414EF353CAC664EB832D7AD3BDA7A005EB12AF01430D4EB71937B39F4DBD59B2E323E0EAA8864D0802FD3512640E94D1347
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.9.0.8.1.3.1.4.2.4.4.8.6.5.0.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.9.0.8.1.3.1.4.4.3.5.4.8.5.0.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.c.3.b.0.6.2.a.-.7.0.7.f.-.4.b.8.0.-.9.d.e.0.-.a.3.d.6.0.5.f.2.1.d.6.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.4.d.5.4.d.3.7.-.2.3.2.4.-.4.f.f.e.-.b.1.2.7.-.8.d.c.5.d.4.5.a.6.c.2.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.h.i.Y.c.6.V.n.p.p.c...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.9.1.8.-.0.0.0.1.-.0.0.1.c.-.e.5.0.0.-.f.4.b.b.3.d.2.f.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.b.3.a.2.3.f.4.4.4.0.d.9.6.f.c.b.b.5.5.b.1.1.2.d.7.b.a.9.5.e.c.0.0.0.0.f.f.f.f.!.0.0.0.0.e.9.1.f.c.4.c.3.a.5.7.0.9.5.0.f.7.c.e.b.b.6.9.1.b.7.5.b.a.5.7.9.9.0.f.0.e.e.7.4.!.h.i.Y.c.6.V.n.p.p.c...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBBF4.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Mar 3 20:32:22 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	35934
Entropy (8bit):	2.215766478248911
Encrypted:	false
SSDEEP:	192:jC6WuIqHPK+Ont31TEVhxJI5ioY3zfmg8lI026Vz5Xo:WsHPontOPI5ioY3zfi268
MD5:	F5F39E7A4458705EF353DEB1C3B09D28
SHA1:	31D40F28955A8B9A2C8C6B31F88B376CFC985118
SHA-256:	1310D916175463DBACBE1936CA3EBE5B7D2CD2B7A679DD86DE815216493D66DE
SHA-512:	10E02009E131679FCEF78CAB966ADCB9E3EE1CA2D0A703E320F99BC54D9257102E3D30A184E80869B5101E15FD5F014E760034BAEB6AAB1B874BD680A8BC5F05
Malicious:	false
Reputation:	low
Preview:	MDMP....... ........%!b....................................4...B#..........T.......8...........T...............F{...........................................................................................U...........B..............GenuineIntelW...........T............%!b.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBE85.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8308
Entropy (8bit):	3.698099255745368
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNikV63Nd6YF9SUWh98ygmf3SXCprk89bKJsfzOm:RrlsNi+63Nd6Y/SUu95gmf3SuKifz
MD5:	A5CBE426612154DC627AE7D4F0017BA8
SHA1:	FB4EDBA3147A0BEF9CAB96AFACF53A3A4EF0BC85
SHA-256:	A03FF1E7825FA9B08D9A6F8D317437C82140126B35BAB67381CFE564CCDBCA33
SHA-512:	5CBE3E2A4AB2689FABF1139320C305702E72D471C6F77B6E76C8B7C0AC7495E859886360C5983B6305A4300D5B014EF65495B77F1A350BAD99A9927202071936
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.3.2.8.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBF80.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4567
Entropy (8bit):	4.460796257662251
Encrypted:	false
SSDEEP:	48:cvIwSD8zsdJgtWI9hdWSC8Bf8fm8M4JUjUjjFt+q8/eL6EKUTUed:uITf3qsSNGJUjMDkeG9UTUed
MD5:	84EC38FA42AA82A272A948D87B5660C9
SHA1:	179B1E14AE382682B1D19E2221D05A6AD7D59BA9
SHA-256:	BCC3246440F255AE153315BBA2F3A959467086DB83E010553F3B728B7AF8EE08
SHA-512:	073C9E13486A1E51CBE1B2770E72B2E07D70ABD0FD96FB4DA95FC29D4C433E5CF33854180ED827707B7259E16FC9DD7559E96E4EB046076C0118F541A1C292EF
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1411543" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.915215782683756
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	hiYc6Vnppc.exe
File size:	524288
MD5:	0c84297632dffe68994d744487849fd5
SHA1:	e91fc4c3a570950f7cebb691b75ba57990f0ee74
SHA256:	6ccf16f1d1a495de9f5e7c1b60dd09da612ba2355887ebeb56cc1cacb5d64a5e
SHA512:	4add0048a025a90bd8ffdc9fa0b1762062e0ea61bceefb365e7d0f9a9539174cf7fc432cef303c01d5c4777a9c4e60ff31381845848bea2ed535c19fbf74813f
SSDEEP:	12288:dHDdD5BW/rGC9AqcrNNgqGK/lGRgOUqmq9kR6lhKXXCw0NWbWEyq7:dzU/rTAeqGK/cRgOnmq9g6qC/nq7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d.-...~...~...~.n.....~.n.. ..~.n.....~.r.....~.r.....~.n.....~...~...~.r.....~Yr.....~YrX~...~Yr.....~Rich...~...............

File Icon


Icon Hash:	a259dbcda5e8da25

Static PE Info

General

Entrypoint:	0x401000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED
DLL Characteristics:	TERMINAL_SERVER_AWARE, NX_COMPAT
Time Stamp:	0x6207A556 [Sat Feb 12 12:17:26 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	cd8b760cb83f38644768621cc3945d49

Entrypoint Preview

Instruction
push 00451001h
call 00007FBC44BE09B6h
ret
ret
sub byte ptr [EF21h], bl
scasb
minps xmm7, dqword ptr [edi-6Fh]
pop ebx
mov dl, 11h
mov eax, dword ptr [CCB3DF7Ah]
xlatb
out 1Ah, al
pop ds
mov ebp, ecx
push esi
in eax, dx
fsub st(6), st(0)
dec esi
test dword ptr [eax-5C54306Eh], C2E72840h
push esi
mov esi, 9E13ED28h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x51c4c	0xd8	.data
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1e000	0x306fd	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1abdc	0x1c
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x100000

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x14000	0xac00	False	1.00047692587	data	7.99567995228	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
	0x15000	0x7000	0x3600	False	1.00079571759	data	7.98696648963	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
	0x1c000	0x2000	0xa00	False	1.004296875	data	7.92802135641	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x1e000	0x31000	0x15a00	False	0.998780708092	data	7.99660500201	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
	0x4f000	0x2000	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.data	0x51000	0x5c000	0x5b600	False	0.967798820109	data	7.86896555158	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.adata	0xad000	0x1000	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x51eb8	0x12428	data
RT_RCDATA	0x3056c	0x1e000	data	Russian	Russia
RT_GROUP_ICON	0x51ea4	0x14	data
RT_MANIFEST	0x51d24	0x17d	XML 1.0 document text	English	United States

Imports

DLL	Import
kernel32.dll	GetProcAddress, GetModuleHandleA, LoadLibraryA
user32.dll	GetCursorPos
oleaut32.dll	VariantChangeTypeEx
kernel32.dll	RaiseException

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia
English	United States

Target ID:	0
Start time:	12:32:00
Start date:	03/03/2022
Path:	C:\Users\user\Desktop\hiYc6Vnppc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\hiYc6Vnppc.exe"
Imagebase:	0x400000
File size:	524288 bytes
MD5 hash:	0C84297632DFFE68994D744487849FD5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_Allcomeclipbanker, Description: Yara detected Allcome clipbanker, Source: 00000000.00000000.328776321.0000000000430000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Allcomeclipbanker, Description: Yara detected Allcome clipbanker, Source: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Allcomeclipbanker, Description: Yara detected Allcome clipbanker, Source: 00000000.00000000.332292030.0000000000430000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Target ID:	3
Start time:	12:32:20
Start date:	03/03/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 412
Imagebase:	0x1310000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Execution Graph

Execution Coverage:	3.2%
Dynamic/Decrypted Code Coverage:	20.8%
Signature Coverage:	8.1%
Total number of Nodes:	408
Total number of Limit Nodes:	35

Executed Functions

Function 02194CB8 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 151
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F003F,?,00000000,?,00000105), ref: 02194CF2
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F003F,?,80000001,Software\Borland\Locales,00000000,000F003F,?,00000000,?,00000105), ref: 02194D10
RegQueryValueExA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000005,00000000,02194D84,?,80000001,Software\Borland\Locales,00000000,000F003F,?,00000000,?), ref: 02194D4A
RegQueryValueExA.ADVAPI32(?,02194EB0,00000000,00000000,00000000,00000005,?,00000000,00000000,00000000,00000000,00000005,00000000,02194D84,?,80000001), ref: 02194D68
RegCloseKey.ADVAPI32(?,02194D8B,00000000,00000000,00000005,00000000,02194D84,?,80000001,Software\Borland\Locales,00000000,000F003F,?,00000000,?,00000105), ref: 02194D7E
lstrcpy.KERNEL32(?,?), ref: 02194D96
lstrlen.KERNEL32(00000000), ref: 02194DD4
lstrcpy.KERNEL32(00000000,00000000), ref: 02194E0B
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000), ref: 02194E1B
lstrcpy.KERNEL32(00000000,00000000), ref: 02194E31
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 02194E41
lstrcpy.KERNEL32(00000000,00000000), ref: 02194E55
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 02194E65

Strings

Software\Borland\Locales, xrefs: 02194CE8
., xrefs: 02194DE6
Software\Borland\Delphi\Locales, xrefs: 02194D06

Memory Dump Source

Source File: 00000000.00000002.363499699.0000000002191000.00000040.00000800.00020000.00000000.sdmp, Offset: 02191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2191000_hiYc6Vnppc.jbxd

Similarity

API ID: lstrcpy$LibraryLoad$OpenQueryValue$Closelstrlen
String ID: .$Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 3871718695-3917250287
Opcode ID: b5bb4a803b0445ee92669e5281789f3e0ee9a2022c59cacf1ea15ad7ed52a6da
Instruction ID: 19aece7c94cba7b8889da7e7fdcd5489208409992e9017ff8925de1bd6a142bb
Opcode Fuzzy Hash: b5bb4a803b0445ee92669e5281789f3e0ee9a2022c59cacf1ea15ad7ed52a6da
Instruction Fuzzy Hash: 6A416E75E8021D7EFF22D6F49C46FEF77AD9B04744F4000A1AA08E6181D7789A85CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00401B30 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 126
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,Function_00001AE0,00000000,00000000,00000000), ref: 00401B46
Sleep.KERNELBASE(00000FA0), ref: 00401B51
GetSystemInfo.KERNELBASE(0041D198), ref: 00401B63
FindResourceA.KERNEL32(00000000,00000065,0000000A), ref: 00401B6F
LoadResource.KERNEL32(00000000,?), ref: 00401B85
SizeofResource.KERNEL32(00000000,?), ref: 00401B94
ExitProcess.KERNEL32 ref: 00401BBC
ExitProcess.KERNEL32 ref: 00401BC9

Strings

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, xrefs: 00401CE4
A, xrefs: 00401B78
gred %s, xrefs: 00401CB1

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: Resource$ExitProcess$CreateFindInfoLoadSizeofSleepSystemThread
String ID: A$C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe$gred %s
API String ID: 374464391-639581637
Opcode ID: 238b36dc926b0db8b205286b5ef8017c50b81e76edf80d0fcf8145aa5cce9492
Instruction ID: 3c426bcc0a89f84b366c5dccdccd7126fc17696bba57f502a9d2f047407ce515
Opcode Fuzzy Hash: 238b36dc926b0db8b205286b5ef8017c50b81e76edf80d0fcf8145aa5cce9492
Instruction Fuzzy Hash: 3C415DB4E44204EFE704DFD4DD8ABEDBBB1FB48705F10806AEA05662E0D7B85A408B59

Uniqueness

Uniqueness Score: -1.00%

Function 00401AE0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00401AE6
Sleep.KERNELBASE(00003A98), ref: 00401AF4
GetTickCount.KERNEL32 ref: 00401AFA
ExitProcess.KERNEL32 ref: 00401B26

Strings

Virtual machine has been detected!, xrefs: 00401B17
Error, xrefs: 00401B12

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: CountTick$ExitProcessSleep
String ID: Error$Virtual machine has been detected!
API String ID: 1298644884-318677080
Opcode ID: 94d7aa7a4fbc4389129c70ee98bb63dc58e8a5bccd12a9bf9e5f05f99f45ff4c
Instruction ID: e48999178f891ef6c3da06b13ebf7ffed402eeb26958ceb21e4f816962d81e4b
Opcode Fuzzy Hash: 94d7aa7a4fbc4389129c70ee98bb63dc58e8a5bccd12a9bf9e5f05f99f45ff4c
Instruction Fuzzy Hash: FCE06534A90604FFE711BFE4DD49BDC7F74EB45702F508162E805E11D0D7745540866A

Uniqueness

Uniqueness Score: -1.00%

Function 004031C0 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_000031CC,00402AF2), ref: 004031C5

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f153aa39ca29a3ae629e15343f1eeea833f1a4a85a9f089f21b7ef5954a697de
Instruction ID: caa87f2511bcd723d41eba5315e80d492d59ea616669c5976221f7c40eb68032
Opcode Fuzzy Hash: f153aa39ca29a3ae629e15343f1eeea833f1a4a85a9f089f21b7ef5954a697de
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 021975C8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.363499699.0000000002191000.00000040.00000800.00020000.00000000.sdmp, Offset: 02191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2191000_hiYc6Vnppc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efb704f52671acc6e982d702847758b04619514dd0d8b90d11aa4d5c5ab53057
Instruction ID: daedfca4df7a171acc4462f68c7c3a7e5eea08526ac767c09285fddc238292c0
Opcode Fuzzy Hash: efb704f52671acc6e982d702847758b04619514dd0d8b90d11aa4d5c5ab53057
Instruction Fuzzy Hash: BFF018B1D4124CAADF50E7E88CC4ECFB3AC5F05314F540691A529D3191EB3497054BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0219AF84 Relevance: 6.1, APIs: 4, Instructions: 64
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetThreadLocale.KERNEL32 ref: 0219AFAB
GetSystemMetrics.USER32(0000004A), ref: 0219AFD2
GetSystemMetrics.USER32(0000002A), ref: 0219AFE1
GetCPInfo.KERNEL32(00000000,?,0000002A,0000004A), ref: 0219AFF5

Memory Dump Source

Source File: 00000000.00000002.363499699.0000000002191000.00000040.00000800.00020000.00000000.sdmp, Offset: 02191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2191000_hiYc6Vnppc.jbxd

Similarity

API ID: MetricsSystem$InfoLocaleThread
String ID:
API String ID: 1011932403-0
Opcode ID: 8eeb64042f016418861c01c67c88ae64f0a50439164fdde494d9561c3043d447
Instruction ID: a82b64a614ed3f6f98c62aafe0b7efe9c2039d8ed7c010f40c5a58e9028e5a30
Opcode Fuzzy Hash: 8eeb64042f016418861c01c67c88ae64f0a50439164fdde494d9561c3043d447
Instruction Fuzzy Hash: 121157226C97C58DCF20BBB0A8003FABBA99F52218F0D8428D8E947242E721D505D762

Uniqueness

Uniqueness Score: -1.00%

Function 0040B8B4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 0040B92C

Strings

=q, xrefs: 0040B9BE

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: _free
String ID: =q
API String ID: 269201875-2849742216
Opcode ID: 1fab7f3a6fec1fa9118639325d4d9e38d24c0ec74cbd72a1d2d2caa75d03a4f9
Instruction ID: 6738cb0e1d088b0cb2dbbc45a0c49451c6b12779a5b2a60d8be934d07b1d6b3b
Opcode Fuzzy Hash: 1fab7f3a6fec1fa9118639325d4d9e38d24c0ec74cbd72a1d2d2caa75d03a4f9
Instruction Fuzzy Hash: 313190B1900209AFCB11EF69D880ADB77B4EF44314F14447BF511A72E1EB359D11CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00407626 Relevance: 4.6, APIs: 3, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 004076B6
_free.LIBCMT ref: 004076D1
_free.LIBCMT ref: 004076DC

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 2ca95a611534c85a0761a32a6e5a1ecd73ce11374cbcd3ed30b0fbb1305e4377
Instruction ID: a59ccf1c7cec1f1e3576e26af9464927681fc216644ccfa843392a6d0edb236f
Opcode Fuzzy Hash: 2ca95a611534c85a0761a32a6e5a1ecd73ce11374cbcd3ed30b0fbb1305e4377
Instruction Fuzzy Hash: 4E21373690C6005ADF149E6D9841BFB7B55CF82334F24057FE886BB3C1D93B6D02829A

Uniqueness

Uniqueness Score: -1.00%

Function 0040BF10 Relevance: 4.6, APIs: 3, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0040BF19
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0040BF87

Part of subcall function 0040BE22: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,00000000,00000000,?,00410D20,?,00000000,00000000), ref: 0040BECE

Part of subcall function 00409870: RtlAllocateHeap.NTDLL(00000000,00000000), ref: 004098A2

_free.LIBCMT ref: 0040BF78

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$AllocateByteCharFreeHeapMultiWide_free
String ID:
API String ID: 2560199156-0
Opcode ID: 57ddae6f788429a58357c33df5addce2e2a19eb5f71adcea41f02254c7720639
Instruction ID: 7b08b985ce3283757e291cfeb7caa3aa2c0d3e7525d9026c7d70d7794454af9d
Opcode Fuzzy Hash: 57ddae6f788429a58357c33df5addce2e2a19eb5f71adcea41f02254c7720639
Instruction Fuzzy Hash: 7501D872A056167BE72116B74C89CBB696CCDC6BA4315013EBD00E3281EF78CD0185FC

Uniqueness

Uniqueness Score: -1.00%

Function 0045145C Relevance: 3.9, APIs: 3, Instructions: 116
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00060000,00001000,00000040), ref: 0045150D
VirtualAlloc.KERNELBASE(00000000,00060000,00001000,00000040), ref: 0045153B
VirtualFree.KERNELBASE(00640000,00000000,00008000,?,02190000,00000001,00000000,00000000,00451869), ref: 0045161C

Memory Dump Source

Source File: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: Virtual$Alloc$Free
String ID:
API String ID: 3668210933-0
Opcode ID: b9263a3ea97515307f9a6e52b5386bd9baeb3277eab9d3304407ca47a679fcc5
Instruction ID: 1ebe51e50d1f1ebfb3bdc33b77c5478414fd2efbacd455dcae5c5c58ca2e9bd2
Opcode Fuzzy Hash: b9263a3ea97515307f9a6e52b5386bd9baeb3277eab9d3304407ca47a679fcc5
Instruction Fuzzy Hash: DE4136B5A402899FDB71CF18CC81BD977E4FB49700F048126EE099F392D274AA45CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004075D3 Relevance: 3.0, APIs: 2, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 0040761B

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: ac80dc4a250b6ed9d5a5aba3b151104855fbac6e09490768fd3c6f9c33a58d6e
Instruction ID: 6eee036400eb921e0b5e3bb71656fee3878ea8893a895daa09a45989a53471d3
Opcode Fuzzy Hash: ac80dc4a250b6ed9d5a5aba3b151104855fbac6e09490768fd3c6f9c33a58d6e
Instruction Fuzzy Hash: B2E0A972E0A92111D222263EAC056AB1544EBC1339F114B3FF431E72E0DFBC590255DF

Uniqueness

Uniqueness Score: -1.00%

Function 0045144F Relevance: 2.6, APIs: 2, Instructions: 82
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00060000,00001000,00000040), ref: 0045150D
VirtualAlloc.KERNELBASE(00000000,00060000,00001000,00000040), ref: 0045153B
VirtualFree.KERNELBASE(00640000,00000000,00008000,?,02190000,00000001,00000000,00000000,00451869), ref: 0045161C

Memory Dump Source

Source File: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: Virtual$Alloc$Free
String ID:
API String ID: 3668210933-0
Opcode ID: bebaf7b250cdae4cd25bb78736d135890c3776ddd88833bc03eaad82a00b5c3a
Instruction ID: 9ad3af553773c2db6a171916ee54ba9fccedbeaf49f19f1e433f705b6bf3e66e
Opcode Fuzzy Hash: bebaf7b250cdae4cd25bb78736d135890c3776ddd88833bc03eaad82a00b5c3a
Instruction Fuzzy Hash: 703158B5A04289DFDB71CF28CC81BD97BA4FB09701F044166EE0ADF352D234AA85CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0045148F Relevance: 2.6, APIs: 2, Instructions: 67
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00060000,00001000,00000040), ref: 0045150D
VirtualAlloc.KERNELBASE(00000000,00060000,00001000,00000040), ref: 0045153B
VirtualFree.KERNELBASE(00640000,00000000,00008000,?,02190000,00000001,00000000,00000000,00451869), ref: 0045161C

Memory Dump Source

Source File: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: Virtual$Alloc$Free
String ID:
API String ID: 3668210933-0
Opcode ID: 84da2c4fe391c618f00e249224eec55e1e1a2223947fd682f33e01f4b94cb8f3
Instruction ID: f1adc86ba098958f003e24b781357a84f0a54895facb5aec4a8593971d9eb7fc
Opcode Fuzzy Hash: 84da2c4fe391c618f00e249224eec55e1e1a2223947fd682f33e01f4b94cb8f3
Instruction Fuzzy Hash: 062126B594028ADFDB75CF18CC81BD977A0FB49301F044126EE0EAF352D634AA85CB99

Uniqueness

Uniqueness Score: -1.00%

Function 004514EA Relevance: 2.6, APIs: 2, Instructions: 53
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00060000,00001000,00000040), ref: 0045150D
VirtualAlloc.KERNELBASE(00000000,00060000,00001000,00000040), ref: 0045153B
VirtualFree.KERNELBASE(00640000,00000000,00008000,?,02190000,00000001,00000000,00000000,00451869), ref: 0045161C

Memory Dump Source

Source File: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: Virtual$Alloc$Free
String ID:
API String ID: 3668210933-0
Opcode ID: a9f29b2fd031eb0dbf69e84aa5bab7cde95b7eafe921fed151961b058d97720b
Instruction ID: 5993ef0d9e1548ac2d8282d9b5720bf0468db73f8fda7de7216d4a6a89500f2e
Opcode Fuzzy Hash: a9f29b2fd031eb0dbf69e84aa5bab7cde95b7eafe921fed151961b058d97720b
Instruction Fuzzy Hash: 2A211AB5A402899FDB75CF18CC81BD97BA0FB0C301F044156EE4DAF382D274AA81CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0219141C Relevance: 2.5, APIs: 2, Instructions: 37
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000001,?,?,?,02191725), ref: 0219144B
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,02191725), ref: 02191472

Memory Dump Source

Source File: 00000000.00000002.363499699.0000000002191000.00000040.00000800.00020000.00000000.sdmp, Offset: 02191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2191000_hiYc6Vnppc.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 5b4e12ce82a76dfc66d9901f6b05c53c30602be81a9ef16b148d556142dd2036
Instruction ID: fd0db6a6164032c8224e15e57c65cea3659e75d0d3beb1bdcfffbac2ac05dffc
Opcode Fuzzy Hash: 5b4e12ce82a76dfc66d9901f6b05c53c30602be81a9ef16b148d556142dd2036
Instruction Fuzzy Hash: 2BF02772BC06213BDF20AA694DC0B5265959F8ABD0F150070FA4CFF3C8D3614C828AA0

Uniqueness

Uniqueness Score: -1.00%

Function 0040C3CD Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00408DBE: RtlAllocateHeap.NTDLL(00000008,?,00000000), ref: 00408DFF

_free.LIBCMT ref: 0040C43C

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 7cdb1adbac90d47b2a0f731c9530347fa274a67fae20e76af33faa291fd62161
Instruction ID: a9c062645c249a793ec015192c9dea85c4d66c4428afa4f7f731a7b1dd4b4762
Opcode Fuzzy Hash: 7cdb1adbac90d47b2a0f731c9530347fa274a67fae20e76af33faa291fd62161
Instruction Fuzzy Hash: 6D0126B2600316ABC3208F69C881A9AFB98FB443B0F14473EE555B76C0D774AC1187E8

Uniqueness

Uniqueness Score: -1.00%

Function 00408DBE Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000), ref: 00408DFF

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1316ec912249c896431ab4b8c603abbed80ac0edd6ca2d1a4da4625dbdaf6fbd
Instruction ID: 2b7acc13a5487b1c421e5c08bb205c8e5bc938bbb60da56e08cea36ded211d7c
Opcode Fuzzy Hash: 1316ec912249c896431ab4b8c603abbed80ac0edd6ca2d1a4da4625dbdaf6fbd
Instruction Fuzzy Hash: FFF0243150462067DB315B229E00BAB3748AFE2370B14853FA884F66C1CE38E80296ED

Uniqueness

Uniqueness Score: -1.00%

Function 00411F93 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 00408DBE: RtlAllocateHeap.NTDLL(00000008,?,00000000), ref: 00408DFF

_free.LIBCMT ref: 00411FB5

Part of subcall function 00408E1B: HeapFree.KERNEL32(00000000,00000000,?,0040C803,?,00000000,?,?,?,0040C82A,?,00000007,?,?,0040CC50,?), ref: 00408E31
Part of subcall function 00408E1B: GetLastError.KERNEL32(?,?,0040C803,?,00000000,?,?,?,0040C82A,?,00000007,?,?,0040CC50,?,?), ref: 00408E43

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: Heap$AllocateErrorFreeLast_free
String ID:
API String ID: 314386986-0
Opcode ID: 3b3f8ba533214d9cc1e478e6ea1d4c4a9f9e8982e364af526da1030537af5488
Instruction ID: 6d78d8f7c2ef938a304f1081cfc6fcf51d8826d4d53437afd31c52bc69e58626
Opcode Fuzzy Hash: 3b3f8ba533214d9cc1e478e6ea1d4c4a9f9e8982e364af526da1030537af5488
Instruction Fuzzy Hash: 43F062725007049FD3259F45D901B92B7E9EF80B15F10843FE69A9B6E1D7B8A486CB88

Uniqueness

Uniqueness Score: -1.00%

Function 00409870 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000000), ref: 004098A2

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7197c73b67966d2c05e0f155165b38c2724e0a0689cce004df1f3a6dbf461eb2
Instruction ID: 870dfbd59bfd8ccdfc04b447516768083a8d4e9db1f4497add884e9ac293723e
Opcode Fuzzy Hash: 7197c73b67966d2c05e0f155165b38c2724e0a0689cce004df1f3a6dbf461eb2
Instruction Fuzzy Hash: E5E0A03252862456E62037628C00B9B36589F837A0B1A813BEC05B23D2DA3D9C0281EE

Uniqueness

Uniqueness Score: -1.00%

Function 00402900 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__vfwprintf_l.LIBCONCRTD ref: 00402921

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: __vfwprintf_l
String ID:
API String ID: 1051920573-0
Opcode ID: 4d69f74b89572369ab4cd514bd66c354dd54c20530531eb6c8588fd7e28fb9ab
Instruction ID: dda2a424f9dfb230d2d17bcba1e4d99089c80eb14b1ff097ce4a2c0987242356
Opcode Fuzzy Hash: 4d69f74b89572369ab4cd514bd66c354dd54c20530531eb6c8588fd7e28fb9ab
Instruction Fuzzy Hash: D6E04FB5D0020CBFEB00EF94D946B9EB7B8DB44714F1081AAED08A7381E671AB548BD1

Uniqueness

Uniqueness Score: -1.00%

Function 021915B0 Relevance: 1.3, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 0219161D

Memory Dump Source

Source File: 00000000.00000002.363499699.0000000002191000.00000040.00000800.00020000.00000000.sdmp, Offset: 02191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2191000_hiYc6Vnppc.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4942eef3a4c88f155bb713efe5b06165db6af9eebc5dce0602efc692b8fa8211
Instruction ID: 95ff04dc53759079b81dda5ecfc6480a4533b3a8147d84d4e8f9b235e41ad694
Opcode Fuzzy Hash: 4942eef3a4c88f155bb713efe5b06165db6af9eebc5dce0602efc692b8fa8211
Instruction Fuzzy Hash: 161170B2A85602AFC7108E29C88061BB7E5EBC4761F0AC52CE59C97354D770BC818A91

Uniqueness

Uniqueness Score: -1.00%

Function 02191644 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,00004000,?,?,?,02234000,02238003,021918AB), ref: 0219169E

Memory Dump Source

Source File: 00000000.00000002.363499699.0000000002191000.00000040.00000800.00020000.00000000.sdmp, Offset: 02191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2191000_hiYc6Vnppc.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: a6588ff0857fcda20d917424285aa3d12d31db5a27c2bc08e481ed936e3fd1a5
Instruction ID: 0731db6e199c8bd5ba4742154c54d89448051df58fa160ebc712dd0685f7c7c0
Opcode Fuzzy Hash: a6588ff0857fcda20d917424285aa3d12d31db5a27c2bc08e481ed936e3fd1a5
Instruction Fuzzy Hash: 2101FC76AC9205AFC7109E28DDC0B2A77E4E784324F1A057CDD8997341D3727C918BE4

Uniqueness

Uniqueness Score: -1.00%

Function 021BCC20 Relevance: 1.3, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00000014,00001000,00000040,?,?,021C9A33,?,?,?), ref: 021BCC38

Memory Dump Source

Source File: 00000000.00000002.363499699.0000000002191000.00000040.00000800.00020000.00000000.sdmp, Offset: 02191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2191000_hiYc6Vnppc.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 838e851495497d3d5afa8b318cb7ff378629cfaa9fb05e00bb555cd0a7b66b47
Instruction ID: a5a7dcdcbd1848b47653be29c046453aefa93220a78feefc90da5a6fa9f436de
Opcode Fuzzy Hash: 838e851495497d3d5afa8b318cb7ff378629cfaa9fb05e00bb555cd0a7b66b47
Instruction Fuzzy Hash: 56D012B13422306FE321C6999C81F9267D8DB4D7A1F100161F70CDB2D0D1A05C008794

Uniqueness

Uniqueness Score: -1.00%

Function 021BCC40 Relevance: 1.3, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000,021CCD3D,?,?,?,?,021CCE2B), ref: 021BCC52

Memory Dump Source

Source File: 00000000.00000002.363499699.0000000002191000.00000040.00000800.00020000.00000000.sdmp, Offset: 02191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2191000_hiYc6Vnppc.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: e2c4764dff1ecaae3db098727c0146a5abe1626fb41be33696b4ea2629586872
Instruction ID: 3e663ec16be015ef2f22a688faa9b046520748fc7148a49cc77a972741ce680b
Opcode Fuzzy Hash: e2c4764dff1ecaae3db098727c0146a5abe1626fb41be33696b4ea2629586872
Instruction Fuzzy Hash: C2C092703922009FD281CB48CC81F0233E8BB88B00F400090F104CF2E0CA60A8008B00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 021C030C Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 117COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(0000009C), ref: 021C0392

Part of subcall function 021C07C4: GetVersionExA.KERNEL32(?,00000000,021C0882,?,00000000,?,021C0355), ref: 021C081B

GetVersionExA.KERNEL32(0000009C), ref: 021C0361

Strings

ProductType, xrefs: 021C040F
LANMANNT, xrefs: 021C044D
System\CurrentControlSet\Control\ProductOptions, xrefs: 021C0414
SERVERNT, xrefs: 021C0438
WINNT, xrefs: 021C0423

Memory Dump Source

Source File: 00000000.00000002.363499699.0000000002191000.00000040.00000800.00020000.00000000.sdmp, Offset: 02191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2191000_hiYc6Vnppc.jbxd

Similarity

API ID: Version
String ID: LANMANNT$ProductType$SERVERNT$System\CurrentControlSet\Control\ProductOptions$WINNT
API String ID: 1889659487-2290413088
Opcode ID: 7fa826ca762c21524171d1692875f52ff24398293587ec527133de40558e0935
Instruction ID: f68ec0ae43b499c5885e77cdb1af6e4662993983a8b1a1da2ed3a84748e72be6
Opcode Fuzzy Hash: 7fa826ca762c21524171d1692875f52ff24398293587ec527133de40558e0935
Instruction Fuzzy Hash: 2031B53CAC9248DEEF24DAA489417EB77A9DB3E308F7650AED451E7141D7348542CB11

Uniqueness

Uniqueness Score: -1.00%

Function 021BDB00 Relevance: 10.6, APIs: 7, Instructions: 81nativewindowCOMMON

Download Yara Rule

APIs

SetFocus.USER32(021E50A0), ref: 021BDB3C
DestroyWindow.USER32(?), ref: 021BDB6D
NtdllDefWindowProc_A.NTDLL(?,?,?,?), ref: 021BDBDD

Memory Dump Source

Source File: 00000000.00000002.363499699.0000000002191000.00000040.00000800.00020000.00000000.sdmp, Offset: 02191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2191000_hiYc6Vnppc.jbxd

Similarity

API ID: Window$DestroyFocusNtdllProc_
String ID:
API String ID: 3483532353-0
Opcode ID: 490edbf8bd2c721184d250125d638ef9b62d63bf77115012812aec7536fff93b
Instruction ID: cc063dfc4463f3189d06828fd00661891f643978d276b8579d49f208b10cd036
Opcode Fuzzy Hash: 490edbf8bd2c721184d250125d638ef9b62d63bf77115012812aec7536fff93b
Instruction Fuzzy Hash: F2210C752C4149AFDF2EDEA8EA84EEA37BABF46314F408811F9158B245C771D940CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0040ED28 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1427COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0040EEE4

Strings

1#SNAN, xrefs: 004101CB
1#IND, xrefs: 004101C1
1#QNAN, xrefs: 004101D5
1#INF, xrefs: 004101DF

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: cc40a9a354b5e79e9c4b01d85ad401466cbd0923e17a0a0cc4f6c77154fe8870
Instruction ID: 700f4b05c05fc33e27dfa3181a2f160ffe134a85e0109692c7d4d5c562555375
Opcode Fuzzy Hash: cc40a9a354b5e79e9c4b01d85ad401466cbd0923e17a0a0cc4f6c77154fe8870
Instruction Fuzzy Hash: A5D21671E086298BDB74CE28DD407EAB7B5EB48304F1445FBD80DE6680E778AE858F45

Uniqueness

Uniqueness Score: -1.00%

Function 021B02C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(021D6538,00000000,00000000,00000000,00000000,04000000,00000000,00000000,021B03B2), ref: 021B0340
DeviceIoControl.KERNEL32(00000000,00000001,?,000000FF,00000000,00000000,?,00000000), ref: 021B0375
CloseHandle.KERNEL32(00000000,00000000,00000001,?,000000FF,00000000,00000000,?,00000000,021D6538,00000000,00000000,00000000,00000000,04000000,00000000), ref: 021B038C

Strings

\System\SER.VXD, xrefs: 021B0309

Memory Dump Source

Source File: 00000000.00000002.363499699.0000000002191000.00000040.00000800.00020000.00000000.sdmp, Offset: 02191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2191000_hiYc6Vnppc.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID: \System\SER.VXD
API String ID: 33631002-3682912164
Opcode ID: 1e0282aab2371dff24e1881e7013f3580ac6725029c8f305e6b543f033199f48
Instruction ID: d68db4b9dec83bb252a5eabfa0444256cfd63e1e59022f29436558ae89688f8f
Opcode Fuzzy Hash: 1e0282aab2371dff24e1881e7013f3580ac6725029c8f305e6b543f033199f48
Instruction Fuzzy Hash: B7213A70684708AFEF25EA64CC81FDFB3BA9F48B04F5041A1EA15B62D0E770AF458E54

Uniqueness

Uniqueness Score: -1.00%

Function 0219D318 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 92timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,00000000,0219D475), ref: 0219D3F0

Strings

\pagefile.sys, xrefs: 0219D388
\win386.swp, xrefs: 0219D3A8

Memory Dump Source

Source File: 00000000.00000002.363499699.0000000002191000.00000040.00000800.00020000.00000000.sdmp, Offset: 02191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2191000_hiYc6Vnppc.jbxd

Similarity

API ID: LocalTime
String ID: \pagefile.sys$\win386.swp
API String ID: 481472006-523492860
Opcode ID: 17ee8876ddd076df86674572699c3c01ef133038eea6bcdcf5313fac63975d8a
Instruction ID: b61209b8f33ccc02941ac3f828f2167b5aae719e4f401be7a5893b6d3d9ee97e
Opcode Fuzzy Hash: 17ee8876ddd076df86674572699c3c01ef133038eea6bcdcf5313fac63975d8a
Instruction Fuzzy Hash: 0541F97598011EAADF14FFA4E9406EEF3B6EF09700F9084A1D814A3650EB34AF86CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0040E890 Relevance: 3.4, APIs: 2, Instructions: 450COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc068ba184f046630bd6e991861b1c485ec8df6db27087624b5ea5709390ad56
Instruction ID: 93103586a9ceef539f4d77e427c28f4fddcfd0274641bc4b714935a846fb8d0a
Opcode Fuzzy Hash: cc068ba184f046630bd6e991861b1c485ec8df6db27087624b5ea5709390ad56
Instruction Fuzzy Hash: 04F15E71E002199FDF14CFA9C8806AEBBB1FF88314F15866AD819B7381D735AE11CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0040AFFB Relevance: 3.1, APIs: 2, Instructions: 99COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000001), ref: 0040B0C1
_free.LIBCMT ref: 0040B212

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: FileFindFirst_free
String ID:
API String ID: 689657435-0
Opcode ID: c1f910429d05cc122be3c01fd4a31821299b5684f1fa7cd948e5ddd0da83f145
Instruction ID: 3a06af1e6300e4e127c8887008a413e0802c581576144d9922c8d82b7aa4bf47
Opcode Fuzzy Hash: c1f910429d05cc122be3c01fd4a31821299b5684f1fa7cd948e5ddd0da83f145
Instruction Fuzzy Hash: FA3146B19401195DDB20AE289CC9AFF73A9DB55308F1441FFE069B2281DB3C0D865AAD

Uniqueness

Uniqueness Score: -1.00%

Function 004058B3 Relevance: 3.1, APIs: 2, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,C0000417), ref: 004059B5
UnhandledExceptionFilter.KERNEL32(?), ref: 004059C2

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 278b6c8511ce4885e9e9a60dbedda2120ae860790f788ef9bfeee9684b46457a
Instruction ID: c0f7e2639cc15ccb9ad2660c6562d585f881661a6f141bcdf271140660008c86
Opcode Fuzzy Hash: 278b6c8511ce4885e9e9a60dbedda2120ae860790f788ef9bfeee9684b46457a
Instruction Fuzzy Hash: C831B774901218ABCB21DF69DD897CDBBB8FF48310F5041EAE40CA6290E7749F858F58

Uniqueness

Uniqueness Score: -1.00%

Function 0040305E Relevance: 3.1, APIs: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00403156
UnhandledExceptionFilter.KERNEL32(?), ref: 00403160

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: ce84cf3e23d0a6d24fc64c1201c671d3d84a3822d3d9aeb5b60701af25b0ac0a
Instruction ID: e15de0840396deee12bf487befc3ad599f0f8ddb44ab4a27ce5d1cfb50ba4540
Opcode Fuzzy Hash: ce84cf3e23d0a6d24fc64c1201c671d3d84a3822d3d9aeb5b60701af25b0ac0a
Instruction Fuzzy Hash: 74314974C05218DADB20EFA5D949BCDBBF8BF08704F1041AAE50CAB290EB754B858F48

Uniqueness

Uniqueness Score: -1.00%

Function 004034F4 Relevance: 3.1, APIs: 2, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00403614,00415280), ref: 004034F9
UnhandledExceptionFilter.KERNEL32(00403614,?,00403614,00415280), ref: 00403502

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: af3a45c08fad757f82921cc3e9b6b718968e3112f9aed18eea1a0ffc111d50bc
Instruction ID: 2cef8b53940ec940ed0f6b120f7b0ff0cabf1ee129e833cc2620446197af3020
Opcode Fuzzy Hash: af3a45c08fad757f82921cc3e9b6b718968e3112f9aed18eea1a0ffc111d50bc
Instruction Fuzzy Hash: A731F3F4911308AED700DF95FA857C4BBE4BB4C314F10C07AE9248B2A1E3B499818F4E

Uniqueness

Uniqueness Score: -1.00%

Function 021976A4 Relevance: 3.0, APIs: 2, Instructions: 33fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,?,?,00000001,0219D3C5,00000000,0219D475), ref: 021976BF
GetLastError.KERNEL32(00000000,?,?,?,00000001,0219D3C5,00000000,0219D475), ref: 021976E4

Part of subcall function 02197640: FileTimeToLocalFileTime.KERNEL32(?), ref: 0219766D
Part of subcall function 02197640: FileTimeToDosDateTime.KERNEL32(?,?,?), ref: 0219767C

Part of subcall function 021976F4: FindClose.KERNEL32(?,?,021976E2,00000000,?,?,?,00000001,0219D3C5,00000000,0219D475), ref: 02197700

Memory Dump Source

Source File: 00000000.00000002.363499699.0000000002191000.00000040.00000800.00020000.00000000.sdmp, Offset: 02191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2191000_hiYc6Vnppc.jbxd

Similarity

API ID: FileTime$Find$CloseDateErrorFirstLastLocal
String ID:
API String ID: 976985129-0
Opcode ID: b5e50eb9cc6753a5917c91f2fc53f76d5f4e7345019d2f3b76ed9a216832b6ef
Instruction ID: 9ca68950636f62f89ee8bb43cc284518a9b2220cfcb72cf4a6c50f9fcd01cf72
Opcode Fuzzy Hash: b5e50eb9cc6753a5917c91f2fc53f76d5f4e7345019d2f3b76ed9a216832b6ef
Instruction Fuzzy Hash: D7E0EDF3B821200B1F24AE7D08C085B958A5E846A430A06B6E928CB285DB20CC138BE0

Uniqueness

Uniqueness Score: -1.00%

Function 00413682 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,00000000,?,00000008,?,?,0041367D,00000000,?,00000008,?,?,00413315,00000000), ref: 004138AF

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 07a9c044905a7755e1628af98819a7d89e5252ef390c8c07ee61c138e53a6736
Instruction ID: 43ccbb8978d24294af21c5e24cbed49dd1552a47edfa67c3174935a437176aa5
Opcode Fuzzy Hash: 07a9c044905a7755e1628af98819a7d89e5252ef390c8c07ee61c138e53a6736
Instruction Fuzzy Hash: B5B15FB5610604DFD714CF28C486BA57BE0FF45365F258659E89ACF3A1C339EA82CB44

Uniqueness

Uniqueness Score: -1.00%

Function 0040AF20 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c739d1c6a14957cf84208182ce6e984cf96ad2e5ab5aa13e32033f575219186c
Instruction ID: 5083aece22af5d6506588a6007101e4044cb119c2caf6c63f0728d65b2a9198a
Opcode Fuzzy Hash: c739d1c6a14957cf84208182ce6e984cf96ad2e5ab5aa13e32033f575219186c
Instruction Fuzzy Hash: 2141B8B1804219AFDB10DF69CC89AEEB7B8EF45304F1442EEE41DE3241D6359E848F54

Uniqueness

Uniqueness Score: -1.00%

Function 02197878 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceA.KERNEL32(00000000,?,?,?,?), ref: 02197899

Memory Dump Source

Source File: 00000000.00000002.363499699.0000000002191000.00000040.00000800.00020000.00000000.sdmp, Offset: 02191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2191000_hiYc6Vnppc.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: c982e1cf5a99f9fa9977126e6836e47726ecb48f5223997347083cec8e94bb96
Instruction ID: 900796ddfd377ad557e8ce50e303a99ec6105d4a55e6f4db030cc9cf634e4845
Opcode Fuzzy Hash: c982e1cf5a99f9fa9977126e6836e47726ecb48f5223997347083cec8e94bb96
Instruction Fuzzy Hash: BE11DEB5E00209AF9B04CF99C881DEFF7FAEFC8310B54C569A519E7254E7319E018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00407A6D Relevance: 1.5, APIs: 1, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 00407AA8

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: b67e660137902377c1bd5e8862efe3acc6fd731f5ed8225fc8030fa3c10f366e
Instruction ID: 84f479360f2e6d1c16921b4ec698a4041345c7a25e0006a90db0867a96083481
Opcode Fuzzy Hash: b67e660137902377c1bd5e8862efe3acc6fd731f5ed8225fc8030fa3c10f366e
Instruction Fuzzy Hash: 33E09B30614504EBCE11BBA4CD54A8E3F14EB40310F148426F80455292CB3DFE90DD6A

Uniqueness

Uniqueness Score: -1.00%

Function 00406644 Relevance: 1.5, Strings: 1, Instructions: 216COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 004067C0

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: da55992896ce73b64e7b67eea58183c9fc9bd325487895a0f581d5c018ec2773
Instruction ID: 091bdf5e62febd5a6e5c309a2fb1bc7011397078684b298c3d94b91c72984d1b
Opcode Fuzzy Hash: da55992896ce73b64e7b67eea58183c9fc9bd325487895a0f581d5c018ec2773
Instruction Fuzzy Hash: 7E514A7020064856DB388A2985957BF779D9B42308F1A093FD883FB3C1C63EED75866E

Uniqueness

Uniqueness Score: -1.00%

Function 021B62D8 Relevance: 1.4, Strings: 1, Instructions: 155COMMON

Download Yara Rule

Strings

112, xrefs: 021B6533

Memory Dump Source

Source File: 00000000.00000002.363499699.0000000002191000.00000040.00000800.00020000.00000000.sdmp, Offset: 02191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2191000_hiYc6Vnppc.jbxd

Similarity

API ID:
String ID: 112
API String ID: 0-1616928578
Opcode ID: 51ed2acf174c034bf2c63cc17347112237f39fa7203f243bb2fd59fbc9bbd760
Instruction ID: 58bece57dd903f3298f53a1d3169ea30d59a4bbdd23b97fa8736713366feacf5
Opcode Fuzzy Hash: 51ed2acf174c034bf2c63cc17347112237f39fa7203f243bb2fd59fbc9bbd760
Instruction Fuzzy Hash: B741B681BC75909FEA877AAC54C03EE01774F66B44FE18270D2229F789D75ACD138746

Uniqueness

Uniqueness Score: -1.00%

Function 00403314 Relevance: 1.4, Strings: 1, Instructions: 144COMMON

Download Yara Rule

Strings

W, xrefs: 0040333D

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID:
String ID: W
API String ID: 0-655174618
Opcode ID: c80711a0b236d99cd74dafb75a8a59689c6365c265bd71a030c434548d86ce2b
Instruction ID: 0b183b952898a98bf0ba082220faadc0810cbbd59001941ec5845be169b6f62d
Opcode Fuzzy Hash: c80711a0b236d99cd74dafb75a8a59689c6365c265bd71a030c434548d86ce2b
Instruction Fuzzy Hash: 10518BB1E412158BDB15CF98E9C56AABBF5FB48311F24C47AD801EB390D3799A01CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0040CE43 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0040CE43

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: c088a4e7cdaace391546c98e6f03870cdb8fddc72efc3a2188784a25f1d99e84
Instruction ID: 3286082713fb0e4feee6c1c44b1ee69f1d997f3bc81a95e81afb07cc7afa2fce
Opcode Fuzzy Hash: c088a4e7cdaace391546c98e6f03870cdb8fddc72efc3a2188784a25f1d99e84
Instruction Fuzzy Hash: 8BA022B0E00B00CF83008F32EE083CC3BE8BA822CA302C038A00BC0230EB388080CF08

Uniqueness

Uniqueness Score: -1.00%

Function 021AC980 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.363499699.0000000002191000.00000040.00000800.00020000.00000000.sdmp, Offset: 02191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2191000_hiYc6Vnppc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5797c28ce8b9f195c1b73362480e9bd58889a08c9dc1d6cf2cd085d4bf685f5
Instruction ID: 3be9d5ee7d1adbe4892fabd05f5ec20b97f20376f65cd5a5e63c8f7b980b318a
Opcode Fuzzy Hash: a5797c28ce8b9f195c1b73362480e9bd58889a08c9dc1d6cf2cd085d4bf685f5
Instruction Fuzzy Hash: 10918E39E842198FDB14DFA8C5A0AAEB7F2FB48350F11412AD816B7350DB75A945CFE0

Uniqueness

Uniqueness Score: -1.00%

Function 021AB1D8 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.363499699.0000000002191000.00000040.00000800.00020000.00000000.sdmp, Offset: 02191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2191000_hiYc6Vnppc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29b69c7b6c9fb4bda54e62216c6989b30310bfede9ef9a0868b46e5daf6878b3
Instruction ID: bf1eddeffad3c78b32d11faf22ad25571a516f53603ce7c82d888a32e70f6eae
Opcode Fuzzy Hash: 29b69c7b6c9fb4bda54e62216c6989b30310bfede9ef9a0868b46e5daf6878b3
Instruction Fuzzy Hash: BF719E78B486969FC714CE18C4E0A2AF7A2FF99314F15CA19E8A58B705D330F991CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00411E9C Relevance: .1, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc71be762f8715ad9d13bf709785b6f6890c6ba34153193cbe57788e69b67264
Instruction ID: e4ea8aaf837ab143f23aed2b2e1d598ac991040530ec36f8ff5c61d4c98b7a59
Opcode Fuzzy Hash: dc71be762f8715ad9d13bf709785b6f6890c6ba34153193cbe57788e69b67264
Instruction Fuzzy Hash: 5421B373F204394B7B0CC57E8C522BDB6E1C68C601745823EF8A6EA2C1D968D917E2E4

Uniqueness

Uniqueness Score: -1.00%

Function 00411D7C Relevance: .1, Instructions: 81COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6f16113cdf5bf2b607b985eb23ac49171c0cec118e5f3d8ce175772f06a074c
Instruction ID: 135671fd2a4c67b99fd5a0fcb7c452cc2b762ad6384b67a36051f366f17fd56f
Opcode Fuzzy Hash: d6f16113cdf5bf2b607b985eb23ac49171c0cec118e5f3d8ce175772f06a074c
Instruction Fuzzy Hash: EB11CA33F30C255B675C81AD8C132BA91D2DBD824071F533AD826E72C4E9A4DE13D290

Uniqueness

Uniqueness Score: -1.00%

Function 0040C39C Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bd13e8db2f9529ace82a69afeb937bb4eaa021dae9aa292d34fedb844de8450
Instruction ID: d757c09329a45aec2d5af0cab6efca3ad2814e3c05feaacd6f1d17020de67398
Opcode Fuzzy Hash: 0bd13e8db2f9529ace82a69afeb937bb4eaa021dae9aa292d34fedb844de8450
Instruction Fuzzy Hash: 88E08C32921238EBCB14DB89C98498EF3ECEB44B04B1141ABF901E3281C278EF00C7D4

Uniqueness

Uniqueness Score: -1.00%

Function 021C0A10 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.363499699.0000000002191000.00000040.00000800.00020000.00000000.sdmp, Offset: 02191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2191000_hiYc6Vnppc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c0459424f1116aad770ded283a34064420ff478638f7431598b181d6a31c336
Instruction ID: 515e982fcc113093bc8b9341a6cdcd2dd9e3cb9215dfa8f3b5e9b2f25e208636
Opcode Fuzzy Hash: 4c0459424f1116aad770ded283a34064420ff478638f7431598b181d6a31c336
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 021BDBEC Relevance: 38.7, APIs: 18, Strings: 4, Instructions: 164windowregistryCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,?), ref: 021BDC49
LoadIconA.USER32(021E50B0,MAINICON), ref: 021BDC7C
LoadCursorA.USER32(00000000,00007F00), ref: 021BDC8B
RegisterClassA.USER32(021E5068), ref: 021BDCA8
SetWindowTextA.USER32(021E50A4,021D725E), ref: 021BDCF8
SetWindowTextA.USER32(021E50AC,Name:), ref: 021BDD08
SetWindowTextA.USER32(021E50A8,Code:), ref: 021BDD18
ShowWindow.USER32(021E5090,00000001,021E50A8,Code:,021E50AC,Name:,021E50A4,021D725E,021E5068,00000000,00007F00,021E50B0,MAINICON,00000000,?,?), ref: 021BDD25
SetFocus.USER32(021E50A0,021E5090,00000001,021E50A8,Code:,021E50AC,Name:,021E50A4,021D725E,021E5068,00000000,00007F00,021E50B0,MAINICON,00000000,?), ref: 021BDD30
GetFocus.USER32 ref: 021BDD48
DestroyWindow.USER32(021E5090,021E50B4,00000000,00000000,00000000,021E50A0,021E5090,00000001,021E50A8,Code:,021E50AC,Name:,021E50A4,021D725E,021E5068,00000000), ref: 021BDD94
TranslateMessage.USER32(021E50B4), ref: 021BDD9A
DispatchMessageA.USER32(021E50B4), ref: 021BDDA0
GetMessageA.USER32(021E50B4,00000000,00000000,00000000), ref: 021BDDAC
DestroyWindow.USER32(021E509C,021E50B4,00000000,00000000,00000000,021E50A0,021E5090,00000001,021E50A8,Code:,021E50AC,Name:,021E50A4,021D725E,021E5068,00000000), ref: 021BDDC5
DestroyWindow.USER32(021E50A0,021E509C,021E50B4,00000000,00000000,00000000,021E50B4,021E50B4,021E50B4,00000000,00000000,00000000,021E50A0,021E5090,00000001,021E50A8), ref: 021BDDD0
DestroyWindow.USER32(021E5094,021E50A0,021E509C,021E50B4,00000000,00000000,00000000,021E50B4,021E50B4,021E50B4,00000000,00000000,00000000,021E50A0,021E5090,00000001), ref: 021BDDDB
DestroyWindow.USER32(021E5098,021E5094,021E50A0,021E509C,021E50B4,00000000,00000000,00000000,021E50B4,021E50B4,021E50B4,00000000,00000000,00000000,021E50A0,021E5090), ref: 021BDDE6

Strings

Code:, xrefs: 021BDD0D
KeysDialog, xrefs: 021BDC9F, 021BDCCE
MAINICON, xrefs: 021BDC71
Name:, xrefs: 021BDCFD

Memory Dump Source

Source File: 00000000.00000002.363499699.0000000002191000.00000040.00000800.00020000.00000000.sdmp, Offset: 02191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2191000_hiYc6Vnppc.jbxd

Similarity

API ID: Window$Destroy$MessageText$FocusLoad$ClassCursorDispatchHandleIconModuleRegisterShowTranslate
String ID: Code:$KeysDialog$MAINICON$Name:
API String ID: 3228851985-2456160341
Opcode ID: 7e25ec50c674fa702ea8227d9ec6abe11f33d4371848f0ca810fe899477c5896
Instruction ID: dad30b0380e2f10379008b7aa038784a50c53d5538a83b8550099020f6c6c6aa
Opcode Fuzzy Hash: 7e25ec50c674fa702ea8227d9ec6abe11f33d4371848f0ca810fe899477c5896
Instruction Fuzzy Hash: F2515E71AC0284AFDF55EFB8AC80B9B37FAAF45714F840914F548DF281C73699508BA1

Uniqueness

Uniqueness Score: -1.00%

Function 021BD88C Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 172windowCOMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000200,EDIT,021BDA7C,50000180,00000037,0000002B,00000122,00000015,00000000,00000000,00000000,00000000), ref: 021BD8C1
CreateWindowExA.USER32(00000200,EDIT,021BDA7C,50000180,00000037,00000043,00000122,00000015,00000000,00000000,00000000,00000000), ref: 021BD8F4
SendMessageA.USER32(021E50A8,00000030,00000000,00000001), ref: 021BDA22
SendMessageA.USER32(021E50AC,00000030,00000000,00000001), ref: 021BDA32
SendMessageA.USER32(021E509C,00000030,00000000,00000001), ref: 021BDA42
SendMessageA.USER32(021E50A0,00000030,00000000,00000001), ref: 021BDA52
SendMessageA.USER32(021E5094,00000030,00000000,00000001), ref: 021BDA62
SendMessageA.USER32(021E5098,00000030,00000000,00000001), ref: 021BDA72

Strings

Static, xrefs: 021BD974, 021BD99F, 021BD9CA
MS Sans Serif, xrefs: 021BD9DE
BUTTON, xrefs: 021BD918, 021BD946
EDIT, xrefs: 021BD8B7, 021BD8EA
Cancel, xrefs: 021BD941

Memory Dump Source

Source File: 00000000.00000002.363499699.0000000002191000.00000040.00000800.00020000.00000000.sdmp, Offset: 02191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2191000_hiYc6Vnppc.jbxd

Similarity

API ID: MessageSend$CreateWindow
String ID: BUTTON$Cancel$EDIT$MS Sans Serif$Static
API String ID: 2286652126-4222191983
Opcode ID: 20205cbbc39bc124f8671bd1c47afbd7f8d319b348801977a10d16d256378065
Instruction ID: 0b87a7f94f36a4e4520e01d848f9b32053f4bdb5cf7a6fe57b6ead35b1b2cb7b
Opcode Fuzzy Hash: 20205cbbc39bc124f8671bd1c47afbd7f8d319b348801977a10d16d256378065
Instruction Fuzzy Hash: 5851EAB07C4344BFFA2596A49CA3FA732AEEB05F44F500511B744BF2C6C6E69D408BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040CAB9 Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0040CAFD

Part of subcall function 0040C672: _free.LIBCMT ref: 0040C68F
Part of subcall function 0040C672: _free.LIBCMT ref: 0040C6A1
Part of subcall function 0040C672: _free.LIBCMT ref: 0040C6B3
Part of subcall function 0040C672: _free.LIBCMT ref: 0040C6C5
Part of subcall function 0040C672: _free.LIBCMT ref: 0040C6D7
Part of subcall function 0040C672: _free.LIBCMT ref: 0040C6E9
Part of subcall function 0040C672: _free.LIBCMT ref: 0040C6FB
Part of subcall function 0040C672: _free.LIBCMT ref: 0040C70D
Part of subcall function 0040C672: _free.LIBCMT ref: 0040C71F
Part of subcall function 0040C672: _free.LIBCMT ref: 0040C731
Part of subcall function 0040C672: _free.LIBCMT ref: 0040C743
Part of subcall function 0040C672: _free.LIBCMT ref: 0040C755
Part of subcall function 0040C672: _free.LIBCMT ref: 0040C767

_free.LIBCMT ref: 0040CAF2

Part of subcall function 00408E1B: HeapFree.KERNEL32(00000000,00000000,?,0040C803,?,00000000,?,?,?,0040C82A,?,00000007,?,?,0040CC50,?), ref: 00408E31
Part of subcall function 00408E1B: GetLastError.KERNEL32(?,?,0040C803,?,00000000,?,?,?,0040C82A,?,00000007,?,?,0040CC50,?,?), ref: 00408E43

_free.LIBCMT ref: 0040CB14
_free.LIBCMT ref: 0040CB29
_free.LIBCMT ref: 0040CB34
_free.LIBCMT ref: 0040CB56
_free.LIBCMT ref: 0040CB69
_free.LIBCMT ref: 0040CB77
_free.LIBCMT ref: 0040CB82
_free.LIBCMT ref: 0040CBBA
_free.LIBCMT ref: 0040CBC1
_free.LIBCMT ref: 0040CBDE
_free.LIBCMT ref: 0040CBF6

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 972bdd526d1857f33f2cfbb3207d02e764111e5aaf54e4dd0e5a1bea27d1970c
Instruction ID: 5e640baffe88ff543c4b5248080f9926c4d6a7127ad1542a4239fcd7b63fbcba
Opcode Fuzzy Hash: 972bdd526d1857f33f2cfbb3207d02e764111e5aaf54e4dd0e5a1bea27d1970c
Instruction Fuzzy Hash: 92313C71500601DBEB319B39E986B5773E4AF80324F104A3FE495E72D1DE39BC91CA58

Uniqueness

Uniqueness Score: -1.00%

Function 004048DB Relevance: 16.1, APIs: 4, Strings: 5, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 004049FA
___TypeMatch.LIBVCRUNTIME ref: 00404B08
_UnwindNestedFrames.LIBCMT ref: 00404C5A
CallUnexpected.LIBVCRUNTIME ref: 00404C75

Strings

csm, xrefs: 00404918
csm, xrefs: 00404985
|RA, xrefs: 004049F1
-7, xrefs: 00404C7A
csm, xrefs: 00404A31

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm$|RA$-7
API String ID: 2751267872-3464069488
Opcode ID: 59d04053296473e66128c3bdc461578824f9f13455be5ce2afd6863cd177567a
Instruction ID: 1482bd04149e20280335e9136dc6a4e04a11bd16c6dbbadd322b8a04db4731b9
Opcode Fuzzy Hash: 59d04053296473e66128c3bdc461578824f9f13455be5ce2afd6863cd177567a
Instruction Fuzzy Hash: C5B16AB1900209AFCF14DFA5C941AAFB7B5BF84314B15417BEA007B292D339EA51CF99

Uniqueness

Uniqueness Score: -1.00%

Function 004089C8 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004089DE

Part of subcall function 00408E1B: HeapFree.KERNEL32(00000000,00000000,?,0040C803,?,00000000,?,?,?,0040C82A,?,00000007,?,?,0040CC50,?), ref: 00408E31
Part of subcall function 00408E1B: GetLastError.KERNEL32(?,?,0040C803,?,00000000,?,?,?,0040C82A,?,00000007,?,?,0040CC50,?,?), ref: 00408E43

_free.LIBCMT ref: 004089EA
_free.LIBCMT ref: 004089F5
_free.LIBCMT ref: 00408A00
_free.LIBCMT ref: 00408A0B
_free.LIBCMT ref: 00408A16
_free.LIBCMT ref: 00408A21
_free.LIBCMT ref: 00408A2C
_free.LIBCMT ref: 00408A37
_free.LIBCMT ref: 00408A45

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 0bb2f9d78abe6cf057f5e0f5333418b608d41883d368f811a40c01ca910e8a49
Instruction ID: e330f03267eae28a21fca3fc63cab5fce96350ed1dfa2297df4441d34f55a0cf
Opcode Fuzzy Hash: 0bb2f9d78abe6cf057f5e0f5333418b608d41883d368f811a40c01ca910e8a49
Instruction Fuzzy Hash: 3221F676900108AFCF41EF95C981CDE7BB8AF88314F0080AAF545EB162DB35EA55CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00404090 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 004040C7
___except_validate_context_record.LIBVCRUNTIME ref: 004040CF
_ValidateLocalCookies.LIBCMT ref: 00404158
__IsNonwritableInCurrentImage.LIBCMT ref: 00404183
_ValidateLocalCookies.LIBCMT ref: 004041D8

Strings

csm, xrefs: 0040416D
0@, xrefs: 0040419C
`B@, xrefs: 00404175, 0040417E, 0040418F

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: 0@$`B@$csm
API String ID: 1170836740-2734781928
Opcode ID: fd6f7a57359c823ea29376dfd258a425a8f9a08301f99e407a3009433b5108e6
Instruction ID: 0fb5d205e58dbabe529ead84677bfbcdc4414c3c072106fa712b5e9646839d99
Opcode Fuzzy Hash: fd6f7a57359c823ea29376dfd258a425a8f9a08301f99e407a3009433b5108e6
Instruction Fuzzy Hash: 5041A374A00208ABCF10DF69DC88A9F7BA1EF85314F148166E9147B3D2D7399D51CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0219B03C Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,0219B307,?,?,00000000,00000000), ref: 0219B072

Strings

AMPM, xrefs: 0219B286
AMPM , xrefs: 0219B295
mmmm d, yyyy, xrefs: 0219B16E
:mm:ss, xrefs: 0219B2C2
m/d/yy, xrefs: 0219B141
:mm, xrefs: 0219B2A5

Memory Dump Source

Source File: 00000000.00000002.363499699.0000000002191000.00000040.00000800.00020000.00000000.sdmp, Offset: 02191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2191000_hiYc6Vnppc.jbxd

Similarity

API ID: LocaleThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 635194068-2493093252
Opcode ID: 753609f3c2d86b34fe57b0d9e29f2d1eb5034f3b89cce89a0ddabb32c26a1306
Instruction ID: 6b0064680c6f1c9d11ce2ee333375acf2f52f3ba09c6c9412349255e2f4e7676
Opcode Fuzzy Hash: 753609f3c2d86b34fe57b0d9e29f2d1eb5034f3b89cce89a0ddabb32c26a1306
Instruction Fuzzy Hash: D6612D31B85248DFDF00EBA4D980A9FB7BBAB48304F508479E111AB345DB34EA46CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040BF94 Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0040BFBE
_free.LIBCMT ref: 0040C097
_free.LIBCMT ref: 0040C0C4

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 991d796795e5b6876fbac61f70163761d07ad06e779fb8e2784dbb851bf97854
Instruction ID: 793ec8e395128184e872d946ddf62033a2612e7d9a5d08c2e125f827f07a5f8f
Opcode Fuzzy Hash: 991d796795e5b6876fbac61f70163761d07ad06e779fb8e2784dbb851bf97854
Instruction Fuzzy Hash: 7051B3B1904201EEDB20AFA598C19AA77A4AF45318F14437FE551BB2C2DB3D8901CF9D

Uniqueness

Uniqueness Score: -1.00%

Function 02194B10 Relevance: 12.1, APIs: 5, Strings: 3, Instructions: 127stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?,?), ref: 02194B6B
lstrcpyn.KERNEL32(?,?,0000005C,kernel32.dll), ref: 02194BCF
lstrcpyn.KERNEL32(?,?,00000001,?,?,?,kernel32.dll), ref: 02194C04
lstrlen.KERNEL32(?,0000005D,?), ref: 02194C67
lstrcpy.KERNEL32(?,0000005C), ref: 02194C85

Strings

\, xrefs: 02194C42
kernel32.dll, xrefs: 02194B25
GetLongPathNameA, xrefs: 02194B35

Memory Dump Source

Source File: 00000000.00000002.363499699.0000000002191000.00000040.00000800.00020000.00000000.sdmp, Offset: 02191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2191000_hiYc6Vnppc.jbxd

Similarity

API ID: lstrcpylstrcpyn$lstrlen
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 2167663922-1565342463
Opcode ID: d3e61994f5b57b75c37f5e0cc9379b2428793c7ff665cf498462714aeb58ff5e
Instruction ID: 0f79661417b16d018d7a4ede4ed9f12ec4a6ecb12e348387b8e30883fe919c0a
Opcode Fuzzy Hash: d3e61994f5b57b75c37f5e0cc9379b2428793c7ff665cf498462714aeb58ff5e
Instruction Fuzzy Hash: DB415C71A40219BFEF21DAB8CD88BDE77EEAF08310F0404B19519D7240D7759A86CF64

Uniqueness

Uniqueness Score: -1.00%

Function 021A69D8 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 181fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,021A6D08,?,\\.\Scsi,C0000000,00000003,00000000,00000003,00000000,00000000,00000000,021A6CDD), ref: 021A6A93
DeviceIoControl.KERNEL32(000000FF,0004D008,0000001C,0000023C,0000001C,0000023C,?,00000000), ref: 021A6B65
CloseHandle.KERNEL32(000000FF,021A6C67,0000023C,0000001C,0000023C,?,00000000,00000000,021A6B92), ref: 021A6B8C

Strings

SCSIDISK, xrefs: 021A6ACE
\\.\Scsi, xrefs: 021A6A67
\\.\SMARTVSD, xrefs: 021A6BA5

Memory Dump Source

Source File: 00000000.00000002.363499699.0000000002191000.00000040.00000800.00020000.00000000.sdmp, Offset: 02191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2191000_hiYc6Vnppc.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID: SCSIDISK$\\.\SMARTVSD$\\.\Scsi
API String ID: 33631002-4143829331
Opcode ID: 1c5c307cea79cb89b1a7339e879df32e0cb3b22dcc56ba9ea1f8be8b5e5d8771
Instruction ID: 5cab4450dee5c36f9b6a173c39b25455c54216e014080b03a9a0b05db772a94a
Opcode Fuzzy Hash: 1c5c307cea79cb89b1a7339e879df32e0cb3b22dcc56ba9ea1f8be8b5e5d8771
Instruction Fuzzy Hash: 6471B5706843989EEF21DB24CC59F99BBB9EB05714F5580E4E50CAB2D1C3B55E48CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0040C811 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0040C7D9: _free.LIBCMT ref: 0040C7FE

_free.LIBCMT ref: 0040C85F

Part of subcall function 00408E1B: HeapFree.KERNEL32(00000000,00000000,?,0040C803,?,00000000,?,?,?,0040C82A,?,00000007,?,?,0040CC50,?), ref: 00408E31
Part of subcall function 00408E1B: GetLastError.KERNEL32(?,?,0040C803,?,00000000,?,?,?,0040C82A,?,00000007,?,?,0040CC50,?,?), ref: 00408E43

_free.LIBCMT ref: 0040C86A
_free.LIBCMT ref: 0040C875
_free.LIBCMT ref: 0040C8C9
_free.LIBCMT ref: 0040C8D4
_free.LIBCMT ref: 0040C8DF
_free.LIBCMT ref: 0040C8EA

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: dfd30121637da8de457bbdb20e5c8dbb2e13d70f5835f32775482e51a56bcf2e
Instruction ID: 1b54ede2b651037c14262451ea210479eea2756cc1357b2ed54b533ab1923ccb
Opcode Fuzzy Hash: dfd30121637da8de457bbdb20e5c8dbb2e13d70f5835f32775482e51a56bcf2e
Instruction Fuzzy Hash: C1114A31580B05EAD930B7B2CC86FCB77A95F88714F40493FB29AB64D3DF78A5144A94

Uniqueness

Uniqueness Score: -1.00%

Function 004045A4 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0040459B,0040440C,00403210), ref: 004045B2
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 004045C0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 004045D9
SetLastError.KERNEL32(00000000,0040459B,0040440C,00403210), ref: 0040462B

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 38c3bb12bb5450d277d9b495d0c79af4792a40a6b9c4ded1da8043f56c201e08
Instruction ID: da6f97795d2dedf0c88609181b2cb75d13fcd367c592a4f4b32682efc7540049
Opcode Fuzzy Hash: 38c3bb12bb5450d277d9b495d0c79af4792a40a6b9c4ded1da8043f56c201e08
Instruction Fuzzy Hash: 67012876118A11AED62436B57DC54972AC4EBD2B76B20133FF710A11E1FF7E8C02A58C

Uniqueness

Uniqueness Score: -1.00%

Function 00404684 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0040474B
___AdjustPointer.LIBCMT ref: 0040476E
___AdjustPointer.LIBCMT ref: 0040480A

Strings

0@, xrefs: 004046E3

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID: 0@
API String ID: 1740715915-1855383697
Opcode ID: ed2b68e0b01666af651dda3a1222adcfed941a40fa4bbdeb6bfde3e63676e481
Instruction ID: 996528970bb24515314476948a1fcfaaa719e2c1e2afcf38844c0b47f5924ef3
Opcode Fuzzy Hash: ed2b68e0b01666af651dda3a1222adcfed941a40fa4bbdeb6bfde3e63676e481
Instruction Fuzzy Hash: 2051DEB6600602AFDB299F51D841BABB7A4EF85314F14853FEE01672D1E739EC41CB98

Uniqueness

Uniqueness Score: -1.00%

Function 021ADBEC Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(netapi32.dll,00000000,021ADD73), ref: 021ADC1D
GetProcAddress.KERNEL32(00000000,Netbios), ref: 021ADC57
FreeLibrary.KERNEL32(00000000,021ADD5D,021ADD56,?,?,netapi32.dll,00000000,021ADD73), ref: 021ADD50

Strings

netapi32.dll, xrefs: 021ADC18, 021ADC33
Netbios, xrefs: 021ADC4E

Memory Dump Source

Source File: 00000000.00000002.363499699.0000000002191000.00000040.00000800.00020000.00000000.sdmp, Offset: 02191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2191000_hiYc6Vnppc.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: Netbios$netapi32.dll
API String ID: 4061214504-970706980
Opcode ID: ce876075ff75b28cef43d1c9b467a5ce5b0b11efca26d33a361c7cec64199da0
Instruction ID: daec9cd590483a114e9021c3595e9a4a59d93b20110ffcb639932d7d864d9482
Opcode Fuzzy Hash: ce876075ff75b28cef43d1c9b467a5ce5b0b11efca26d33a361c7cec64199da0
Instruction Fuzzy Hash: 7A412678D88A899EEF25DB70EC607EEBBB2AF47300F4044A5D41553980D7751A85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0040B3AD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\hiYc6Vnppc.exe, xrefs: 0040B3B2

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\hiYc6Vnppc.exe
API String ID: 0-1369794819
Opcode ID: 7c18eb401558195c1c73f83feb187478a9ceeda492c63b58accbfde343853383
Instruction ID: 49a3544bafe95d210442d2e85997da1498c24d3020b2ed4bc18ae607f8759688
Opcode Fuzzy Hash: 7c18eb401558195c1c73f83feb187478a9ceeda492c63b58accbfde343853383
Instruction Fuzzy Hash: FB21CF71200605AFDB10AF729C81D6B7768EE50368310863AF954A22D2EB38ED0187ED

Uniqueness

Uniqueness Score: -1.00%

Function 00408EBD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

Strings

ext-ms-, xrefs: 00408F28
api-ms-, xrefs: 00408F14

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 5b28311d8cf7e672d2c943a0488037bb7dc1fdab38b117f1b5bc8fe156f62e07
Instruction ID: 7a791f7703257a9673e31adeae409d1ac703023e236893cbfa9d8064a1f031e4
Opcode Fuzzy Hash: 5b28311d8cf7e672d2c943a0488037bb7dc1fdab38b117f1b5bc8fe156f62e07
Instruction Fuzzy Hash: 3A21F571A05616EFCB22AB349E40A9B36A99F44764F21013BED85FB2D1DF38DC00C5E8

Uniqueness

Uniqueness Score: -1.00%

Function 00407AF2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 31libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,00407AA4,?,?,00407A6C,?,?,?), ref: 00407B07
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00407B1A

Strings

mscoree.dll, xrefs: 00407B00
0@, xrefs: 00407B2B
CorExitProcess, xrefs: 00407B12

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: 0@$CorExitProcess$mscoree.dll
API String ID: 1646373207-3806126223
Opcode ID: 102ba065852f58f522910a8a5a1e393e89d92f248fe033a11f1119d777f7b36d
Instruction ID: 47b293a45a76d09b823b1ae91e4c4efca29ae04e0ff400ddb8b4fa71f5ec9a6e
Opcode Fuzzy Hash: 102ba065852f58f522910a8a5a1e393e89d92f248fe033a11f1119d777f7b36d
Instruction Fuzzy Hash: 04F08231A01618FBCB11AB90DD09FDE7EB9DF44759F114075E400B21A0DB759F40DAD9

Uniqueness

Uniqueness Score: -1.00%

Function 00410B74 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00410BF8
__alloca_probe_16.LIBCMT ref: 00410CBE
__freea.LIBCMT ref: 00410D2A

Part of subcall function 00409870: RtlAllocateHeap.NTDLL(00000000,00000000), ref: 004098A2

__freea.LIBCMT ref: 00410D33
__freea.LIBCMT ref: 00410D56

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 5d83a49f99020a6c2f1f17d7b95ee591256166db876b10a0a1a5d36ba3d33650
Instruction ID: 655126f06936f5c72a4aefd8d36d8e0d27d6c3d86f35e3f7ea5601a204fa929a
Opcode Fuzzy Hash: 5d83a49f99020a6c2f1f17d7b95ee591256166db876b10a0a1a5d36ba3d33650
Instruction Fuzzy Hash: E551D67260020AAFDB245F91DC41EFB77A9DB84754F15052AFD04A7251E7BCECC1C6A8

Uniqueness

Uniqueness Score: -1.00%

Function 021919C8 Relevance: 7.6, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(021D8430), ref: 021919F5
LocalFree.KERNEL32(021D8488,021D8430,00000000,02191A9E), ref: 02191A07
LocalFree.KERNEL32(021D8448,00000000,00000000,00008000,021D8488,00000000,02191A9E), ref: 02191A65
RtlLeaveCriticalSection.NTDLL(021D8430), ref: 02191A8E
RtlDeleteCriticalSection.NTDLL(021D8430), ref: 02191A98

Memory Dump Source

Source File: 00000000.00000002.363499699.0000000002191000.00000040.00000800.00020000.00000000.sdmp, Offset: 02191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2191000_hiYc6Vnppc.jbxd

Similarity

API ID: CriticalSection$FreeLocal$DeleteEnterLeave
String ID:
API String ID: 3902855382-0
Opcode ID: 9720125e7f1f616986e97ea4448192f1c578a687827e6fa68b361292b5fd21e3
Instruction ID: 6136d9256306e937eaa5b0a0de0b6036c7709ac0cc93a85ba62e5d27345a41b4
Opcode Fuzzy Hash: 9720125e7f1f616986e97ea4448192f1c578a687827e6fa68b361292b5fd21e3
Instruction Fuzzy Hash: DC116D30ACA342FEEF51ABA9A980B2B37E69745748F660850E10DD7540C774B8D2CB35

Uniqueness

Uniqueness Score: -1.00%

Function 0040C770 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0040C788

Part of subcall function 00408E1B: HeapFree.KERNEL32(00000000,00000000,?,0040C803,?,00000000,?,?,?,0040C82A,?,00000007,?,?,0040CC50,?), ref: 00408E31
Part of subcall function 00408E1B: GetLastError.KERNEL32(?,?,0040C803,?,00000000,?,?,?,0040C82A,?,00000007,?,?,0040CC50,?,?), ref: 00408E43

_free.LIBCMT ref: 0040C79A
_free.LIBCMT ref: 0040C7AC
_free.LIBCMT ref: 0040C7BE
_free.LIBCMT ref: 0040C7D0

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: dad6c6168b3971448665ef2f8a935c997f56374553b0cea953facc9ac78d0028
Instruction ID: 29e24e347ce0085d4d5b6c3b15b63838021f7943036704dc09b760d8d5d67d71
Opcode Fuzzy Hash: dad6c6168b3971448665ef2f8a935c997f56374553b0cea953facc9ac78d0028
Instruction Fuzzy Hash: 7FF06832540205E7C630DB55EAC1C5B77EAAA84B24754493FF044F76C0CB38FC818A9C

Uniqueness

Uniqueness Score: -1.00%

Function 02199F68 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 143threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,0219A12A,?,?,?,?,00000000,00000000,00000000,00000000), ref: 02199F96

Strings

yyyy, xrefs: 0219A081
ggg, xrefs: 0219A074
eeee, xrefs: 0219A09A

Memory Dump Source

Source File: 00000000.00000002.363499699.0000000002191000.00000040.00000800.00020000.00000000.sdmp, Offset: 02191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2191000_hiYc6Vnppc.jbxd

Similarity

API ID: LocaleThread
String ID: eeee$ggg$yyyy
API String ID: 635194068-1253427255
Opcode ID: b0f62ec0f44cea6b54f629e81721a6321bc82a30cfd2d14962525c2f6cc6aee4
Instruction ID: 88aa4d5452fb52708795c4d7d066dd58ba37c9c3a2a48f25b45d54c83551e039
Opcode Fuzzy Hash: b0f62ec0f44cea6b54f629e81721a6321bc82a30cfd2d14962525c2f6cc6aee4
Instruction Fuzzy Hash: E7412F757C42015FCF15AAB888903BFF29BEF88310F180575E4A2D3340EB25AC4ACEA5

Uniqueness

Uniqueness Score: -1.00%

Function 021B270C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 108fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000003,00000000,00000004,00000080,00000000,00000000,021B285F,?,00000000,021B287F), ref: 021B2788

Strings

158, xrefs: 021B2829

Memory Dump Source

Source File: 00000000.00000002.363499699.0000000002191000.00000040.00000800.00020000.00000000.sdmp, Offset: 02191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2191000_hiYc6Vnppc.jbxd

Similarity

API ID: CreateFile
String ID: 158
API String ID: 823142352-3801435587
Opcode ID: 4a5754710b5cb42e20f1372f86a7e42d994d51dae09a10849b8224a39ab6fc0a
Instruction ID: 3ac6c895f13634ea98eb479dc5248e4bc5f4542f09c8a7e2f0a6a3aa30f8fdd5
Opcode Fuzzy Hash: 4a5754710b5cb42e20f1372f86a7e42d994d51dae09a10849b8224a39ab6fc0a
Instruction Fuzzy Hash: 56415D74A80208EFEF22EBA4C841BCDB7B5FF05704F5185B5EA14A7290D774AA89CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00405612 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 00405663

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-
API String ID: 0-2084034818
Opcode ID: 553e1944f630e16c0ff694f55789d1e577a52e57eb29dd21801813c314a8f75b
Instruction ID: e60c6f7fd9fafeb86fe18cfdd4ec20ac643fb849185ca9f617fec69b11f93adc
Opcode Fuzzy Hash: 553e1944f630e16c0ff694f55789d1e577a52e57eb29dd21801813c314a8f75b
Instruction Fuzzy Hash: EE11A732A01A21ABDF225B689C40B9B3798DF45760F650632E919FB2C0D779ED018EDD

Uniqueness

Uniqueness Score: -1.00%

Function 00409FEB Relevance: 6.3, APIs: 4, Instructions: 320COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0040A075

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 297e674e151500d86084b6bc3621331759cafdb13f8d23ea8a3a0672e83bc00e
Instruction ID: bf69cb88f5e0cdf71a34dad8a41fc81e23cf7afdb3fb901bfbfe705b051c9f46
Opcode Fuzzy Hash: 297e674e151500d86084b6bc3621331759cafdb13f8d23ea8a3a0672e83bc00e
Instruction Fuzzy Hash: 1FB124729003459FDB11CF68C8417EEBBA5EF55340F1441BBE845BB382D6398D52CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00412141 Relevance: 6.2, APIs: 4, Instructions: 245COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0041229A
__alloca_probe_16.LIBCMT ref: 00412330
__freea.LIBCMT ref: 0041239B
__freea.LIBCMT ref: 004123A7

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea
String ID:
API String ID: 1635606685-0
Opcode ID: 3107296534d4435a19ebf4dea142f8843e57c8005995749831b451b9625a2a93
Instruction ID: 2e6e990cfc712b44a6a882a05bf1fc62a1db2ff6d8bbe8fcc7b2aa5530a2482e
Opcode Fuzzy Hash: 3107296534d4435a19ebf4dea142f8843e57c8005995749831b451b9625a2a93
Instruction Fuzzy Hash: 7D81D372D0020AABDF219F658A41EEF7BB59F4A314F18005BED14E7241D6BDCCA1C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 021C0A14 Relevance: 6.2, APIs: 4, Instructions: 207threadCOMMON

Download Yara Rule

APIs

SetThreadPriority.KERNEL32(?,0000000F,?,?,?), ref: 021C0AC1
QueryPerformanceCounter.KERNEL32(?,00000000,021C0B48,?,?,?,?), ref: 021C0ADA
QueryPerformanceCounter.KERNEL32(?,?,00000000,021C0B48,?,?,?,?), ref: 021C0B07
SetThreadPriority.KERNEL32(?,7FFFFFFF,021C0B4F,?,?,?,?), ref: 021C0B42

Memory Dump Source

Source File: 00000000.00000002.363499699.0000000002191000.00000040.00000800.00020000.00000000.sdmp, Offset: 02191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2191000_hiYc6Vnppc.jbxd

Similarity

API ID: CounterPerformancePriorityQueryThread
String ID:
API String ID: 179279453-0
Opcode ID: 42238edbf2ff0e6d42abb5d254f4de5398036dca04cd4e5681ff94e832dfc5fe
Instruction ID: d6a525cb4fd3a7b1b4a474dda4d9e390493c6700ef43aa531f033d74daa9e54b
Opcode Fuzzy Hash: 42238edbf2ff0e6d42abb5d254f4de5398036dca04cd4e5681ff94e832dfc5fe
Instruction Fuzzy Hash: 1D81BDB9E40218DFCB04DFE8C984ADEBBF6AB49304F21856AD418EB254E7319A458F50

Uniqueness

Uniqueness Score: -1.00%

Function 021C00CC Relevance: 6.1, APIs: 4, Instructions: 91registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,00000000,00000000,00020019,?,00000000,021C01BB), ref: 021C0110
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,00000000,?,?,00000000,00000000,00020019,?,00000000,021C01BB), ref: 021C0142
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,?,?,?,00000000,00000000,?,00000000,?,?,00000000,00000000,00020019), ref: 021C0172
RegCloseKey.ADVAPI32(?,?,00000000,00000000,?,00000000,?,?,00000000,00000000,00020019,?,00000000,021C01BB), ref: 021C01A0

Memory Dump Source

Source File: 00000000.00000002.363499699.0000000002191000.00000040.00000800.00020000.00000000.sdmp, Offset: 02191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2191000_hiYc6Vnppc.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: bdf29311373136b8118ad53f79565cc0a4df9ea689e05c30a0603e8cf273c695
Instruction ID: d116020b3d245ee38f3d2f24aa827a34366343bec458321520d370ade2ec116a
Opcode Fuzzy Hash: bdf29311373136b8118ad53f79565cc0a4df9ea689e05c30a0603e8cf273c695
Instruction Fuzzy Hash: 3531D775A50619BFEF11EBA8CC80EAFB7BEEB49710F504565A514E7240E730EE018B60

Uniqueness

Uniqueness Score: -1.00%

Function 0040AC45 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 0040B267: _free.LIBCMT ref: 0040B275

Part of subcall function 0040BE22: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,00000000,00000000,?,00410D20,?,00000000,00000000), ref: 0040BECE

GetLastError.KERNEL32 ref: 0040ACAD
__dosmaperr.LIBCMT ref: 0040ACB4
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0040ACF3
__dosmaperr.LIBCMT ref: 0040ACFA

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 9172ec3c6ae770dd49c2917de77819b826084d210957810ef62a47460ac69e8b
Instruction ID: da6b955007121a6bba651cdf27a16814553dc068fb813253fb440f90ca8d7dad
Opcode Fuzzy Hash: 9172ec3c6ae770dd49c2917de77819b826084d210957810ef62a47460ac69e8b
Instruction Fuzzy Hash: BE21D371504705BFEB10AF629C8496B77A9EF54368310863EF855B36D0E738DC21879A

Uniqueness

Uniqueness Score: -1.00%

Function 00408AE0 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00407CD1,?,?,00402ABF,00000000,0041B36C,?,string too long,?,00401ECB,?,004027A2,)'@), ref: 00408AE5
_free.LIBCMT ref: 00408B42
_free.LIBCMT ref: 00408B78
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,?,00407CD1,?,?,00402ABF,00000000,0041B36C,?,string too long,?,00401ECB), ref: 00408B83

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 0af373db9932830809188551db6b7d49dccb60e0b9b41aa442febf19644c7272
Instruction ID: a91eafa9eb8c65f739ed9f1b0d2f7165d69771ab74e34c8b4e7360ee4ccfb059
Opcode Fuzzy Hash: 0af373db9932830809188551db6b7d49dccb60e0b9b41aa442febf19644c7272
Instruction Fuzzy Hash: 0B114CB2340509BAD71067769EC6EAB316DABC4778724033FF694B62D2DE3CAC16911C

Uniqueness

Uniqueness Score: -1.00%

Function 00408C37 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,?,00408DB0,004098B3,?,?,00402CA5,00000000,?,0040244C,00000000,?,00401D59,00000000), ref: 00408C3C
_free.LIBCMT ref: 00408C99
_free.LIBCMT ref: 00408CCF
SetLastError.KERNEL32(00000000,00000006,000000FF,?,00000000,?,00408DB0,004098B3,?,?,00402CA5,00000000,?,0040244C,00000000), ref: 00408CDA

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: bb4c3524b6671b9505c4bfebf6052633fdac9e2cab3770c0c275643530338323
Instruction ID: d8b0c5c3e2ca81d1329aa52abaa76473770c9bce7d22a6d20f43c58d7616cf92
Opcode Fuzzy Hash: bb4c3524b6671b9505c4bfebf6052633fdac9e2cab3770c0c275643530338323
Instruction Fuzzy Hash: 5011297130A2057AF71026769EC9EAB2569ABC4378724023FF594B62D1DE398C15612C

Uniqueness

Uniqueness Score: -1.00%

Function 0219D018 Relevance: 6.1, APIs: 4, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,00000000,00000000,00020019,?), ref: 0219D03E
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,00000000,?,?,00000000,00000000,00020019,?), ref: 0219D06C
RegQueryValueExA.ADVAPI32(?,00000000,00000000,00000003,?,?,?,00000000,00000000,?,00000000,?,?,00000000,00000000,00020019), ref: 0219D09C
RegCloseKey.ADVAPI32(?,?,00000000,00000000,?,00000000,?,?,00000000,00000000,00020019,?), ref: 0219D0A8

Memory Dump Source

Source File: 00000000.00000002.363499699.0000000002191000.00000040.00000800.00020000.00000000.sdmp, Offset: 02191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2191000_hiYc6Vnppc.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: 0408de3088738fd8eff5748714d264a7e372c784926f405a6a91d754d5241bc3
Instruction ID: fc34471cb8262dfe230515b2cdb92aa8ec60bf21cd77743fa09386a27ffd050d
Opcode Fuzzy Hash: 0408de3088738fd8eff5748714d264a7e372c784926f405a6a91d754d5241bc3
Instruction Fuzzy Hash: AC11BD76E40118BFDF10EAA9DC84FEEB7BDEB04210F044566BA14E7240E7709A008BA1

Uniqueness

Uniqueness Score: -1.00%

Function 02199EB8 Relevance: 6.0, APIs: 4, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,02199F4F,?,?,00000000), ref: 02199ED0
GetThreadLocale.KERNEL32(00000000,00000004,00000000,02199F4F,?,?,00000000), ref: 02199F00
GetThreadLocale.KERNEL32(00000000,00000003,Function_00008E04,00000000,00000000,00000004,00000000,02199F4F,?,?,00000000), ref: 02199F29
EnumCalendarInfoA.KERNEL32(Function_00008E40,00000000,00000000,00000003), ref: 02199F34

Memory Dump Source

Source File: 00000000.00000002.363499699.0000000002191000.00000040.00000800.00020000.00000000.sdmp, Offset: 02191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2191000_hiYc6Vnppc.jbxd

Similarity

API ID: LocaleThread$CalendarEnumInfo
String ID:
API String ID: 1139405593-0
Opcode ID: 83a8c7383970de2e5428e2a31aed99e1b0ea7eda58d3115ce1a623bd7fa6faea
Instruction ID: d485b5d18163ebf3a215f867b1869ac46981bdb499130bd477be21160a8d0a3e
Opcode Fuzzy Hash: 83a8c7383970de2e5428e2a31aed99e1b0ea7eda58d3115ce1a623bd7fa6faea
Instruction Fuzzy Hash: 1201F2717C4248AFFF11AB748D12F6AB75EDB86B20F200164F500A66C0E7349E018AA8

Uniqueness

Uniqueness Score: -1.00%

Function 00412467 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000001B,00000000,00000000,00000000,?,00411517,00000000,00000001,00000000,00000000,?,0040DE5A,?,0000000F,00000000), ref: 0041247E
GetLastError.KERNEL32(?,00411517,00000000,00000001,00000000,00000000,?,0040DE5A,?,0000000F,00000000,?,00000000,?,0040E3A6,?), ref: 0041248A

Part of subcall function 00412450: CloseHandle.KERNEL32(FFFFFFFE,0041249A,?,00411517,00000000,00000001,00000000,00000000,?,0040DE5A,?,0000000F,00000000,?,00000000), ref: 00412460

___initconout.LIBCMT ref: 0041249A

Part of subcall function 00412412: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00412441,00411504,00000000,?,0040DE5A,?,0000000F,00000000,?), ref: 00412425

WriteConsoleW.KERNEL32(00000000,0000001B,00000000,00000000,?,00411517,00000000,00000001,00000000,00000000,?,0040DE5A,?,0000000F,00000000,?), ref: 004124AF

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 154d22163482ac2e1cee05457185874bc8b07cdd1f4d63705a76896d0c1d751a
Instruction ID: 7e3763eda41dce19ce67d731735d68b7e6a9f15119974591a5522d454736ef8f
Opcode Fuzzy Hash: 154d22163482ac2e1cee05457185874bc8b07cdd1f4d63705a76896d0c1d751a
Instruction Fuzzy Hash: 54F01C37400128BBCF226FD1DD04ACA3F66FB4C3A4F458021FA08D5120C6768C60EB98

Uniqueness

Uniqueness Score: -1.00%

Function 004081DC Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004081E5

Part of subcall function 00408E1B: HeapFree.KERNEL32(00000000,00000000,?,0040C803,?,00000000,?,?,?,0040C82A,?,00000007,?,?,0040CC50,?), ref: 00408E31
Part of subcall function 00408E1B: GetLastError.KERNEL32(?,?,0040C803,?,00000000,?,?,?,0040C82A,?,00000007,?,?,0040CC50,?,?), ref: 00408E43

_free.LIBCMT ref: 004081F8
_free.LIBCMT ref: 00408209
_free.LIBCMT ref: 0040821A

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 89843c78b46ecbdfd6f7dcce1ee1ac36033d748c6d14e1dc2bb597d032026490
Instruction ID: 749b8829db4eaaf99a6bd23986dc91dba5821a0a1ab3b060ddd4f8272a56a8ff
Opcode Fuzzy Hash: 89843c78b46ecbdfd6f7dcce1ee1ac36033d748c6d14e1dc2bb597d032026490
Instruction Fuzzy Hash: F6E0BFF5C05160AACB11AF15FE414C63B61EBC4764701A43EF450626B6CA390562DBCD

Uniqueness

Uniqueness Score: -1.00%

Function 004072A3 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\hiYc6Vnppc.exe, xrefs: 004072E6, 004072ED, 00407323

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\hiYc6Vnppc.exe
API String ID: 0-1369794819
Opcode ID: 91219cbde1be2c42f593788d6fb92af30ee0cdbbdd0a13273b995a418b2f9f85
Instruction ID: bd43cf828432085d93917b06e8555d72da317386a575ff5f0cffdaaf06698e0a
Opcode Fuzzy Hash: 91219cbde1be2c42f593788d6fb92af30ee0cdbbdd0a13273b995a418b2f9f85
Instruction Fuzzy Hash: F24194B0E04214ABDB11DF9A9C8199FBBB8EB84310B10407BFC04F7291D778AE01D799

Uniqueness

Uniqueness Score: -1.00%

Function 00404C80 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 00404CA5

Strings

MOC, xrefs: 00404CB7
RCC, xrefs: 00404CBF

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: a78bb005423d4d1483988eda407080e485ae25ecc85c95642cd84746d98321b7
Instruction ID: d45a07652d828b7dccaa433c5f59063f4c2df5354e8bc583bc59cd699ba6929b
Opcode Fuzzy Hash: a78bb005423d4d1483988eda407080e485ae25ecc85c95642cd84746d98321b7
Instruction Fuzzy Hash: 74415BB1900209EFDF15DF94CD81AEE7BB5BF88304F15806AFA04B7291D3399A51DB54

Uniqueness

Uniqueness Score: -1.00%

Function 02198980 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,02198A5E), ref: 02198A06
GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,02198A5E), ref: 02198A0C

Strings

yyyy, xrefs: 021989E1

Memory Dump Source

Source File: 00000000.00000002.363499699.0000000002191000.00000040.00000800.00020000.00000000.sdmp, Offset: 02191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2191000_hiYc6Vnppc.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: yyyy
API String ID: 3303714858-3145165042
Opcode ID: 8161631ac958d1d2040fac267f292d0c782dd74c87e46f67689065c95e7a2906
Instruction ID: fb78782a4e001132c05409d39524194f3e09838e60df0fa3afe17091a8fabd17
Opcode Fuzzy Hash: 8161631ac958d1d2040fac267f292d0c782dd74c87e46f67689065c95e7a2906
Instruction Fuzzy Hash: CB21A178680208AFDF15EFA8C885AAEB3B9EF49710F4200A5F915E7751DB30DE40CB65

Uniqueness

Uniqueness Score: -1.00%

Function 021B70E8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(021E4DE4), ref: 021B70F3
RtlLeaveCriticalSection.NTDLL(021E4DE4), ref: 021B7169

Strings

181, xrefs: 021B7149

Memory Dump Source

Source File: 00000000.00000002.363499699.0000000002191000.00000040.00000800.00020000.00000000.sdmp, Offset: 02191000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2191000_hiYc6Vnppc.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: 181
API String ID: 3168844106-523153041
Opcode ID: 457650890ca7035595c9b4025ec706bcbcdf7dce2c73efecd60fbd1f438fa8ab
Instruction ID: 453227d7fdeed3ee19ab1b142f0dffcfbac589f20413c0fcbca7c6eb9bd6df74
Opcode Fuzzy Hash: 457650890ca7035595c9b4025ec706bcbcdf7dce2c73efecd60fbd1f438fa8ab
Instruction Fuzzy Hash: DE01C0722807469EDF32EF69C880AC7B7FEAF80304B00892AE54647144D761F90A8BB0

Uniqueness

Uniqueness Score: -1.00%

Function 004091C2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?), ref: 00409202

Strings

0@, xrefs: 004091F2
InitializeCriticalSectionEx, xrefs: 004091D2

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: 0@$InitializeCriticalSectionEx
API String ID: 2593887523-348943516
Opcode ID: 820523cb8882581daeb4233bf1cf00565923cc79475d46bb87ca62abc0df9ff3
Instruction ID: ea175ca7c0054d3ecf465842f4c2b5daf9089b8f728e32c464686bd57bc6b6ed
Opcode Fuzzy Hash: 820523cb8882581daeb4233bf1cf00565923cc79475d46bb87ca62abc0df9ff3
Instruction Fuzzy Hash: A8E0923168021DF7CF112F51DC0AEDE3F15DF84B61B108036FD18291A2CB768960A7C8

Uniqueness

Uniqueness Score: -1.00%

Function 004090C3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 004090F7

Strings

FlsAlloc, xrefs: 004090D3
0@, xrefs: 004090ED

Memory Dump Source

Source File: 00000000.00000002.363201451.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.363188412.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363260298.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363297142.0000000000451000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.363308479.0000000000464000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hiYc6Vnppc.jbxd

Yara matches

Similarity

API ID: Alloc
String ID: 0@$FlsAlloc
API String ID: 2773662609-1191926940
Opcode ID: c48f049adb390857d296c21d3dc04b2ddc32ee604f02374522663f94a0598c6f
Instruction ID: f4fdd5adffcf4d16a9820a1f1a41caa8e6a2c58ce2c09c421f3608c8c531de37
Opcode Fuzzy Hash: c48f049adb390857d296c21d3dc04b2ddc32ee604f02374522663f94a0598c6f
Instruction Fuzzy Hash: CAE0CD31B81715F7C6113751EC0AFDE7D148780B60F158033F904651D2DEB98D4151DD

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report hiYc6Vnppc.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Allcome clipbanker

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_hiYc6Vnppc.exe_b0d78236e65c5dc4ede9cda029eafd3eac4aca1b_983f6238_15bdd112\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBBF4.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBE85.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBF80.tmp.xml

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

Windows Analysis Report
hiYc6Vnppc.exe

Function 02194CB8 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 151
registrystringlibraryCOMMON

Function 00401B30 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 126
sleepthreadCOMMON

Function 00401AE0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24
sleepCOMMON

Function 0219AF84 Relevance: 6.1, APIs: 4, Instructions: 64
threadCOMMON

Function 0040B8B4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99
COMMON

Function 00407626 Relevance: 4.6, APIs: 3, Instructions: 102
COMMON

Function 0040BF10 Relevance: 4.6, APIs: 3, Instructions: 68
COMMON

Function 0045145C Relevance: 3.9, APIs: 3, Instructions: 116
memoryCOMMON

Function 004075D3 Relevance: 3.0, APIs: 2, Instructions: 33
COMMON

Function 0045144F Relevance: 2.6, APIs: 2, Instructions: 82
memoryCOMMON

Function 0045148F Relevance: 2.6, APIs: 2, Instructions: 67
memoryCOMMON

Function 004514EA Relevance: 2.6, APIs: 2, Instructions: 53
memoryCOMMON

Function 0219141C Relevance: 2.5, APIs: 2, Instructions: 37
memoryCOMMON

Function 0040C3CD Relevance: 1.6, APIs: 1, Instructions: 52
COMMON