Edit tour

Windows Analysis Report
Infor IDF Auxiliary Machine.exe

Overview

General Information

Sample name:	Infor IDF Auxiliary Machine.exe
Analysis ID:	1500785
MD5:	62cdc45806e717f187e2f46780bd6834
SHA1:	c84eb7d4061d8e57a37c493ca28a06403f56501d
SHA256:	574bd976108995da86f648aad2403e6780d11bc36d579ce0a6098bd69287769a
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

AI detected suspicious sample

Machine Learning detection for sample

PE file has a writeable .text section

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Detected potential crypto function

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Infor IDF Auxiliary Machine.exe (PID: 7316 cmdline: "C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe" MD5: 62CDC45806E717F187E2F46780BD6834)

conhost.exe (PID: 7324 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 92.5% probability

Machine Learning detection for sample

Source: Infor IDF Auxiliary Machine.exe

Joe Sandbox ML: detected

Source: Infor IDF Auxiliary Machine.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: Infor IDF Auxiliary Machine.exe, 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmp

String found in binary or memory: http://java.sun.com

System Summary

PE file has a writeable .text section

Source: Infor IDF Auxiliary Machine.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe	Code function: 0_2_004166FC	0_2_004166FC
Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe	Code function: 0_2_0040C8E0	0_2_0040C8E0
Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe	Code function: 0_2_0041ACE1	0_2_0041ACE1
Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe	Code function: 0_2_00408E5D	0_2_00408E5D
Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe	Code function: 0_2_00413F00	0_2_00413F00

Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe	Code function: String function: 004166B0 appears 58 times
Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe	Code function: String function: 00401A0A appears 54 times
Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe	Code function: String function: 00415728 appears 187 times
Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe	Code function: String function: 00411F19 appears 38 times

Source: Infor IDF Auxiliary Machine.exe	Binary or memory string: OriginalFilename vs Infor IDF Auxiliary Machine.exe
Source: Infor IDF Auxiliary Machine.exe, 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameconsole.exe@ vs Infor IDF Auxiliary Machine.exe
Source: Infor IDF Auxiliary Machine.exe, 00000000.00000000.2042309173.000000000043C000.00000080.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameconsole.exe@ vs Infor IDF Auxiliary Machine.exe
Source: Infor IDF Auxiliary Machine.exe	Binary or memory string: OriginalFilenameconsole.exe@ vs Infor IDF Auxiliary Machine.exe

Source: Infor IDF Auxiliary Machine.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: Infor IDF Auxiliary Machine.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: classification engine

Classification label: mal60.evad.winEXE@2/0@0/0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7324:120:WilError_03

Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe "C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe"
Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe	Section loaded: version.dll			Jump to behavior

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe

Unpacked PE file: 0.2.Infor IDF Auxiliary Machine.exe.400000.0.unpack .text:EW;.rsrc:EW; vs .text:ER;.rsrc:EW;

Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe

Code function: 0_2_0041F805 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_0041F805

Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe	Code function: 0_2_0042D04C push eax; ret	0_2_0042D0A1
Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe	Code function: 0_2_00428018 push eax; retn 0042h	0_2_00428019
Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe	Code function: 0_2_004283D8 push esp; iretd	0_2_004283D9
Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe	Code function: 0_2_004166EB push ecx; ret	0_2_004166FB
Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe	Code function: 0_2_00415728 push eax; ret	0_2_00415746
Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe	Code function: 0_2_0041C880 push eax; ret	0_2_0041C894
Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe	Code function: 0_2_0041C880 push eax; ret	0_2_0041C8BC

Source: Infor IDF Auxiliary Machine.exe

Static PE information: section name: .text entropy: 7.970208954906549

Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_0-19947

Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe

API coverage: 9.2 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe

Code function: 0_2_0041E627 VirtualQuery,GetSystemInfo,VirtualQuery,VirtualAlloc,VirtualProtect,

0_2_0041E627

Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe

API call chain: ExitProcess graph end node

graph_0-19949

Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe

Code function: 0_2_0041F805 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_0041F805

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe	Code function: 0_2_0041C9CE SetUnhandledExceptionFilter,		0_2_0041C9CE
Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe	Code function: 0_2_0041C9BA SetUnhandledExceptionFilter,		0_2_0041C9BA

Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe	Code function: GetLocaleInfoA,	0_2_0041E70A
Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe	Code function: GetLastError,GetLocaleInfoA,GetLocaleInfoA,MultiByteToWideChar,	0_2_0041F8FE
Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe	Code function: GetLocaleInfoA,_strncpy,	0_2_0041D992
Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe	Code function: GetLocaleInfoA,MultiByteToWideChar,	0_2_0041F9BA
Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe	Code function: GetLastError,WideCharToMultiByte,GetLocaleInfoA,	0_2_0041FA2E
Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe	Code function: _strlen,_strlen,EnumSystemLocalesA,	0_2_0041DEE8
Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe	Code function: _strlen,EnumSystemLocalesA,	0_2_0041DEB1
Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe	Code function: _strlen,EnumSystemLocalesA,	0_2_0041DF6E
Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe	Code function: GetLocaleInfoA,_TranslateName,_TranslateName,IsValidLocale,_strcat,	0_2_0041DFC3

Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe

Code function: 0_2_0041E429 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_0041E429

Source: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe

Code function: 0_2_00414FC6 EntryPoint,GetVersionExA,GetModuleHandleA,_fast_error_exit,_fast_error_exit,GetCommandLineA,

0_2_00414FC6

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 Process Injection	12 Software Packing	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	14 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Infor IDF Auxiliary Machine.exe	5%	ReversingLabs
Infor IDF Auxiliary Machine.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://java.sun.com	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://java.sun.com	Infor IDF Auxiliary Machine.exe, 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1500785
Start date and time:	2024-08-28 22:50:16 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 1m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Infor IDF Auxiliary Machine.exe
Detection:	MAL
Classification:	mal60.evad.winEXE@2/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 93% Number of executed functions: 16 Number of non-executed functions: 95
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: Infor IDF Auxiliary Machine.exe

File type:	PE32 executable (console) Intel 80386, for MS Windows, PECompact2 compressed
Entropy (8bit):	7.719974222025018
TrID:	Win32 Executable (generic) a (10002005/4) 98.96% Win32 EXE PECompact compressed (v2.x) (59071/9) 0.58% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	Infor IDF Auxiliary Machine.exe
File size:	122'880 bytes
MD5:	62cdc45806e717f187e2f46780bd6834
SHA1:	c84eb7d4061d8e57a37c493ca28a06403f56501d
SHA256:	574bd976108995da86f648aad2403e6780d11bc36d579ce0a6098bd69287769a
SHA512:	888edf170ea8dfdf165c6107efd9beff18e80597911b0df29a50aba31f91a5040504c23610492a896f5c04e3c3324e9c27681795304834e94e723038221bb6ae
SSDEEP:	3072:YM5y2eLmj6MgLi58xh4V9A/PW/nVaTyVHZdY:KKj6ZLAaHWfVlY
TLSH:	7BC3F1D6E6405DBBE06D0572CD3312A02BB0B9093F23968716F36ADB3C71A25258F6DD
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........r8...V...V...V...Y...V...6...V.....*.V.......V...?...V.9.....V.9.....V...W...V...2...V.V.....V.......V.Rich..V.........PE..L..

File Icon


Icon Hash:	76e9daf4c888b0f0

Static PE Info

General

Entrypoint:	0x414fc6
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x4C650145 [Fri Aug 13 08:24:37 2010 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	09d0478591d4f788cb3e5ea416c25237

Entrypoint Preview

Instruction
mov eax, 004438FCh
push eax
push dword ptr fs:[00000000h]
mov dword ptr fs:[00000000h], esp
xor eax, eax
mov dword ptr [eax], ecx
push eax
inc ebp
inc ebx
outsd
insd
jo 00007F7010D149E3h
arpl word ptr [edx+esi+00h], si
pop ecx
retf
aam 16h
pop es
pushad
rcr byte ptr [ecx], 00000022h
je 00007F7010D149A9h
in eax, 22h
dec esp
mov ebx, 26449820h
pop esi
add al, D1h
imul eax, esp, EEC4E71Eh
salc
push FFFFFFA6h
inc eax
or eax, dword ptr [esi-6CCA1C66h]
and dl, byte ptr [edi]
in al, 68h
fidiv dword ptr [eax+6303CD78h]
xor edx, dword ptr [ebx+44h]
push esp
mov esp, dword ptr [ebp+72h]
sbb ch, byte ptr [edi]
jnl 00007F7010D149F6h
mov bx, ds
and dword ptr [edx], A02D8029h
mov ebx, D0E870ACh
and cl, ch
push 00000046h
sub al, 02h
push FFFFFF81h
dec esp
mov eax, dword ptr [81D5B00Ch]
xor eax, 1B248E63h
add esp, dword ptr [esi]
push eax
add byte ptr [edx-6Bh], FFFFFFBCh
dec ebx
dec ebp
adc al, 02h
salc
pushfd
cdq
add ah, byte ptr [ecx]
mov al, byte ptr [A3B72108h]
pushad
test byte ptr [edx], cl
dec eax
mov dword ptr [E23DD200h], eax
sbb dword ptr [ebx+4D488D00h], ebp
fmul qword ptr [esi+0306AB36h]
arpl ax, sp
sbb dword ptr [eax], eax

Rich Headers

Programming Language:

[ASM] VS2003 (.NET) build 3077
[C++] VS2003 (.NET) build 3077
[ C ] VS2003 (.NET) build 3077
[RES] VS2003 (.NET) build 3077
[LNK] VS2003 (.NET) build 3077

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x42e94	0x8f	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3c000	0x6e55	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3b000	0x16200	6b2e13c14c65b20d76c9b766f5db175d	False	0.9955420197740112	data	7.970208954906549	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3c000	0x8000	0x7a00	7606d67299f301afb8b445c88408d4e6	False	0.6684490266393442	data	6.468159493452258	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x3c598	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.43658536585365854
RT_ICON	0x3cc00	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.5376344086021505
RT_ICON	0x3cee8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.597972972972973
RT_ICON	0x3d010	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.6471215351812367
RT_ICON	0x3deb8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.7572202166064982
RT_ICON	0x3e760	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.5823699421965318
RT_ICON	0x3ecc8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.7104771784232365
RT_ICON	0x41270	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.6843339587242027
RT_ICON	0x42318	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.9166666666666666
RT_STRING	0x30000	0x2a8	empty			0
RT_STRING	0x302a8	0x2b0	empty	Catalan	Spain	0
RT_STRING	0x30558	0x142	empty	Chinese	Taiwan	0
RT_STRING	0x3069a	0x1b4	empty	Czech	Czech Republic	0
RT_STRING	0x3084e	0x2b4	empty	Danish	Denmark	0
RT_STRING	0x30b02	0x274	empty	German	Germany	0
RT_STRING	0x30d76	0x31c	empty	Greek	Greece	0
RT_STRING	0x31092	0x268	empty	English	United States	0
RT_STRING	0x312fa	0x276	empty	Finnish	Finland	0
RT_STRING	0x31570	0x28c	empty	French	France	0
RT_STRING	0x317fc	0x28c	empty	Hungarian	Hungary	0
RT_STRING	0x31a88	0x29c	empty	Italian	Italy	0
RT_STRING	0x31d24	0x1ce	empty	Japanese	Japan	0
RT_STRING	0x31ef2	0x164	empty	Korean	North Korea	0
RT_STRING	0x31ef2	0x164	empty	Korean	South Korea	0
RT_STRING	0x32056	0x2a4	empty	Dutch	Netherlands	0
RT_STRING	0x322fa	0x26a	empty	Norwegian	Norway	0
RT_STRING	0x32564	0x202	empty	Polish	Poland	0
RT_STRING	0x32766	0x2d4	empty	Portuguese	Brazil	0
RT_STRING	0x32a3a	0x2e4	empty	Russian	Russia	0
RT_STRING	0x32d1e	0x2dc	empty	Slovak	Slovakia	0
RT_STRING	0x32ffa	0x262	empty	Swedish	Sweden	0
RT_STRING	0x3325c	0x286	empty	Thai	Thailand	0
RT_STRING	0x334e2	0x29c	empty	Turkish	Turkey	0
RT_STRING	0x3377e	0x29e	empty	Indonesian	Indonesia	0
RT_STRING	0x33a1c	0x2d6	empty	Slovenian	Slovenia	0
RT_STRING	0x33cf2	0x2e8	empty	Basque	France	0
RT_STRING	0x33cf2	0x2e8	empty	Basque	Spain	0
RT_STRING	0x33fda	0x140	empty	Chinese	China	0
RT_STRING	0x3411a	0x2be	empty	Portuguese	Portugal	0
RT_STRING	0x343d8	0x286	empty	French	Canada	0
RT_GROUP_ICON	0x42780	0x84	data	English	United States	0.6363636363636364
RT_VERSION	0x42808	0x348	data	English	United States	0.45595238095238094
RT_MANIFEST	0x42b50	0x305	XML 1.0 document, ASCII text			0.5420439844760673

Imports

DLL	Import
kernel32.dll	LoadLibraryA, GetProcAddress, VirtualAlloc, VirtualFree

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Catalan	Spain
Chinese	Taiwan
Czech	Czech Republic
Danish	Denmark
German	Germany
Greek	Greece
Finnish	Finland
French	France
Hungarian	Hungary
Italian	Italy
Japanese	Japan
Korean	North Korea
Korean	South Korea
Dutch	Netherlands
Norwegian	Norway
Polish	Poland
Portuguese	Brazil
Russian	Russia
Slovak	Slovakia
Swedish	Sweden
Thai	Thailand
Turkish	Turkey
Indonesian	Indonesia
Slovenian	Slovenia
Chinese	China
Portuguese	Portugal
French	Canada

Target ID:	0
Start time:	16:51:08
Start date:	28/08/2024
Path:	C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe"
Imagebase:	0x400000
File size:	122'880 bytes
MD5 hash:	62CDC45806E717F187E2F46780BD6834
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:51:08
Start date:	28/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	1.1%
Signature Coverage:	3.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	62

Executed Functions

Function 00414FC6 Relevance: 7.6, APIs: 5, Instructions: 121
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(?,004247B8,00000018), ref: 00414FE6
GetModuleHandleA.KERNEL32(00000000,?,004247B8,00000018), ref: 00415033
_fast_error_exit.LIBCMT ref: 00415099
_fast_error_exit.LIBCMT ref: 004150AA
GetCommandLineA.KERNEL32(?,004247B8,00000018), ref: 004150C9

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: _fast_error_exit$CommandHandleLineModuleVersion
String ID:
API String ID: 2471294817-0
Opcode ID: be51f0216baf2cf2f8e1b70fa28ccbb07090ee8127ad58b0c7e50d3b3e00463c
Instruction ID: 52348ceb12ad2935292754978af404c3743035051b11f28c4781ee22d84ee488
Opcode Fuzzy Hash: be51f0216baf2cf2f8e1b70fa28ccbb07090ee8127ad58b0c7e50d3b3e00463c
Instruction Fuzzy Hash: EB41D571E40610CAC720AF76DC466E93BA1AF84308F61443FE5199A292DB3D98C3CB8C

Function 00411F19 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 119
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,?,?,?,00411968,kernel32.dll,CreateFileMappingW,0042D340,004120A4), ref: 00411F31
GetFileAttributesW.KERNELBASE(???.???,00000000,GetFileAttributesW,?,?,?,?,00411968,kernel32.dll,CreateFileMappingW,0042D340,004120A4), ref: 00411F50
GetLastError.KERNEL32(?,?,?,?,00411968,kernel32.dll,CreateFileMappingW,0042D340,004120A4), ref: 00411F57
InterlockedExchange.KERNEL32(?,?), ref: 00411FCE
LoadLibraryA.KERNEL32(?,?,?,?,?,00411968,kernel32.dll,CreateFileMappingW,0042D340,004120A4), ref: 00411FF0
LoadLibraryA.KERNEL32(security.dll,?,?,?,?,00411968,kernel32.dll,CreateFileMappingW,0042D340,004120A4), ref: 00412003
InterlockedExchange.KERNEL32(00000001,00000000), ref: 00412009
FreeLibrary.KERNEL32(00000000,?,?,?,?,00411968,kernel32.dll,CreateFileMappingW,0042D340,004120A4), ref: 00412014
InterlockedExchange.KERNEL32(0042C064,00000000), ref: 00412041
FreeLibrary.KERNEL32(00000000,?,?,?,?,00411968,kernel32.dll,CreateFileMappingW,0042D340,004120A4), ref: 0041204C

Strings

???.???, xrefs: 00411F4B
security.dll, xrefs: 00411FFE
GetFileAttributesW, xrefs: 00411F37
`AB, xrefs: 00411F82

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: Library$ExchangeInterlocked$FreeLoad$AttributesErrorFileHandleLastModule
String ID: ???.???$GetFileAttributesW$`AB$security.dll
API String ID: 1916585904-522417547
Opcode ID: 84fde1eb2596e27518b9b66f74fad4f568d33ae02a80d8bcb14e35c8c4c33197
Instruction ID: 0c90559da91bd831cd3dab65bf3bbea139e12f2d0966ec066b35a1c3824bc043
Opcode Fuzzy Hash: 84fde1eb2596e27518b9b66f74fad4f568d33ae02a80d8bcb14e35c8c4c33197
Instruction Fuzzy Hash: 1C4191317042059BCB318FA4AC44AEB3BA5EB59750B600226FB45E2270D77988D7DB6D

Function 0041B5F1 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoA.KERNEL32(?), ref: 0041B64E
GetFileType.KERNEL32(?), ref: 0041B6F8
GetStdHandle.KERNEL32(-000000F6), ref: 0041B779

Strings

DB, xrefs: 0041B68B

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: FileHandleInfoStartupType
String ID: DB
API String ID: 2461013171-3807777182
Opcode ID: 63b2d08512decfe744177ba38bf9fb7207bbc92b537ac15aace0e44b3773ae25
Instruction ID: 5a94dd12d3dea06ee2feb2cc53fbe35cbf2be88284841c6ab5255a4807d3c723
Opcode Fuzzy Hash: 63b2d08512decfe744177ba38bf9fb7207bbc92b537ac15aace0e44b3773ae25
Instruction Fuzzy Hash: 6D51E4716043018FD7208F79DC847A677E4EB95324F288A2ED5B6CB2E1D738D486C79A

Function 00417BCA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 13
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(mscoree.dll,00417D38,?,00424FE8,00000008,00417D6F,?,00000001,00000000,0041E5D6,00000003), ref: 00417BCF
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00417BDF
ExitProcess.KERNEL32 ref: 00417BF3

Strings

CorExitProcess, xrefs: 00417BD9
mscoree.dll, xrefs: 00417BCA

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: AddressExitHandleModuleProcProcess
String ID: CorExitProcess$mscoree.dll
API String ID: 75539706-1276376045
Opcode ID: 9e11737825365e066570363eff612e26edf7107d7f04036a6dcc465d1b32afbd
Instruction ID: dff2a8c5571777d997ac6d4ed434b35aa53ae8b83b5507574e0483bba6655685
Opcode Fuzzy Hash: 9e11737825365e066570363eff612e26edf7107d7f04036a6dcc465d1b32afbd
Instruction Fuzzy Hash: 0AD0C93070C241AFEB206BB1ED09E1B3AA4FFC0B467854425F815D42B0CF38D891AA2D

Function 0040BEED Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 289
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0040BEF2

Part of subcall function 00401403: __EH_prolog.LIBCMT ref: 00401408

GetCurrentDirectoryW.KERNEL32(00000104,?,00000001,?,00000000,?,?,?,?,00000001,?,?), ref: 0040C0B6

Part of subcall function 004067E9: __EH_prolog.LIBCMT ref: 004067EE

Part of subcall function 00406AB8: GetFileAttributesW.KERNELBASE(-00000004,0040133F,?,?), ref: 00406AC7

Part of subcall function 0040F3F5: __EH_prolog.LIBCMT ref: 0040F3FA

Part of subcall function 0040F43C: __EH_prolog.LIBCMT ref: 0040F441
Part of subcall function 0040F43C: GetModuleHandleW.KERNEL32(00000000,00000000,?,00000100,00426B8C,?,00000000), ref: 0040F47F
Part of subcall function 0040F43C: LoadStringW.USER32(00000000), ref: 0040F486

Part of subcall function 0040F326: __EH_prolog.LIBCMT ref: 0040F32B

Part of subcall function 0040F376: __EH_prolog.LIBCMT ref: 0040F37B

Part of subcall function 00415747: KiUserExceptionDispatcher.NTDLL(?,?,00401278,004281F4,?,/A,?,?,?,00413083,00401278,004281F4,0042D4A8,00401278,00401278,?), ref: 00415775

Strings

exe, xrefs: 0040BF8A
.lax, xrefs: 0040BFE7, 0040C058, 0040C14A

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: H_prolog$AttributesCurrentDirectoryDispatcherExceptionFileHandleLoadModuleStringUser
String ID: .lax$exe
API String ID: 1625219707-1957734886
Opcode ID: b34d59570a1f93907e5c1e6b900ee7657ec6f6ff04d6baf857576de4f1375eee
Instruction ID: aa5d85868ac0a78d6ec3a13113cac6e50dcdc1d7307bac46abc1698d67d1b479
Opcode Fuzzy Hash: b34d59570a1f93907e5c1e6b900ee7657ec6f6ff04d6baf857576de4f1375eee
Instruction Fuzzy Hash: C5A1B371D04218AACF00EBE5CC82ADE7B78AF05304F10817FF910B71D2DB785A498BA9

Function 00402979 Relevance: 6.1, APIs: 4, Instructions: 78
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0040297E

Part of subcall function 0040F3F5: __EH_prolog.LIBCMT ref: 0040F3FA

Part of subcall function 0040F43C: __EH_prolog.LIBCMT ref: 0040F441
Part of subcall function 0040F43C: GetModuleHandleW.KERNEL32(00000000,00000000,?,00000100,00426B8C,?,00000000), ref: 0040F47F
Part of subcall function 0040F43C: LoadStringW.USER32(00000000), ref: 0040F486

GetStdHandle.KERNEL32(000000F4), ref: 00402A24
lstrlenW.KERNEL32(00000000,00000000,00000000), ref: 00402A37
WriteConsoleW.KERNELBASE(00000000,00000000,00000000), ref: 00402A46

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: H_prolog$Handle$ConsoleLoadModuleStringWritelstrlen
String ID:
API String ID: 2839003670-0
Opcode ID: 8e336697ad5142aa8815cc7adf89ab167a23bd38a681d37e9c415b90ec877e12
Instruction ID: 9d8bfae1d112d749d917fe8b20fabb6931b966bb80358f871ccd41f33f339e6c
Opcode Fuzzy Hash: 8e336697ad5142aa8815cc7adf89ab167a23bd38a681d37e9c415b90ec877e12
Instruction Fuzzy Hash: 24213573A00218BADB10EBE4DC49FDE7368AF18325F50457BF605B60D1DB78E6848B59

Function 0040DA80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71
keyboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0040DA85

Part of subcall function 00410F3B: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,0040DA9B,00000000,?), ref: 00410F4E
Part of subcall function 00410F3B: GetProcAddress.KERNEL32(00000000), ref: 00410F55
Part of subcall function 00410F3B: GetCurrentProcess.KERNEL32(00000000,?,?,0040DA9B,00000000,?), ref: 00410F65

Part of subcall function 00401395: __EH_prolog.LIBCMT ref: 0040139A

Part of subcall function 0040BC90: __EH_prolog.LIBCMT ref: 0040BC95
Part of subcall function 0040BC90: GetCurrentDirectoryW.KERNEL32(00000104,?,?,?,?,00000000), ref: 0040BCFA

Part of subcall function 0040BDF5: __EH_prolog.LIBCMT ref: 0040BDFA
Part of subcall function 0040BDF5: WaitForSingleObject.KERNEL32(00000000,000000FF,?,?), ref: 0040BEBF
Part of subcall function 0040BDF5: GetExitCodeProcess.KERNEL32(?,?), ref: 0040BECC

Part of subcall function 0040D85B: __EH_prolog.LIBCMT ref: 0040D860

GetKeyState.USER32(00000011), ref: 0040DB30

Strings

[press enter to close this window], xrefs: 0040DB3B

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: H_prolog$CurrentProcess$AddressCodeDirectoryExitHandleModuleObjectProcSingleStateWait
String ID: [press enter to close this window]
API String ID: 183739109-2096780919
Opcode ID: 885b697ad820a58aae98a06aa0c51c95854284fe6643e8fd198eb8955f7ec925
Instruction ID: 33bfe0f19483b0e39373e5f7727ff1bf281ced3f1f700108c7e5d37b4ac19dc3
Opcode Fuzzy Hash: 885b697ad820a58aae98a06aa0c51c95854284fe6643e8fd198eb8955f7ec925
Instruction Fuzzy Hash: 3D219271E042489ACF10FBE5D5467DDB7B8AF04308F0044AFE11577181CBB85A89CBAE

Function 00415747 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL(?,?,00401278,004281F4,?,/A,?,?,?,00413083,00401278,004281F4,0042D4A8,00401278,00401278,?), ref: 00415775

Strings

/A, xrefs: 00415750

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID: /A
API String ID: 6842923-4160151031
Opcode ID: f08c6ecc858754770d08fa34b19157eda95fe8494b5390995d4a84d93febb9b8
Instruction ID: fc26b3cf50d0a34a08d36ca047944ad2759772b6f73facf253fad043e85ceed7
Opcode Fuzzy Hash: f08c6ecc858754770d08fa34b19157eda95fe8494b5390995d4a84d93febb9b8
Instruction Fuzzy Hash: 25E0E536E0011CABCF11DF99EC449DEBBB9FB89310F408026FA14A7150D774AA55DBA4

Function 0040BC90 Relevance: 3.1, APIs: 2, Instructions: 104
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0040BC95

Part of subcall function 00401395: __EH_prolog.LIBCMT ref: 0040139A

Part of subcall function 0040C25F: __EH_prolog.LIBCMT ref: 0040C264

GetCurrentDirectoryW.KERNEL32(00000104,?,?,?,?,00000000), ref: 0040BCFA

Part of subcall function 004067E9: __EH_prolog.LIBCMT ref: 004067EE

Part of subcall function 00406B1E: __EH_prolog.LIBCMT ref: 00406B23

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: H_prolog$CurrentDirectory
String ID:
API String ID: 730206648-0
Opcode ID: 5ca349435eb70097b2258bc4e512ecd40886a0f68d72b5190f26737569517e49
Instruction ID: d402d18aa3206320871a9d085a75376e2ece34b4051101a5d93a8e7ef23390ca
Opcode Fuzzy Hash: 5ca349435eb70097b2258bc4e512ecd40886a0f68d72b5190f26737569517e49
Instruction Fuzzy Hash: AD416071D01254EFCB00EFE9C946A8EBBB4AF14308F50456EF945B7691C778AA08C7E6

Function 005704AB Relevance: 3.0, APIs: 2, Instructions: 33
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 005704BA
GetProcAddress.KERNEL32(?,00000000), ref: 005704DC

Memory Dump Source

Source File: 00000000.00000002.2044215172.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: bfec523b0a34fb97738a06bdfbcae2ff6c25c63efdf5a5add7696fe588be8235
Instruction ID: 047bff9cb7e18dfa674330279a8f077aede19c0c72be186793bbe8ac163fa0c5
Opcode Fuzzy Hash: bfec523b0a34fb97738a06bdfbcae2ff6c25c63efdf5a5add7696fe588be8235
Instruction Fuzzy Hash: 86F0BE77600200DBCB10CF18DC809AAB7F2FF942653298879D94A97304D239BD159A10

Function 00570C74 Relevance: 3.0, APIs: 2, Instructions: 30
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,00001000,00000004,?,?), ref: 00570C9F
VirtualProtect.KERNEL32(?,00001000,?,?), ref: 00570CB8

Memory Dump Source

Source File: 00000000.00000002.2044215172.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 559bbdefaf15e456d605dae105da3aef4e62acee13071953ca7ff870281ea4d7
Instruction ID: 0db10f7f7f2d54f55655ab94cb51b4411e090399127f33dd5203920eb90523f5
Opcode Fuzzy Hash: 559bbdefaf15e456d605dae105da3aef4e62acee13071953ca7ff870281ea4d7
Instruction Fuzzy Hash: 15F08276200305AFDB18CF40C844FDE77B9EB44390F10457AEE42AB684C6B0FA148B50

Function 0041A748 Relevance: 3.0, APIs: 2, Instructions: 26
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,00415092,00000001,?,004247B8,00000018), ref: 0041A759

Part of subcall function 0041A799: RtlAllocateHeap.NTDLL(00000000,00000140,0041A781), ref: 0041A7A6

HeapDestroy.KERNEL32(?,004247B8,00000018), ref: 0041A78C

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: Heap$AllocateCreateDestroy
String ID:
API String ID: 316229882-0
Opcode ID: 39ae5f4eeaed9afa3268c597e5104310a47ecb4a8cb57128d404ec35618bc741
Instruction ID: 29a8363419bf7b76235f3d31d64908f01075f94bc863d2ba34fc8903b1f2bd0c
Opcode Fuzzy Hash: 39ae5f4eeaed9afa3268c597e5104310a47ecb4a8cb57128d404ec35618bc741
Instruction Fuzzy Hash: 7CE012B47513019ADB31AB316C097A636E4D744795F44483BB515C51E0FB74CAA1DA0A

Function 00570304 Relevance: 2.7, APIs: 2, Instructions: 165
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040,?), ref: 00570372
VirtualFree.KERNELBASE(?,00000000,00008000,?), ref: 0057048D

Memory Dump Source

Source File: 00000000.00000002.2044215172.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 75ee3d0b778d5b05149a3ae5ecd3ba9b1428b0f0e8eca6b4ea6447106af3b3cb
Instruction ID: 56d2c70ce93c96dd1f7f2cdaad45c014646a7c7cb1758af585f1f096454574e2
Opcode Fuzzy Hash: 75ee3d0b778d5b05149a3ae5ecd3ba9b1428b0f0e8eca6b4ea6447106af3b3cb
Instruction Fuzzy Hash: A341BD72601746DFDB389F14DC88AEB77E9FF49341F009229EE0A97284DB70A915CB91

Function 0040C25F Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0040C264

Part of subcall function 0040BEED: __EH_prolog.LIBCMT ref: 0040BEF2

Part of subcall function 0040E3F9: __EH_prolog.LIBCMT ref: 0040E3FE

Part of subcall function 0040D0D0: __EH_prolog.LIBCMT ref: 0040D0D5

Part of subcall function 0040CFE8: __EH_prolog.LIBCMT ref: 0040CFED

Part of subcall function 0040D05C: __EH_prolog.LIBCMT ref: 0040D061

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: ed2d833c2c01b4da2502007d4f2e884085fd53661ec2e5d61c149da5b6e70a9b
Instruction ID: 153bbef9904f94461048ff2239cbac7d85ecf114c63dfe1336c169005aaec7e1
Opcode Fuzzy Hash: ed2d833c2c01b4da2502007d4f2e884085fd53661ec2e5d61c149da5b6e70a9b
Instruction Fuzzy Hash: 7331A071D01218AADB11EBE9D986FEFBB78AF41314F10417FF900B31C2D7785A0986A6

Function 00406AB8 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(-00000004,0040133F,?,?), ref: 00406AC7

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 5739bada32f22a109928ef0f35d511c0d226d86ad391682a40321510bc55c7e5
Instruction ID: afdddf1bddbb1ab465564c3f3ad37a78e02770f96a7cb6d62cdc45e823ba6929
Opcode Fuzzy Hash: 5739bada32f22a109928ef0f35d511c0d226d86ad391682a40321510bc55c7e5
Instruction Fuzzy Hash: E9C080766201008FCA089B34CD8C84D32506B4737533B8675D033FB1F0D234D555DE59

Function 00570C2A Relevance: 1.5, APIs: 1, Instructions: 9libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?), ref: 00570C34

Memory Dump Source

Source File: 00000000.00000002.2044215172.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a5954c49c222c1f3ec350f8a32cdbddcbdba2b08294a8bc0e7c3682721ad8435
Instruction ID: 8f64b75de0c81256e1979021028c1f10525bd8a4958c5d9d15c0b9e525517119
Opcode Fuzzy Hash: a5954c49c222c1f3ec350f8a32cdbddcbdba2b08294a8bc0e7c3682721ad8435
Instruction Fuzzy Hash: A1B0923321020597DB015F68E5C88CD7B21DBA42E63104133EA02980589B76C0218650

Non-executed Functions

Function 00408E5D Relevance: 39.2, APIs: 1, Strings: 21, Instructions: 738COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00408E62

Part of subcall function 00408CB0: __EH_prolog.LIBCMT ref: 00408CB5

Part of subcall function 0040E1D8: __EH_prolog.LIBCMT ref: 0040E1DD

Part of subcall function 00408B42: __EH_prolog.LIBCMT ref: 00408B47

Part of subcall function 004046BD: __EH_prolog.LIBCMT ref: 004046C2

Strings

jre.exe, xrefs: 004096C9
\jrew.exe, xrefs: 0040975B
SOFTWARE\JavaSoft\Java Runtime Environment, xrefs: 00409092
\server, xrefs: 00409389
\..\jre\bin\client, xrefs: 00409323
system32, xrefs: 00408FA0
\pack200.exe, xrefs: 00409244
SOFTWARE\JavaSoft\Java Runtime Environment\, xrefs: 004090DF
Sun, xrefs: 00408EBF
\hotspot, xrefs: 00409527
\..\jre\bin\hotspot, xrefs: 00409587
CurrentVersion, xrefs: 004090B8, 004090BD, 00409158
, xrefs: 00409604
\classic, xrefs: 00409652
\client, xrefs: 004092BE
MicroVersion, xrefs: 0040912C
syswow64, xrefs: 00408FF1
\jre.exe, xrefs: 004096FB
\..\jre\bin\server, xrefs: 004093EB
, xrefs: 004094DC
jrew.exe, xrefs: 004096E1

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: H_prolog
String ID: $ $CurrentVersion$MicroVersion$SOFTWARE\JavaSoft\Java Runtime Environment$SOFTWARE\JavaSoft\Java Runtime Environment\$Sun$\..\jre\bin\client$\..\jre\bin\hotspot$\..\jre\bin\server$\classic$\client$\hotspot$\jre.exe$\jrew.exe$\pack200.exe$\server$jre.exe$jrew.exe$system32$syswow64
API String ID: 3519838083-2804910554
Opcode ID: ad77efde9717963f197c8d73ed4a1803274c2f54aeb37501d807ef3e862fc48b
Instruction ID: 1e7507257cd746e7733ca94bec581c81114ef3e80147510d26ece64c8374395f
Opcode Fuzzy Hash: ad77efde9717963f197c8d73ed4a1803274c2f54aeb37501d807ef3e862fc48b
Instruction Fuzzy Hash: 8452D471D003599ADB11EBA9C946BEEBBB49F05308F0441AFE940771C2C7BC5F498BA9

Function 0041F805 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 90libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,00425548,?,?), ref: 0041F81D
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 0041F839
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 0041F84A
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 0041F857
GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA), ref: 0041F86D
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 0041F87E

Strings

GetUserObjectInformationA, xrefs: 0041F867
GetLastActivePopup, xrefs: 0041F84C
user32.dll, xrefs: 0041F818
MessageBoxA, xrefs: 0041F833
GetProcessWindowStation, xrefs: 0041F878
GetActiveWindow, xrefs: 0041F844

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$user32.dll
API String ID: 2238633743-1612076079
Opcode ID: 1b231eca6e6ca0c4fbf13ecb73712b2d1c72790d6bdb087e815c357667c05b9b
Instruction ID: f461a004f676de98019ce9aad15efb724ad5c86a7e1fd8c3f073d35a5d6cb6a3
Opcode Fuzzy Hash: 1b231eca6e6ca0c4fbf13ecb73712b2d1c72790d6bdb087e815c357667c05b9b
Instruction Fuzzy Hash: 1E21A931B003169ED725BB75AC85BAB3BE8A784754B940037E511D1150E7B8C48BDB6D

Function 0040C8E0 Relevance: 12.7, APIs: 1, Strings: 6, Instructions: 481COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040C8E5

Part of subcall function 004067E9: __EH_prolog.LIBCMT ref: 004067EE

Part of subcall function 0040D275: __EH_prolog.LIBCMT ref: 0040D27A

Part of subcall function 004066D8: __EH_prolog.LIBCMT ref: 004066DD

Part of subcall function 00406883: __EH_prolog.LIBCMT ref: 00406888

Part of subcall function 00406B1E: __EH_prolog.LIBCMT ref: 00406B23

Part of subcall function 0040265A: __EH_prolog.LIBCMT ref: 0040265F

Part of subcall function 0040B169: __EH_prolog.LIBCMT ref: 0040B16E

Strings

class, xrefs: 0040CC8C, 0040CCA3, 0040CCA8
-Xrs, xrefs: 0040CD07
none, xrefs: 0040CCB5
invalid verbosity selection '%s', disabling verbosity., xrefs: 0040CCD0
all, xrefs: 0040CC6F
normal, xrefs: 0040CC5E

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: H_prolog
String ID: -Xrs$all$class$invalid verbosity selection '%s', disabling verbosity.$none$normal
API String ID: 3519838083-1137796707
Opcode ID: 65b96c86cf66e314cf1757d1438fbc2e78f0dcfbfcbd1cb8841867d56b0804e3
Instruction ID: 3786e9a0fd1b39570c77000879a2f1eb8e3a88523833ee977a5fe2df0359dabc
Opcode Fuzzy Hash: 65b96c86cf66e314cf1757d1438fbc2e78f0dcfbfcbd1cb8841867d56b0804e3
Instruction Fuzzy Hash: 12026071D01258EADB00EBE5CD46BDEBB78AF05304F10417EF905B71D2D7796A088BAA

Function 0041D992 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 86COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,?,?,?), ref: 0041D9D0
_strncpy.LIBCMT ref: 0041DA60

Strings

1252, xrefs: 0041DA03
ESP, xrefs: 0041DA2D
850, xrefs: 0041DA23
ESP, xrefs: 0041DA37
040a, xrefs: 0041DA41

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: InfoLocale_strncpy
String ID: 040a$1252$850$ESP$ESP
API String ID: 4025304676-1770330732
Opcode ID: 3e06e7d6357553c01a8415e5c1f8fe8cb37d89f2423108b310a2b083ae67bd02
Instruction ID: fcff750a64bcb8d57de21672546242907468af35653cd2e723ae3371f8b67390
Opcode Fuzzy Hash: 3e06e7d6357553c01a8415e5c1f8fe8cb37d89f2423108b310a2b083ae67bd02
Instruction Fuzzy Hash: 5821F7F2A28406DBC7188E38D985AF67799EF84380B484077D402CB6A0E739EA85C25D

Function 0041DFC3 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

APIs

_TranslateName.LIBCMT ref: 0041E01E
_TranslateName.LIBCMT ref: 0041E067
IsValidLocale.KERNEL32(00000001), ref: 0041E0E1
_strcat.LIBCMT ref: 0041E124

Part of subcall function 0041DEB1: _strlen.LIBCMT ref: 0041DEB7
Part of subcall function 0041DEB1: EnumSystemLocalesA.KERNEL32(0041DAC7,00000001,00000000,0042C860,0041604A,?,0042D670,?,?,00000000,?), ref: 0041DED1

Strings

Norwegian-Nynorsk, xrefs: 0041E11E

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: NameTranslate$EnumLocaleLocalesSystemValid_strcat_strlen
String ID: Norwegian-Nynorsk
API String ID: 3343657701-461349085
Opcode ID: 46ca81f3c00113f2b475bfc71713a8c729927825085ef0e21a4e1548ae9b7a50
Instruction ID: cd137ce7416f07200242538995aa878f17d1052f24cc2e7959a146a5af76368f
Opcode Fuzzy Hash: 46ca81f3c00113f2b475bfc71713a8c729927825085ef0e21a4e1548ae9b7a50
Instruction Fuzzy Hash: 174196B9F40250AAD730BF339C41AEA3BE1AB08740B55447FE95597260D6788CC6CB1E

Function 0041F8FE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 97COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0041F92D
GetLocaleInfoA.KERNEL32(00000001,?,00000000,00000000,00426770,00000018,0041CC85,?,0042D84C,0042D808,00000004,00000000,00000000), ref: 0041F986
GetLocaleInfoA.KERNEL32(?,?,?,HXA), ref: 0041F9ED
MultiByteToWideChar.KERNEL32(?,00000001,?,000000FF,?,?,?,HXA), ref: 0041FA0D

Strings

HXA, xrefs: 0041F9E3, 0041F9D1

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: InfoLocale$ByteCharErrorLastMultiWide
String ID: HXA
API String ID: 97497842-4067533616
Opcode ID: f299f82d3cb0aee308ed8d7c8e9664a884abb312edf329b530f6124863416277
Instruction ID: 2609baf4c6197403248c23d45fb5098ceca742346116a0635a6d4264128fa2d7
Opcode Fuzzy Hash: f299f82d3cb0aee308ed8d7c8e9664a884abb312edf329b530f6124863416277
Instruction Fuzzy Hash: D53190B1A10205EFCF21AF51DC459EF7BB5FF84360B60413AF525A2260D3388D96DB99

Function 0041E627 Relevance: 7.6, APIs: 5, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0041E641
GetSystemInfo.KERNEL32(?,?,?,0000001C), ref: 0041E652
VirtualQuery.KERNEL32(?,?,0000001C,?,?,0000001C), ref: 0041E698
VirtualAlloc.KERNEL32(?,?,00001000,00000004,?,?,0000001C), ref: 0041E6D6
VirtualProtect.KERNEL32(?,?,00000002,?,?,?,0000001C), ref: 0041E6FC

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: Virtual$Query$AllocInfoProtectSystem
String ID:
API String ID: 4136887677-0
Opcode ID: a24f57d7ac257a25a86c5fb8c3e8046e59f1fd459f5daca52648b4e8a305ee4c
Instruction ID: ea47f9a0727f87aa8895d56aa1d9a993ecc454d9ff0b40fb471b75b3be788f3e
Opcode Fuzzy Hash: a24f57d7ac257a25a86c5fb8c3e8046e59f1fd459f5daca52648b4e8a305ee4c
Instruction Fuzzy Hash: 5131E336E00219EBDF20CBA5DD45AEEBBB8EB04710F940166ED01E3290D7349E81CB98

Function 0041E429 Relevance: 7.5, APIs: 5, Instructions: 32timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0041E444
GetCurrentProcessId.KERNEL32 ref: 0041E450
GetCurrentThreadId.KERNEL32 ref: 0041E458
GetTickCount.KERNEL32 ref: 0041E460
QueryPerformanceCounter.KERNEL32(?), ref: 0041E46C

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 55d847e21f13af51a80f00a8b1b3df130785a90897a5857553846a2978548ae0
Instruction ID: 4ec97b83fc5e33799ff628e0ea3e2e39106a2f3e4376b37c9a73efe8360858c0
Opcode Fuzzy Hash: 55d847e21f13af51a80f00a8b1b3df130785a90897a5857553846a2978548ae0
Instruction Fuzzy Hash: EFF0FF75E011249BCB20DBF4ED8C99EBBF8FF5C341BC20561D841E7110EB3499D18A88

Function 0041F9BA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 0041E627: VirtualQuery.KERNEL32(?,?,0000001C), ref: 0041E641
Part of subcall function 0041E627: GetSystemInfo.KERNEL32(?,?,?,0000001C), ref: 0041E652
Part of subcall function 0041E627: VirtualQuery.KERNEL32(?,?,0000001C,?,?,0000001C), ref: 0041E698

GetLocaleInfoA.KERNEL32(?,?,?,HXA), ref: 0041F9ED
MultiByteToWideChar.KERNEL32(?,00000001,?,000000FF,?,?,?,HXA), ref: 0041FA0D

Strings

HXA, xrefs: 0041F9E3, 0041F9D1

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: InfoQueryVirtual$ByteCharLocaleMultiSystemWide
String ID: HXA
API String ID: 2568233206-4067533616
Opcode ID: e8805e89830c256780e75dfd49b6eab8dc292b8e7cf01b704d6499840af37c51
Instruction ID: f890c634e2f2b62ddcc6733a3c571df3486c7ddb9e8042bc820a497a2e2ce928
Opcode Fuzzy Hash: e8805e89830c256780e75dfd49b6eab8dc292b8e7cf01b704d6499840af37c51
Instruction Fuzzy Hash: 73018435D00119AACF21AF65DC058EF7B74EF443A4B20423AF829721A0D6394D92CA98

Function 0041FA2E Relevance: 4.6, APIs: 3, Instructions: 102COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0041FA5D
WideCharToMultiByte.KERNEL32(58301C42,00000000,?,000000FF,0042D84C,00001004,00000000,00000000,?,00000000), ref: 0041FB39

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: ecb690969d840d88b5e21ee8166899d658a695c2cb9d50e7c72d7893cfd9a751
Instruction ID: d264ab06b22957c04969c53c92380e3cf6eab7006ad77897310d6261ea8e4fee
Opcode Fuzzy Hash: ecb690969d840d88b5e21ee8166899d658a695c2cb9d50e7c72d7893cfd9a751
Instruction Fuzzy Hash: E5318B71A01129EBCF228F60DC458DF7F75FF497A0B20412AF81996260C73899D7DBA9

Function 0041DEE8 Relevance: 4.5, APIs: 3, Instructions: 36COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0041DEEE
_strlen.LIBCMT ref: 0041DF06
EnumSystemLocalesA.KERNEL32(0041DBCC,00000001,00000000,?), ref: 0041DF4D

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: _strlen$EnumLocalesSystem
String ID:
API String ID: 2581538701-0
Opcode ID: b6852d7dda244e997bbf7e880fc0be9f0975f65cb06160938d9859bebf83c3c3
Instruction ID: 0702a00514c3aafb615b34d9b3769d4030597a14b277264647cda93da92d2ab5
Opcode Fuzzy Hash: b6852d7dda244e997bbf7e880fc0be9f0975f65cb06160938d9859bebf83c3c3
Instruction Fuzzy Hash: C3F03CF0E502059AE720BF3AED097A137E1E750755F9046BAE422832E0D77885C3CA0C

Function 0041DF6E Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0041DF74
EnumSystemLocalesA.KERNEL32(0041DDE6,00000001,00000000,0042C860,0041604A,?,0042D670,?,?,00000000,?), ref: 0041DFAC

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: EnumLocalesSystem_strlen
String ID:
API String ID: 216762292-0
Opcode ID: 6317b2421eef26f11bd6730e82801faf01399a2e8dab33f1138cea39d251ff1d
Instruction ID: 836338381e67184d1acc1d9d344789029c3326f49940fb130e2f5c5fa72e689a
Opcode Fuzzy Hash: 6317b2421eef26f11bd6730e82801faf01399a2e8dab33f1138cea39d251ff1d
Instruction Fuzzy Hash: A4E0E5F4F642448AF720BF36EC097A13BE1E751B59F90457AE125862A5C6788587CF0C

Function 0041DEB1 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0041DEB7
EnumSystemLocalesA.KERNEL32(0041DAC7,00000001,00000000,0042C860,0041604A,?,0042D670,?,?,00000000,?), ref: 0041DED1

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: EnumLocalesSystem_strlen
String ID:
API String ID: 216762292-0
Opcode ID: 726c762c6823e505d628f4d448feae2f631e1cc86f870dc2ba129b2068ce0b81
Instruction ID: fd240acc032a9ae4fea5ce65b405e498eeb3caa07eb0e858c1abcf3796dfac24
Opcode Fuzzy Hash: 726c762c6823e505d628f4d448feae2f631e1cc86f870dc2ba129b2068ce0b81
Instruction Fuzzy Hash: B9D017F1F502494AEB20AF32AC097603BA0E710B59F90856ADA20810E0C2684486CE08

Function 0041E70A Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00001004,00000100,00000006,00000100,?,00000000), ref: 0041E72A

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 925e746eabc221decdbc9e9e082074dc6d03278b5161c81548eadf1625223a08
Instruction ID: 9cb02bf14380981e35eb23f64719fc579559cb455c1f9affca35b4a72235ef09
Opcode Fuzzy Hash: 925e746eabc221decdbc9e9e082074dc6d03278b5161c81548eadf1625223a08
Instruction Fuzzy Hash: BBE09234A04248BBDB10EBA9D946ADD77B8AF04318F004166E920D61C0E774DA849759

Function 0041C9BA Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001C96C), ref: 0041C9BF

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: d5e9ba3343babe47f27c1d571ded0ca08a4559d1853762f43ed62b6e3b856b78
Instruction ID: 45a6559ba246d889c86a391612fbc2f0de7a6bcbab8338f82b9c31e7a93365f4
Opcode Fuzzy Hash: d5e9ba3343babe47f27c1d571ded0ca08a4559d1853762f43ed62b6e3b856b78
Instruction Fuzzy Hash: 7EA011F0FA02008B8320AF30AC0A2003AA0B280B023A08832E020E22A0EB3000828A28

Function 0041C9CE Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 0041C9D3

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: e520a69d72f939327004755c6cdb161dcc9447a40bfe95765f14ce720f44e939
Instruction ID: d384b32fab9d0e98b6ba67db07e9e642d87e4e52d418467f06550871bb826b39
Opcode Fuzzy Hash: e520a69d72f939327004755c6cdb161dcc9447a40bfe95765f14ce720f44e939
Instruction Fuzzy Hash:

Function 004166FC Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 024c9f906ae4236277169058adc02ea42a03c649ac394ae48955fdc2ddf9ef4e
Instruction ID: a5f6a17643e4fa30bc47168d3e8fb17364691485aa0e7ac4bdeeed75f1edabbc
Opcode Fuzzy Hash: 024c9f906ae4236277169058adc02ea42a03c649ac394ae48955fdc2ddf9ef4e
Instruction Fuzzy Hash: 2B2128769002049FCB10DF69C8C08EBBBA9FF44314B4A85A9EC298B285D734F955CBE0

Function 00413F00 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 191ea19e4b8869d48a227b63d809db1a2faabff5766256ba2e53543e8d03c347
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 33115E77A0508187D6048E2DC4B86F7A3B5EBC532772C437BE0454B744C22A9BC7960C

Function 00411C6E Relevance: 31.7, APIs: 11, Strings: 7, Instructions: 214libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000001,?,00000002), ref: 00411C98
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00411CB6
GetWindowsDirectoryA.KERNEL32(?,00000104,?,00000002), ref: 00411CCE
GetModuleFileNameA.KERNEL32(?,?,00000104,?,00000002), ref: 00411CEF
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00000002), ref: 00411D04
GetModuleFileNameA.KERNEL32(00000000,?,00000002), ref: 00411D0B
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000002), ref: 00411DFA
LoadLibraryA.KERNEL32(advapi32.dll,?,00000002), ref: 00411E11
InterlockedExchange.KERNEL32(0042C084,00000000), ref: 00411E1F
FreeLibrary.KERNEL32(00000000,?,00000002), ref: 00411E2A
LoadLibraryA.KERNEL32(?,?,00000105,?,00000105,\Microsoft Shared\MSLU\,?,00000002), ref: 00411F02

Part of subcall function 00411ADC: CompareStringA.KERNEL32(00000409,00000001,?,000000FF,?,000000FF,00411DAE,?,?,?,?,?,?,?,?), ref: 00411AEF

Strings

RegQueryValueExA, xrefs: 00411E48
RegOpenKeyExA, xrefs: 00411E3D
RegCloseKey, xrefs: 00411E5A
CommonFilesDir, xrefs: 00411EAE
advapi32.dll, xrefs: 00411E0C
\Microsoft Shared\MSLU\, xrefs: 00411EC9
SOFTWARE\Microsoft\Windows\CurrentVersion, xrefs: 00411E91

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: Library$LoadModule$DirectoryFileFreeName$CompareExchangeHandleInterlockedStringSystemWindows
String ID: CommonFilesDir$RegCloseKey$RegOpenKeyExA$RegQueryValueExA$SOFTWARE\Microsoft\Windows\CurrentVersion$\Microsoft Shared\MSLU\$advapi32.dll
API String ID: 1518379172-4255789690
Opcode ID: 3c0a9924227e0c389fd7c83340b232a980eca20ab4ad9404eefbc85813d9a1e1
Instruction ID: bf8dba9fe5d8057f1bd1042d01fa7e3f7f38df035f26281d1a3cce4626a7edfb
Opcode Fuzzy Hash: 3c0a9924227e0c389fd7c83340b232a980eca20ab4ad9404eefbc85813d9a1e1
Instruction Fuzzy Hash: BE714271A0411DAACF219BA1DC94EDF7BBCEB44344F5400AAE705E3121E7389BC9CB58

Function 0041C251 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 115fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,00000000,00000000), ref: 0041C2D2
_strcat.LIBCMT ref: 0041C2E5
_strlen.LIBCMT ref: 0041C2F2
_strlen.LIBCMT ref: 0041C301
_strncpy.LIBCMT ref: 0041C318
_strlen.LIBCMT ref: 0041C321
_strlen.LIBCMT ref: 0041C32E
_strcat.LIBCMT ref: 0041C34C
_strlen.LIBCMT ref: 0041C394
GetStdHandle.KERNEL32(000000F4,004254F8,00000000,?,00000000,00000000,00000000,00000000), ref: 0041C39F
WriteFile.KERNEL32(00000000), ref: 0041C3A6

Strings

..., xrefs: 0041C312
<program name unknown>, xrefs: 0041C2DF
Microsoft Visual C++ Runtime Library, xrefs: 0041C374
Runtime Error!Program: , xrefs: 0041C346

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: _strlen$File_strcat$HandleModuleNameWrite_strncpy
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3601721357-4022980321
Opcode ID: a30abcc432c2e45fd032e7e6496d7d7e29cb15107122b72e532235b00301d4ae
Instruction ID: 1fddcb1e1ddfe32f19bcc109b3d1b12d8b5b6a08c62580432a5a4107ef04f6c5
Opcode Fuzzy Hash: a30abcc432c2e45fd032e7e6496d7d7e29cb15107122b72e532235b00301d4ae
Instruction Fuzzy Hash: 5E310772680218AADB30ABB59CC2FEF3769EB44314F50441FF925D7192DA3C99D1872C

Function 0041E48F Relevance: 26.3, APIs: 7, Strings: 8, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,004266C0,00000118,0041681E,00000001,00000000,00424A00,00000008,0041C3BD,00000000,00000000,00000000), ref: 0041E510
_strcat.LIBCMT ref: 0041E526
_strlen.LIBCMT ref: 0041E536
_strlen.LIBCMT ref: 0041E547
_strncpy.LIBCMT ref: 0041E561
_strlen.LIBCMT ref: 0041E56A
_strcat.LIBCMT ref: 0041E586

Strings

..., xrefs: 0041E55B
Unknown security failure detected!, xrefs: 0041E4D6
A buffer overrun has been detected which has corrupted the program'sinternal state. The program cannot safely continue execution and mustnow be terminated., xrefs: 0041E4F1
<program name unknown>, xrefs: 0041E51A
Program: , xrefs: 0041E597
Microsoft Visual C++ Runtime Library, xrefs: 0041E5C1
Buffer overrun detected!, xrefs: 0041E4EC, 0041E584
A security error of unknown cause has been detected which hascorrupted the program's internal state. The program cannot safelycontinue execution and must now be terminated., xrefs: 0041E4DB

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: _strlen$_strcat$FileModuleName_strncpy
String ID: ...$<program name unknown>$A buffer overrun has been detected which has corrupted the program'sinternal state. The program cannot safely continue execution and mustnow be terminated.$A security error of unknown cause has been detected which hascorrupted the program's internal state. The program cannot safelycontinue execution and must now be terminated.$Buffer overrun detected!$Microsoft Visual C++ Runtime Library$Program: $Unknown security failure detected!
API String ID: 3058806289-1010210193
Opcode ID: 60d77464501a9c87ce5a5a4acf8a3e58da9fd716d5b7b33f3a5cf4a03843a69e
Instruction ID: b31c63fd2c4f207a6329aac71f92bc0296f23ba8f879f6509e6fdeaeceee581e
Opcode Fuzzy Hash: 60d77464501a9c87ce5a5a4acf8a3e58da9fd716d5b7b33f3a5cf4a03843a69e
Instruction Fuzzy Hash: C331C771B41214BAC711ABA1AC42EDF37AA9F04314F50449BF510AA282DB3CDFD14BAD

Function 00418B98 Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 71libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000000,?,004150A4,?,004247B8,00000018), ref: 00418BB0
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00418BC8
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00418BD5
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00418BE2
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00418BEF
FlsAlloc.KERNEL32(00418A22,?,004247B8,00000018), ref: 00418C2C
FlsSetValue.KERNEL32(00000000,?,004247B8,00000018), ref: 00418C59
GetCurrentThreadId.KERNEL32 ref: 00418C6D

Part of subcall function 00418981: FlsFree.KERNEL32(00000005,00418C82,?,004247B8,00000018), ref: 0041898C

Strings

FlsAlloc, xrefs: 00418BC2
FlsSetValue, xrefs: 00418BD7
FlsFree, xrefs: 00418BE4
kernel32.dll, xrefs: 00418BAB
FlsGetValue, xrefs: 00418BCA

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: AddressProc$AllocCurrentFreeHandleModuleThreadValue
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$kernel32.dll
API String ID: 2355849793-282957996
Opcode ID: 012e15abca368c1597d430bded9e06c638291ed5235fd3e830dfbbb82c6b0752
Instruction ID: fd425951a6fb8aa6796692801cc9aa5a16ae922a9cff7db1b0451517fc0b33ae
Opcode Fuzzy Hash: 012e15abca368c1597d430bded9e06c638291ed5235fd3e830dfbbb82c6b0752
Instruction Fuzzy Hash: C6214FB1B417159BC3309F35BC49A5A7BA1EB85750790013FE519D72A0EB788482CBAC

Function 00410F7E Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00410F3B: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,0040DA9B,00000000,?), ref: 00410F4E
Part of subcall function 00410F3B: GetProcAddress.KERNEL32(00000000), ref: 00410F55
Part of subcall function 00410F3B: GetCurrentProcess.KERNEL32(00000000,?,?,0040DA9B,00000000,?), ref: 00410F65

GetModuleHandleW.KERNEL32(kernel32,Wow64DisableWow64FsRedirection,00000000,?,?,?,?,?,0040DAA6,00000000,00000000,?), ref: 00410FA7
GetProcAddress.KERNEL32(00000000), ref: 00410FB0
GetModuleHandleW.KERNEL32(kernel32,Wow64RevertWow64FsRedirection,?,?,?,?,0040DAA6,00000000,00000000,?), ref: 00410FBB
GetProcAddress.KERNEL32(00000000), ref: 00410FBE

Strings

Wow64EnableWow64FsRedirection, xrefs: 0041101F
Wow64RevertWow64FsRedirection, xrefs: 00410FB2
Wow64DisableWow64FsRedirection, xrefs: 00410F9C
kernel32, xrefs: 00410FA1, 00410FA6, 00410FB7, 00411024

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: AddressHandleModuleProc$CurrentProcess
String ID: Wow64DisableWow64FsRedirection$Wow64EnableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32
API String ID: 565683799-3439747844
Opcode ID: 453212b64c0269306f04363ff7a9b0ced16dc380a508bbf089e20933f90ddca0
Instruction ID: 4b54aee66c67425e005f3fe823602a2303617aec03ea178bea669df92479d699
Opcode Fuzzy Hash: 453212b64c0269306f04363ff7a9b0ced16dc380a508bbf089e20933f90ddca0
Instruction Fuzzy Hash: 6911A271E10258AECF24AFB5DC05EDB3E6CAB18385B50443BB601D2521DB7C89C18A6D

Function 00417424 Relevance: 16.8, APIs: 11, Instructions: 299COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,0042455C,00000001,00000000,00000000,00424F80,00000038,0041ED77,00000100,00000020,00000100,?,00000100,00000000,00000001), ref: 0041744B
GetLastError.KERNEL32 ref: 0041745D
MultiByteToWideChar.KERNEL32(?,00000000,0041EFB5,?,00000000,00000000,00424F80,00000038,0041ED77,00000100,00000020,00000100,?,00000100,00000000,00000001), ref: 004174E4
MultiByteToWideChar.KERNEL32(?,00000001,0041EFB5,?,?,00000000), ref: 00417565
LCMapStringW.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 0041757F
LCMapStringW.KERNEL32(00000000,00000000,?,00000000,?,?), ref: 004175BA

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: String$ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1775797328-0
Opcode ID: 3b2a213123ae2c72155ee2867309493a15f808347b693407346f854b2ee5c5c3
Instruction ID: 57e40128206f457cd21b3890a3f4c7c5a88f3d25b42aacd8fa13885fe63da5cc
Opcode Fuzzy Hash: 3b2a213123ae2c72155ee2867309493a15f808347b693407346f854b2ee5c5c3
Instruction Fuzzy Hash: E6B17E72904219EFCF219FA4DC849EE7FB5FF08364F10412AF925A22A0D7398991DF59

Function 004214C2 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 228COMMON

Download Yara Rule

APIs

_strcat.LIBCMT ref: 0042159A
_strcat.LIBCMT ref: 004215B7
___shr_12.LIBCMT ref: 00421680

Strings

1#QNAN, xrefs: 004215AE
1#IND, xrefs: 00421580
:B, xrefs: 0042171D
?, xrefs: 00421517
1#SNAN, xrefs: 00421566
1#INF, xrefs: 00421591

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: _strcat$___shr_12
String ID: 1#IND$1#INF$1#QNAN$1#SNAN$:B$?
API String ID: 1152255961-957608793
Opcode ID: 72f06b4f41fb07571f016515339e1c09eae94e6414b7684314048004edc806c3
Instruction ID: e57a2a0d5ef0140218a4c38f3a01904742a9b044f9002a104d13cb6f609df91a
Opcode Fuzzy Hash: 72f06b4f41fb07571f016515339e1c09eae94e6414b7684314048004edc806c3
Instruction Fuzzy Hash: 04813831A042AADECF11CF68E8447EFBBB4AF71314F88459BD841DB292D3788645C769

Function 0040AB67 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 152COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040AB6C

Part of subcall function 0040AD5D: __EH_prolog.LIBCMT ref: 0040AD62
Part of subcall function 0040AD5D: GetExitCodeProcess.KERNEL32(00000000,?), ref: 0040AE8A

Strings

MSJ, xrefs: 0040AD09
JRE, xrefs: 0040AC37
JRE_J2, xrefs: 0040ACDA
ALL, xrefs: 0040ABAB
JDK_J2, xrefs: 0040AC80
JDK_J1, xrefs: 0040AC50
JRE_J1, xrefs: 0040ACAE
JDK, xrefs: 0040AC1E

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: H_prolog$CodeExitProcess
String ID: ALL$JDK$JDK_J1$JDK_J2$JRE$JRE_J1$JRE_J2$MSJ
API String ID: 1786189289-467862012
Opcode ID: 37591d3fdf0b68c1b27b7d1802640a96b09f2620d9928fc2860fe2f848af0ee2
Instruction ID: d3543fd851d75a31ef1ecc64cc05e55038d5c9ea7c63f4a89326500076d3f62c
Opcode Fuzzy Hash: 37591d3fdf0b68c1b27b7d1802640a96b09f2620d9928fc2860fe2f848af0ee2
Instruction Fuzzy Hash: 0F510531604356ABDF20AB21C8026FA7765BF00346F40847BED11775C1E77CAA67A69F

Function 004171C5 Relevance: 13.7, APIs: 9, Instructions: 196COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,0042455C,00000001,00000000,00000000,00424A60,00000024,00412CB7,?,00000100,?,00000001,?,00000001,?), ref: 004171EC
GetLastError.KERNEL32(?,00000100,?,00000001,?,00000001,?), ref: 004171FE
LCMapStringW.KERNEL32(?,?,?,?,?,?,00424A60,00000024,00412CB7,?,00000100,?,00000001,?,00000001,?), ref: 00417250
WideCharToMultiByte.KERNEL32(?,00000000,?,?,00000000,00000000,00000000,00000000,00424A60,00000024,00412CB7,?,00000100,?,00000001,?), ref: 004172AB
WideCharToMultiByte.KERNEL32(?,00000000,?,?,?,?,00000000,00000000,?,00000100,?,00000001,?,00000001,?), ref: 0041731D
LCMapStringA.KERNEL32(?,?,?,?,00000000,00000000,?,00000100,?,00000001,?,00000001,?), ref: 00417339
LCMapStringA.KERNEL32(?,?,?,?,?,00000000,?,00000100,?,00000001,?,00000001,?), ref: 004173A5
_strncpy.LIBCMT ref: 004173CA

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: String$ByteCharMultiWide$ErrorLast_strncpy
String ID:
API String ID: 4089183155-0
Opcode ID: 0ae8a41c2e875b2265bdf39c30bd47532b52cfd6f6564c383f3ddd6d48d24726
Instruction ID: c8cb82fdfd3ab626dcbff0e6e6de350fda4e6dd80e5bd6da5c23149d1d09ffc6
Opcode Fuzzy Hash: 0ae8a41c2e875b2265bdf39c30bd47532b52cfd6f6564c383f3ddd6d48d24726
Instruction Fuzzy Hash: 93717C71D04219EFCF219FA4DC849EE7B75FB08354B24412AF924A22A0C7388DD2DF69

Function 0040FE52 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 224COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040FE57

Part of subcall function 00410134: __EH_prolog.LIBCMT ref: 00410139

Part of subcall function 00410F3B: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,0040DA9B,00000000,?), ref: 00410F4E
Part of subcall function 00410F3B: GetProcAddress.KERNEL32(00000000), ref: 00410F55
Part of subcall function 00410F3B: GetCurrentProcess.KERNEL32(00000000,?,?,0040DA9B,00000000,?), ref: 00410F65

Strings

SOFTWARE\IBM\Java2 Runtime Environment, xrefs: 0040FF15, 0041006C
SOFTWARE\IBM\Java Development Kit, xrefs: 0040FF65, 004100BD
SOFTWARE\JavaSoft\Java Runtime Environment, xrefs: 0040FEC4, 0041001A
SOFTWARE\JavaSoft\Java Development Kit, xrefs: 0040FE71, 0040FFC4
Sun, xrefs: 0040FE62, 0040FEB7, 0040FFB7, 0041000D
IBM, xrefs: 0040FF08, 0040FF58, 0041005F, 004100B0

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: H_prolog$AddressCurrentHandleModuleProcProcess
String ID: IBM$SOFTWARE\IBM\Java Development Kit$SOFTWARE\IBM\Java2 Runtime Environment$SOFTWARE\JavaSoft\Java Development Kit$SOFTWARE\JavaSoft\Java Runtime Environment$Sun
API String ID: 3857991278-1712796389
Opcode ID: 69ed3b92afadb8c486c4fa00c652dc4ea43ba203ec142067dd0ca5fafa1e17a8
Instruction ID: 390819e383806bfdc160e7e27f90a1ba953106ba19ca569711288e823cbfc12b
Opcode Fuzzy Hash: 69ed3b92afadb8c486c4fa00c652dc4ea43ba203ec142067dd0ca5fafa1e17a8
Instruction Fuzzy Hash: 60813B71E41208AEDB01EB91CD42FDDBB78AF15724F60012AF910B71D1C7B96B86CAA5

Function 00408B42 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 124COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00408B47

Part of subcall function 004068D8: __EH_prolog.LIBCMT ref: 004068DD

Strings

jview.exe, xrefs: 00408B73
Sun, xrefs: 00408C63, 00408C68
Microsoft, xrefs: 00408BE2, 00408BE7
ibm, xrefs: 00408C41, 00408C46, 00408C4E
wjview.exe, xrefs: 00408B94
IBM, xrefs: 00408C5C

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: H_prolog
String ID: IBM$Microsoft$Sun$ibm$jview.exe$wjview.exe
API String ID: 3519838083-281468356
Opcode ID: b31fca37f8fbe786fa17041fede0c0ee5eb69153a945814365de0ceb7280c30f
Instruction ID: 1d8badddfce9dad5c27da3f7b9227ccf84e2a1d3bdf78bb79557815c6f3e8de2
Opcode Fuzzy Hash: b31fca37f8fbe786fa17041fede0c0ee5eb69153a945814365de0ceb7280c30f
Instruction Fuzzy Hash: 8E41C272D01218AADB11EFA5C981AEFBB78AF45314F11813FF811732C1CB385E4587A8

Function 0041E74D Relevance: 12.2, APIs: 8, Instructions: 169COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,?,004266D0,00000038,0041CB5D,?,00000000,00000000,0041EFB5,00000000,00000000,004255C8,0000001C,0041ED53,00000001,00000020), ref: 0041E78B
GetCPInfo.KERNEL32(00000000,00000001), ref: 0041E79E
_strlen.LIBCMT ref: 0041E7C2
MultiByteToWideChar.KERNEL32(00000000,00000001,0041EFB5,?,00000000,00000000), ref: 0041E7E3

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: Info$ByteCharMultiWide_strlen
String ID:
API String ID: 1335377746-0
Opcode ID: 10cdb8a2ea9fd56441e4dd29bf3eb9c3c325b39430119f7847da183ff7e60023
Instruction ID: 7b18433cd00697b95d60660cb3c1ef6eb2ba60750e87ce0785c6354079567575
Opcode Fuzzy Hash: 10cdb8a2ea9fd56441e4dd29bf3eb9c3c325b39430119f7847da183ff7e60023
Instruction Fuzzy Hash: C4516D74D00218ABDB31EF66DC849DFBBB9EF44754F20412BF814A2290D7348D81DBA8

Function 0041C6D6 Relevance: 12.1, APIs: 8, Instructions: 131COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,?,004150D9,?,004247B8,00000018), ref: 0041C6F2
GetLastError.KERNEL32(?,?,?,?,004150D9,?,004247B8,00000018), ref: 0041C706
GetEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,?,004150D9,?,004247B8,00000018), ref: 0041C728
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,004150D9), ref: 0041C75C
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,004150D9,?,004247B8,00000018), ref: 0041C77E
FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,004150D9,?,004247B8,00000018), ref: 0041C797
GetEnvironmentStrings.KERNEL32(00000000,?,?,?,?,?,004150D9,?,004247B8,00000018), ref: 0041C7AD
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0041C7E9

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide$ErrorLast
String ID:
API String ID: 883850110-0
Opcode ID: f96978fe3591f21a212c14262195282294bcff93be8e80ca309d6cdf5a39b109
Instruction ID: 1c3f31bc1f99735f52c54a932543e9646fded3079ccb2e5aad69eb681a83eb3c
Opcode Fuzzy Hash: f96978fe3591f21a212c14262195282294bcff93be8e80ca309d6cdf5a39b109
Instruction Fuzzy Hash: 0F310AB2A442176FD7302F645CC48BBB6DCDB55354725053BF575C3280D7988CC18AAD

Function 00410387 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 347COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041038C

Part of subcall function 00406832: __EH_prolog.LIBCMT ref: 00406837

Part of subcall function 004089FD: __EH_prolog.LIBCMT ref: 00408A02

Part of subcall function 00408CB0: __EH_prolog.LIBCMT ref: 00408CB5

Part of subcall function 0040DC25: __EH_prolog.LIBCMT ref: 0040DC2A

Strings

\jrew.exe, xrefs: 00410474
\jview.exe, xrefs: 004104A6
\java.exe, xrefs: 004103DC
\jre.exe, xrefs: 00410410
\javaw.exe, xrefs: 00410442

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: H_prolog
String ID: \java.exe$\javaw.exe$\jre.exe$\jrew.exe$\jview.exe
API String ID: 3519838083-3605272454
Opcode ID: 9a53a33964cc93550af6a5139dc514ed3c71b01655136d8ce9b5c561796b59ca
Instruction ID: 6c66026935f0216831b300f47a2ebe9d38291b9b982261de727d5c941923867f
Opcode Fuzzy Hash: 9a53a33964cc93550af6a5139dc514ed3c71b01655136d8ce9b5c561796b59ca
Instruction Fuzzy Hash: 22D19D71D10258EEDB11EBA4CD45BDEBBB4AF04304F10416EE510B31D2DBB8AA89CB69

Function 00408CB0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 147COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00408CB5

Part of subcall function 004068D8: __EH_prolog.LIBCMT ref: 004068DD

Part of subcall function 00406B1E: __EH_prolog.LIBCMT ref: 00406B23

Part of subcall function 0040265A: __EH_prolog.LIBCMT ref: 0040265F

Part of subcall function 004067E9: __EH_prolog.LIBCMT ref: 004067EE

Part of subcall function 00406AB8: GetFileAttributesW.KERNELBASE(-00000004,0040133F,?,?), ref: 00406AC7

Strings

jre.exe, xrefs: 00408D6D
jview.exe, xrefs: 00408CD8
\javac.exe, xrefs: 00408DE6
wjview.exe, xrefs: 00408CFE
jrew.exe, xrefs: 00408D91

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: H_prolog$AttributesFile
String ID: \javac.exe$jre.exe$jrew.exe$jview.exe$wjview.exe
API String ID: 719147301-3427944829
Opcode ID: 519111e812d7d6288636cf1a1199f7feff8226266ef2d4c97323832c27646055
Instruction ID: a13502d764f6f15d69cc7483811924dc863150da3799e05c9a68c5db5f7f33a6
Opcode Fuzzy Hash: 519111e812d7d6288636cf1a1199f7feff8226266ef2d4c97323832c27646055
Instruction Fuzzy Hash: 0251E872D01219AACB11EBE8CE45BEFBB78AF11318F25827EA855B31D1D7780F058794

Function 0040C730 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 85keyboardCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040C735
GetKeyState.USER32(00000011), ref: 0040C77A

Strings

console, xrefs: 0040C756
lax.stderr.redirect=console, xrefs: 0040C819
lax.control-key=true, xrefs: 0040C80E
lax.stdout.redirect=console, xrefs: 0040C824

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: H_prologState
String ID: console$lax.control-key=true$lax.stderr.redirect=console$lax.stdout.redirect=console
API String ID: 1651127522-1142411866
Opcode ID: 62a8e78fc42b8464aa554db53450769e4e57d1c39ce0708f54a7b270eea09cee
Instruction ID: dfaf8729562b2c1db49b24075371f92db3692f14c96d7e5afa284af00a607155
Opcode Fuzzy Hash: 62a8e78fc42b8464aa554db53450769e4e57d1c39ce0708f54a7b270eea09cee
Instruction Fuzzy Hash: 1E213671B44350AAD710FBBA9947BEE7AA49F01728F10026FF451731C2CBBD4644C22E

Function 0040F0F5 Relevance: 10.6, APIs: 7, Instructions: 66synchronizationthreadCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040F0FA
SetConsoleCtrlHandler.KERNEL32(0040F319,00000001), ref: 0040F10B
SetLastError.KERNEL32 ref: 0040F13A
WaitForSingleObject.KERNEL32(00000008,000000FF,?,00000000,00000001), ref: 0040F1B0
GetExitCodeProcess.KERNEL32(?,?), ref: 0040F1C5
ExitProcess.KERNEL32 ref: 0040F1DA
RtlExitUserThread.NTDLL(00000000), ref: 0040F1E1

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: Exit$Process$CodeConsoleCtrlErrorH_prologHandlerLastObjectSingleThreadUserWait
String ID:
API String ID: 2193816540-0
Opcode ID: 8bc3b7668e7e5e5bfe45a262aeaced267f5363cd48c553a86aeb936f0713b879
Instruction ID: e9f3812800fb9ede828922c1798270eb805b758c1898e4910a66a8b7bf791762
Opcode Fuzzy Hash: 8bc3b7668e7e5e5bfe45a262aeaced267f5363cd48c553a86aeb936f0713b879
Instruction Fuzzy Hash: 20219271A00216EBCB14AFB5DC49A8ABAB4FF04314F00463AF115B66E1CB786945CB94

Function 00412604 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00412609

Strings

EB, xrefs: 00412663, 004126B6
ios_base::eofbit set, xrefs: 00412685
ios_base::failbit set, xrefs: 0041266F
ios_base::badbit set, xrefs: 0041263B
EB, xrefs: 004126B3

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: H_prolog
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$EB$EB
API String ID: 3519838083-158159671
Opcode ID: 0d68909b8b0f45778731f91c23b1d7a89d321a40ad3af7e1aa18915f099e1868
Instruction ID: 0a8a1b285ff889e7284506f7560a6ae0b8720b7af07a2115fa34f1a167cf86ab
Opcode Fuzzy Hash: 0d68909b8b0f45778731f91c23b1d7a89d321a40ad3af7e1aa18915f099e1868
Instruction Fuzzy Hash: B9116371A41218EBD711DFA0EA92BDDB774AB50308F64802FA645A71C1DBFD4A99CB0C

Function 004177E0 Relevance: 9.2, APIs: 6, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,0042455C,00000001,?,00424FA8,00000024,0041BCDD,00000001,00000100,00000001,00000000,00000001,00000000,?,?,00414AF3), ref: 00417804
GetLastError.KERNEL32(?,?,00414AF3,?,00000000,00000008,00000000,?,00000016,?,?,?,00414CA5,000000FF,000000FF,000000FF), ref: 00417816
GetStringTypeW.KERNEL32(?,00000100,000000FF,00000010,00424FA8,00000024,0041BCDD,00000001,00000100,00000001,00000000,00000001,00000000,?,?,00414AF3), ref: 00417840
WideCharToMultiByte.KERNEL32(00000000,00000000,00000100,000000FF,00000000,00000000,00000000,00000000,00424FA8,00000024,0041BCDD,00000001,00000100,00000001,00000000,00000001), ref: 00417898
WideCharToMultiByte.KERNEL32(00000000,00000000,00000100,00000000,?,00000000,00000000,00000000), ref: 0041791B
GetStringTypeA.KERNEL32(?,?,?,00000000,?), ref: 004179AD

Part of subcall function 0041B9D3: __lock.LIBCMT ref: 0041BA17
Part of subcall function 0041B9D3: RtlAllocateHeap.NTDLL(00000008,?,00425150), ref: 0041BA55

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: StringType$ByteCharMultiWide$AllocateErrorHeapLast__lock
String ID:
API String ID: 2327821635-0
Opcode ID: ebb9bac48a59801e7f319beffa0ae9fadc1de3cb2536a83aa5716d0902727cbc
Instruction ID: 451cc849405bcc63292fddc5cb94a3fd624bfef80be1c7b51f1ceedc86d623a2
Opcode Fuzzy Hash: ebb9bac48a59801e7f319beffa0ae9fadc1de3cb2536a83aa5716d0902727cbc
Instruction Fuzzy Hash: C6518071D04219EFCF21AFA5DC458EFBBB5FF04754B20412BF814A2260D3388A92DB99

Function 0041C9DA Relevance: 9.1, APIs: 6, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,0042455C,00000001,?,004255C8,0000001C,0041ED53,00000001,00000020,00000100,?,00000000), ref: 0041C9FE
GetLastError.KERNEL32 ref: 0041CA10
MultiByteToWideChar.KERNEL32(?,00000000,00000000,0041EFB5,00000000,00000000,004255C8,0000001C,0041ED53,00000001,00000020,00000100,?,00000000), ref: 0041CA72
MultiByteToWideChar.KERNEL32(?,00000001,00000000,0041EFB5,?,00000000), ref: 0041CAF0
GetStringTypeW.KERNEL32(00000000,?,00000000,?,?,00000000), ref: 0041CB02

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: ByteCharMultiStringTypeWide$ErrorLast
String ID:
API String ID: 3581945363-0
Opcode ID: fd3f87f64c5906040ffa863b06620bd87c600cea3b65315dd6e5582fac6fd858
Instruction ID: 9d6d0c741cd0c282e0ceaf928d1f80541d877b65ba82282077fb73e085f8ec83
Opcode Fuzzy Hash: fd3f87f64c5906040ffa863b06620bd87c600cea3b65315dd6e5582fac6fd858
Instruction Fuzzy Hash: 3541C531A84218ABCB22DF64EC86BDF7B75FF44760F14411AF911E6250C7389991CBE9

Function 0040A9C4 Relevance: 9.1, APIs: 6, Instructions: 138synchronizationCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040A9C9
GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,00000000), ref: 0040AA0E
GetStdHandle.KERNEL32(000000F5,?,?,?,?,?,00000000), ref: 0040AA1A
GetStdHandle.KERNEL32(000000F4,?,?,?,?,?,00000000), ref: 0040AA26

Part of subcall function 004066D8: __EH_prolog.LIBCMT ref: 004066DD

WaitForSingleObject.KERNEL32(?,000000FF,?,?,?), ref: 0040AABD
GetLastError.KERNEL32(?,?,?), ref: 0040AACB

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: Handle$H_prolog$ErrorLastObjectSingleWait
String ID:
API String ID: 2978390528-0
Opcode ID: 31db356805a268d5a3eb076ddfd6b5e9e19aa08b61795defdaff2ddced85ef54
Instruction ID: 5b66e927b6fd5f0c2caf3e061a290b367a18b3da78dd637c7ad4f65eb92948ab
Opcode Fuzzy Hash: 31db356805a268d5a3eb076ddfd6b5e9e19aa08b61795defdaff2ddced85ef54
Instruction Fuzzy Hash: 11416FB2E00218AFDB10EBA4CC8AFDE777CAB04314F50457BF514B71D1DA78AA54CA69

Function 0041F57F Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,00000000,?,00000000,00000000,?,?), ref: 0041F5F9
GetLastError.KERNEL32 ref: 0041F603
ReadFile.KERNEL32(?,?,00000001,?,00000000), ref: 0041F6CC
GetLastError.KERNEL32 ref: 0041F6D6

Strings

1@, xrefs: 0041F57F

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: 1@
API String ID: 1948546556-1036656397
Opcode ID: e4e81b70e60a0f5aa089f855bbb94a3dd120b78998247ee932263cb4ba1e8f15
Instruction ID: 3e61911184b30c1e44a4e34ea084b11da34abeca48171019db01ce6fb36304e2
Opcode Fuzzy Hash: e4e81b70e60a0f5aa089f855bbb94a3dd120b78998247ee932263cb4ba1e8f15
Instruction Fuzzy Hash: DF61A6356043459FDB21CF58C884BDA7BF0AF01314F5441ABE8658B2A2D778D9CBCB59

Function 0040AD5D Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 166COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040AD62

Part of subcall function 0040AF87: __EH_prolog.LIBCMT ref: 0040AF8C

Part of subcall function 0040EAAA: __EH_prolog.LIBCMT ref: 0040EAAF

Part of subcall function 0040EB7E: __EH_prolog.LIBCMT ref: 0040EB83

GetExitCodeProcess.KERNEL32(00000000,?), ref: 0040AE8A

Strings

com.zerog.util.jvm.Validator, xrefs: 0040AE02, 0040AE07
JRE, xrefs: 0040AED8
JDK, xrefs: 0040AEE6

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: H_prolog$CodeExitProcess
String ID: JDK$JRE$com.zerog.util.jvm.Validator
API String ID: 1786189289-2755780433
Opcode ID: 0d37ebf1faab10e4f67a1b7d81f47353ef961a61cc499ae3b538402bcd41f4ff
Instruction ID: 9b459d25dd5898f9467672e8a4b145c6047de2a19797779f0c15c97fba251a6e
Opcode Fuzzy Hash: 0d37ebf1faab10e4f67a1b7d81f47353ef961a61cc499ae3b538402bcd41f4ff
Instruction Fuzzy Hash: C9517271D002599ADF10EBA5D946BDEB7B8AF44304F10407FB904B72C1D7785B49CBAA

Function 0040A2F4 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 137COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040A2F9

Part of subcall function 004067E9: __EH_prolog.LIBCMT ref: 004067EE

Part of subcall function 004068D8: __EH_prolog.LIBCMT ref: 004068DD

Strings

system32, xrefs: 0040A346
syswow64, xrefs: 0040A38D
\bin\java.exe, xrefs: 0040A42E
\java.exe, xrefs: 0040A427, 0040A433

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: H_prolog
String ID: \bin\java.exe$\java.exe$system32$syswow64
API String ID: 3519838083-3234651240
Opcode ID: 2eaddf649ee53056219a8dd7312372a14b0e4dd8df65d5fcc7af9c34b2b21416
Instruction ID: 85fc40fa7b090057b4cff9c066aa9f173c0fe48305fdfe98ca5b839902fdd7fe
Opcode Fuzzy Hash: 2eaddf649ee53056219a8dd7312372a14b0e4dd8df65d5fcc7af9c34b2b21416
Instruction Fuzzy Hash: 6A518071D003289ADB10EBE5CC46BEEBBB4AF05318F00456EE915B71C1CBB85B48CB95

Function 00412265 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041226A

Part of subcall function 00401163: __EH_prolog.LIBCMT ref: 00401168

Part of subcall function 00415747: KiUserExceptionDispatcher.NTDLL(?,?,00401278,004281F4,?,/A,?,?,?,00413083,00401278,004281F4,0042D4A8,00401278,00401278,?), ref: 00415775

__EH_prolog.LIBCMT ref: 004122AA

Strings

invalid string position, xrefs: 00412272
pEB, xrefs: 00412294
string too long, xrefs: 004122B2

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: H_prolog$DispatcherExceptionUser
String ID: invalid string position$pEB$string too long
API String ID: 1370957130-461005008
Opcode ID: c60fa510a448b80caa1b6ca82e1d85ae9a1dc6db5cdadc9afb175ee8d4ee3911
Instruction ID: b75ce0494f71dd9d00632fa370008925e2026a752dc76bd960ee112793c15cb0
Opcode Fuzzy Hash: c60fa510a448b80caa1b6ca82e1d85ae9a1dc6db5cdadc9afb175ee8d4ee3911
Instruction Fuzzy Hash: 54F086B1D10118D7C700F7D1EC46BDD73B8BF54348F90402BE111B2094DBB84688CB68

Function 00413924 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 25COMMONLIBRARYCODE

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00413934
_strcat.LIBCMT ref: 0041394C

Strings

:A, xrefs: 0041392C
/A, xrefs: 00413924
T0A, xrefs: 00413926, 00413932, 00413949

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: _strcat_strlen
String ID: :A$T0A$/A
API String ID: 432593777-2141440836
Opcode ID: beb809f2225996f5001b95c28b9166104063e1fe50b60b62d878ec6e48c04983
Instruction ID: ac57415e97cf9eeaad8e4688a12e4ed066bf00738ff260a4d174c8562099a7f3
Opcode Fuzzy Hash: beb809f2225996f5001b95c28b9166104063e1fe50b60b62d878ec6e48c04983
Instruction Fuzzy Hash: 5BE04FF210C3115EE7145F56F801587FBE8DF54324B20881FF855C3250EBBAA8A18A5C

Function 00410F3B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,0040DA9B,00000000,?), ref: 00410F4E
GetProcAddress.KERNEL32(00000000), ref: 00410F55
GetCurrentProcess.KERNEL32(00000000,?,?,0040DA9B,00000000,?), ref: 00410F65

Strings

IsWow64Process, xrefs: 00410F44
kernel32, xrefs: 00410F49

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: AddressCurrentHandleModuleProcProcess
String ID: IsWow64Process$kernel32
API String ID: 4190356694-3789238822
Opcode ID: c1fc144c41faf2fe3b0b359dd55a644a18a0a4adf561c217383946529fc19021
Instruction ID: e57bb35ef3286bca47b963b0edd766ef26bf39249091e8193094d6132a14fc57
Opcode Fuzzy Hash: c1fc144c41faf2fe3b0b359dd55a644a18a0a4adf561c217383946529fc19021
Instruction Fuzzy Hash: 80E04F72E01628EBDB20DBF09C0EBCE7AAC9B04755B5149A6A901E3140D678DA8196A8

Function 0041E200 Relevance: 7.7, APIs: 5, Instructions: 184COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,?,?,?,?,?,0041673D,?), ref: 0041E2B3
InterlockedExchange.KERNEL32(0042D8C8,00000001), ref: 0041E331
InterlockedExchange.KERNEL32(0042D8C8,00000000), ref: 0041E396
InterlockedExchange.KERNEL32(0042D8C8,00000001), ref: 0041E3BA
InterlockedExchange.KERNEL32(0042D8C8,00000000), ref: 0041E41A

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: ExchangeInterlocked$QueryVirtual
String ID:
API String ID: 2947987494-0
Opcode ID: d0edcf8a1eb989224e18c8dfbcc835544c58e5e1e4f6457a3b918bfe4dc5c08e
Instruction ID: 5dca98a0126f508db255f135a1c328e9de624c188cec58f252d852239ec38bf8
Opcode Fuzzy Hash: d0edcf8a1eb989224e18c8dfbcc835544c58e5e1e4f6457a3b918bfe4dc5c08e
Instruction Fuzzy Hash: BD51F638B006198BCB289F1AD9907EA73E5EB85354F64817BDC61C7391D338DCC2864D

Function 0041F320 Relevance: 7.7, APIs: 5, Instructions: 169COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000001,?,00000000,?,?,?,?,?,?,?,(qB,?), ref: 0041F453
WideCharToMultiByte.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000,00000000,?,00000000,?,00000000), ref: 0041F4B4

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 332e4c4af94b29404426b3aadfa8b8ad9d26cbed4feaf7e48a1229e1cf646118
Instruction ID: 7b05b72e52233bbebd4b67132d4f95332c1fc47ff47bef68287f2796feaf267f
Opcode Fuzzy Hash: 332e4c4af94b29404426b3aadfa8b8ad9d26cbed4feaf7e48a1229e1cf646118
Instruction Fuzzy Hash: 03518A7190015AAF8F20EF94EC908FFB7B9FB64304764453BE96192250D7349D8BCBA9

Function 00417A1D Relevance: 7.6, APIs: 5, Instructions: 150COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff3d403cf58bf7fca9261007d4a1504cf370e3ce3ada691057eba8d921932462
Instruction ID: 62fdcf725419c5d8c62da50c65500de067d8c696b9e3f92b15cfd751f9443ab3
Opcode Fuzzy Hash: ff3d403cf58bf7fca9261007d4a1504cf370e3ce3ada691057eba8d921932462
Instruction Fuzzy Hash: 4841C5B1E092259ACF30AF669C848EF7A74EE41768710413FF925A6290D73C5EC1CA9D

Function 004189B1 Relevance: 7.5, APIs: 5, Instructions: 37threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00415786,00415B3D,00000000,004247F8,00000008,00415B94,?,?,?,0041BA1C,00000004,00425150,00000010,00418C4A), ref: 004189B3
FlsGetValue.KERNEL32(?,0041BA1C,00000004,00425150,00000010,00418C4A,00000001,0000008C,?,004247B8,00000018), ref: 004189C1
SetLastError.KERNEL32(00000000,?,0041BA1C,00000004,00425150,00000010,00418C4A,00000001,0000008C,?,004247B8,00000018), ref: 00418A17

Part of subcall function 0041B9D3: __lock.LIBCMT ref: 0041BA17
Part of subcall function 0041B9D3: RtlAllocateHeap.NTDLL(00000008,?,00425150), ref: 0041BA55

FlsSetValue.KERNEL32(00000000,?,0041BA1C,00000004,00425150,00000010,00418C4A,00000001,0000008C,?,004247B8,00000018), ref: 004189E8
GetCurrentThreadId.KERNEL32 ref: 00418A00

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: ErrorLastValue$AllocateCurrentHeapThread__lock
String ID:
API String ID: 1487844433-0
Opcode ID: e35d7d98850c37a71daedd9db5e6d2c65030dcfcf4092baa3f126770099fb887
Instruction ID: e0051e90053ba0a0896f8ad08b21ccf25472bbdbcd72e27b3f1dded6fefc1270
Opcode Fuzzy Hash: e35d7d98850c37a71daedd9db5e6d2c65030dcfcf4092baa3f126770099fb887
Instruction Fuzzy Hash: C2F068717057119BD7302F60BC4968A7A60EF007E1B50452BE656E72A1DF74888297D8

Function 0040AF87 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 144COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040AF8C

Part of subcall function 0040FAB8: __EH_prolog.LIBCMT ref: 0040FABD

Part of subcall function 0040265A: __EH_prolog.LIBCMT ref: 0040265F

Part of subcall function 0040B169: __EH_prolog.LIBCMT ref: 0040B16E

Strings

JRE, xrefs: 0040B030
ALL, xrefs: 0040B060
JDK, xrefs: 0040B048

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: H_prolog
String ID: ALL$JDK$JRE
API String ID: 3519838083-984268273
Opcode ID: 2d1b81d488eb6cc8968c902b9ed5649961cbaf910296a4dad82767a5bf12481c
Instruction ID: 2d035cca3fdabbe73337ee44b92911d75c1327593dfba8332d6857eb3b0ee127
Opcode Fuzzy Hash: 2d1b81d488eb6cc8968c902b9ed5649961cbaf910296a4dad82767a5bf12481c
Instruction Fuzzy Hash: 07514371E042199BCF00EFA9CD86AEE77B4AF45358F10417EF814772C2C7789E0596A9

Function 0040B8B8 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 128COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040B8BD

Part of subcall function 0040B640: __EH_prolog.LIBCMT ref: 0040B645

Strings

value not a string, xrefs: 0040B9C1
key not open, xrefs: 0040B8F2
key query failed, xrefs: 0040B973

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: H_prolog
String ID: key not open$key query failed$value not a string
API String ID: 3519838083-2296213663
Opcode ID: a4446861470b3b3de7c42047db3cd0402bbc8d86c8ecffb8c5d6b915a8ae7708
Instruction ID: 659e995e1fe2cc780d9e0de5cffdace463a45d16bf95da7fbcdea78ed852c959
Opcode Fuzzy Hash: a4446861470b3b3de7c42047db3cd0402bbc8d86c8ecffb8c5d6b915a8ae7708
Instruction Fuzzy Hash: A8416F71A05259EADB01EFA9C946BDEBBB4EF05308F50406FE50473281C7785B48CBEA

Function 00401229 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 110COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040122E
GetCommandLineW.KERNEL32(00426938), ref: 0040127C

Part of subcall function 0040FAB8: __EH_prolog.LIBCMT ref: 0040FABD

Strings

console, xrefs: 004012F3
-zglaxservice, xrefs: 004012A8

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: H_prolog$CommandLine
String ID: -zglaxservice$console
API String ID: 1798744181-3138557499
Opcode ID: 24580e4d9ad6aa7df8f6f98be371624c37bfc7a5a743d969bbd0b31491f2cd70
Instruction ID: 2d0f8ca2bc7ece575ee91f839a6662ab3562104b913b37ba1e3b0240e0d4591d
Opcode Fuzzy Hash: 24580e4d9ad6aa7df8f6f98be371624c37bfc7a5a743d969bbd0b31491f2cd70
Instruction Fuzzy Hash: 3241C571A002409BCB10EFBDC94569EBBB4AF05304F15407FE804B7293D778AA448BAA

Function 0040D144 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 93COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040D149

Strings

CLASSPATH, xrefs: 0040D204
$ENV_CLASSPATH$, xrefs: 0040D19D
lax.class.path, xrefs: 0040D16D

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: H_prolog
String ID: $ENV_CLASSPATH$$CLASSPATH$lax.class.path
API String ID: 3519838083-1265333889
Opcode ID: 356435373a27bc92b8d4302289f4789fb672281795e08309da378e8d883a3d76
Instruction ID: 438a19e0c2c2be008b1a78d63cdaee5cc72b1d2057612e01336f6100667950cd
Opcode Fuzzy Hash: 356435373a27bc92b8d4302289f4789fb672281795e08309da378e8d883a3d76
Instruction Fuzzy Hash: 9D318471F05258AACB01FFB9A986ACD7BB4AB45318F50807FF410B72D2CA785A05C769

Function 00415D6D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 00415DA4
_strncpy.LIBCMT ref: 00415E15
_strcspn.LIBCMT ref: 00415E32

Strings

_.,, xrefs: 00415E2C

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: _strncpy$_strcspn
String ID: _.,
API String ID: 209312476-2709443920
Opcode ID: 116809ee5454bfbdae0519bdce487f5e25208b0145a3a00956a0f50813735077
Instruction ID: 86d299f6d05f734361a3f7f88e7b2b62fad447f8af077a0a4d7325cfee592dab
Opcode Fuzzy Hash: 116809ee5454bfbdae0519bdce487f5e25208b0145a3a00956a0f50813735077
Instruction Fuzzy Hash: 33213871D00B05EEEF708B24DA05BE73759AF92364F188417F849C6282E33D9AC58B5D

Function 0040D85B Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 74COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040D860

Strings

true, xrefs: 0040D8F2
lax.win32.console.pause, xrefs: 0040D87F
yes, xrefs: 0040D903

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: H_prolog
String ID: lax.win32.console.pause$true$yes
API String ID: 3519838083-3116419153
Opcode ID: d1d11c78fc9ec949d47cb1ab21dd759812af2dbe03280dac6bf4e020f856500a
Instruction ID: 91f3178f658fc5cd48efafd4fae658082265de401fa5b91777ef16e5936a5417
Opcode Fuzzy Hash: d1d11c78fc9ec949d47cb1ab21dd759812af2dbe03280dac6bf4e020f856500a
Instruction Fuzzy Hash: BB21E171F002589ACB00EFE49942AED7B74AB04319F50807FE811B31C1C7B89A48D769

Function 0040F43C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040F441
GetModuleHandleW.KERNEL32(00000000,00000000,?,00000100,00426B8C,?,00000000), ref: 0040F47F
LoadStringW.USER32(00000000), ref: 0040F486

Part of subcall function 0040F512: __EH_prolog.LIBCMT ref: 0040F517

Strings

invalid key, xrefs: 0040F4E3

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: H_prolog$HandleLoadModuleString
String ID: invalid key
API String ID: 3611912700-3396617187
Opcode ID: cf3fdaedf8913e038841e25f7ce94de1f0565a564edfc68ef1eedc8918a1c039
Instruction ID: 43ad41bb033fb070c85a2acb04b305af505258056d4cb5b3d47a690f92adf5ba
Opcode Fuzzy Hash: cf3fdaedf8913e038841e25f7ce94de1f0565a564edfc68ef1eedc8918a1c039
Instruction Fuzzy Hash: 81216272A00709ABCB10FFA5DC46ADE73B8BF44304F10447BF811A7591DB78AA08CB68

Function 00413961 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0041397C
_strcat.LIBCMT ref: 00413995

Strings

:A, xrefs: 00413969
/A, xrefs: 00413961

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: _strcat_strlen
String ID: :A$/A
API String ID: 432593777-683655810
Opcode ID: 93b7d34b3b1065db4a154b335216cfcb0a26a1b247f0ae12ebbdc72d4e99cb98
Instruction ID: bf14f8818ef4f951228246e200014fd2555498ffe66e92abba0ea0fdd039433a
Opcode Fuzzy Hash: 93b7d34b3b1065db4a154b335216cfcb0a26a1b247f0ae12ebbdc72d4e99cb98
Instruction Fuzzy Hash: B2F037F2618701AE97109F55E501456F7E8EF44715310C91FE459D3750E774E891C758

Function 0041B7FF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00425130,00000010,00415A53,00000000,00000FA0,00000000,?,00418B9D,004150A4,?,004247B8,00000018), ref: 0041B822
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionAndSpinCount), ref: 0041B832

Strings

InitializeCriticalSectionAndSpinCount, xrefs: 0041B82C
kernel32.dll, xrefs: 0041B81D

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: InitializeCriticalSectionAndSpinCount$kernel32.dll
API String ID: 1646373207-3733552308
Opcode ID: f8cfd781a73d808e84495d3e6ee5f162c75a73c7967d9de1169927b8a8d50b12
Instruction ID: 4c4c5c5884bfcaa54bb82efc316efe8da5e8e82151b8f211b2cef5fa199cfb0b
Opcode Fuzzy Hash: f8cfd781a73d808e84495d3e6ee5f162c75a73c7967d9de1169927b8a8d50b12
Instruction Fuzzy Hash: FBF03A70B40215EADB20AF61DC45B9E3BA8EB44B54BA04136E815E62A0D778C5D2DA5C

Function 004121B3 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,MultiByteToWideChar), ref: 004121C0
SetLastError.KERNEL32(0000007F,00000000), ref: 004121D5

Strings

kernel32.dll, xrefs: 004121BB
MultiByteToWideChar, xrefs: 004121B6

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: ErrorHandleLastModule
String ID: MultiByteToWideChar$kernel32.dll
API String ID: 4242514867-2998143648
Opcode ID: d35230aa7cde00b763fc49652336ba04ebad3697f02eaf1917839ca8b13ab95e
Instruction ID: aca718fd7e1e53d2cc8da59600c93c6d85baeaa1e9f1376373edbf4772db1ab8
Opcode Fuzzy Hash: d35230aa7cde00b763fc49652336ba04ebad3697f02eaf1917839ca8b13ab95e
Instruction Fuzzy Hash: C1D0C932B88208A69250A7E17C0EA777A98DBA5750BD00422BB15C5491E9A995E089AD

Function 0042080A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,004203A5), ref: 0042080F
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 0042081F

Strings

IsProcessorFeaturePresent, xrefs: 00420819
KERNEL32, xrefs: 0042080A

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 2ce5a53da2ba8c60dc74da5fe69ead2245e16ebdf1c8c6ebbf912c541e684516
Instruction ID: 175cf54e01542d12263b030cd91fa3025be04a43e0b8fc3ad649ea32b3c63f53
Opcode Fuzzy Hash: 2ce5a53da2ba8c60dc74da5fe69ead2245e16ebdf1c8c6ebbf912c541e684516
Instruction Fuzzy Hash: 7AC0126534526565EA2027727D49B171288AB89B52FD400626415D0281CE58C081546D

Function 004120E6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetCPInfo), ref: 004120F0
SetLastError.KERNEL32(0000007F,00000000), ref: 00412104

Strings

GetCPInfo, xrefs: 004120E6
kernel32.dll, xrefs: 004120EB

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: ErrorHandleLastModule
String ID: GetCPInfo$kernel32.dll
API String ID: 4242514867-4020370742
Opcode ID: 3e750baf46d18c7e220d7d340a8e57189167abccc73bacaf52e07d5932c68f46
Instruction ID: 58f253342a307a9fdb5b70656c412ce6308fd696dac86d4244b2e628255a2a60
Opcode Fuzzy Hash: 3e750baf46d18c7e220d7d340a8e57189167abccc73bacaf52e07d5932c68f46
Instruction Fuzzy Hash: CCC08031BC421066D25067F02C0EA676955EBF4741BD144237754C1091D95CC4D0C53D

Function 00412161 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,IsValidCodePage), ref: 0041216B
SetLastError.KERNEL32(0000007F,00000000), ref: 0041217F

Strings

kernel32.dll, xrefs: 00412166
IsValidCodePage, xrefs: 00412161

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: ErrorHandleLastModule
String ID: IsValidCodePage$kernel32.dll
API String ID: 4242514867-1070563503
Opcode ID: 20d38ee14804076793a5da231e79e633c9479e75e7e2c3d5ff87839cfc670427
Instruction ID: 13011892d11ab4e1539e5d4a34820d1f16f9ce37942f451600be27c4dc841477
Opcode Fuzzy Hash: 20d38ee14804076793a5da231e79e633c9479e75e7e2c3d5ff87839cfc670427
Instruction Fuzzy Hash: B6C08032B8420067D21097F06C0DA676954DBE4741BD044337704C0090DE6CC4D0C53E

Function 00412127 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetFileAttributesW), ref: 00412131
SetLastError.KERNEL32(0000007F,00000000), ref: 00412145

Strings

kernel32.dll, xrefs: 0041212C
GetFileAttributesW, xrefs: 00412127

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: ErrorHandleLastModule
String ID: GetFileAttributesW$kernel32.dll
API String ID: 4242514867-3967345162
Opcode ID: e9b8594dd292461d899803575f68d3c4594aecc238e69c2f09f1eeb12754286e
Instruction ID: fe10567e8f9e459952b6202138f7cc16b4f00a42a5bc0414e2433638519b3992
Opcode Fuzzy Hash: e9b8594dd292461d899803575f68d3c4594aecc238e69c2f09f1eeb12754286e
Instruction Fuzzy Hash: D4C01231B9425095911057F16C0AA666914EBA07907A006227724C00E0D6A8D4D1853E

Function 0041218A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,lstrlenW), ref: 00412194
SetLastError.KERNEL32(0000007F,00000000), ref: 004121A8

Strings

lstrlenW, xrefs: 0041218A
kernel32.dll, xrefs: 0041218F

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: ErrorHandleLastModule
String ID: kernel32.dll$lstrlenW
API String ID: 4242514867-1353037567
Opcode ID: 7cf6e2ce359bb0f559b7899c30cb75f10e877b9dd660bf214ad7f22267b9b425
Instruction ID: 5adcc30e2f83eb8334d7b345b56e55d2476a2fd72ce10dd67bfc14644b17a796
Opcode Fuzzy Hash: 7cf6e2ce359bb0f559b7899c30cb75f10e877b9dd660bf214ad7f22267b9b425
Instruction Fuzzy Hash: ABC01232B8425069E61097F06C0DA666954EBE4741BD044227704C0090D9A894E0C52D

Function 00411040 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetSystemWow64DirectoryW,0041050F,?,00000104,00000000,?,?,?,00000000), ref: 0041104A
GetProcAddress.KERNEL32(00000000), ref: 00411051

Strings

kernel32.dll, xrefs: 00411045
GetSystemWow64DirectoryW, xrefs: 00411040

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 1646373207-1816364905
Opcode ID: 834f25948144d7f69a5e93d261281fff115d5f7d3b56b91a83c9079f8eb00e7e
Instruction ID: 54869c74ee9ddc86258379d662f0ceb4b5afac1ae51c0acee345fc808ee50513
Opcode Fuzzy Hash: 834f25948144d7f69a5e93d261281fff115d5f7d3b56b91a83c9079f8eb00e7e
Instruction Fuzzy Hash: 27C02B70F84B004773105771AC1CF062C483504B013908093B701C0460CE18D041C72E

Function 0041637C Relevance: 6.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

_strpbrk.LIBCMT ref: 004163F0
_strlen.LIBCMT ref: 00416438
_strcspn.LIBCMT ref: 00416458
_strncpy.LIBCMT ref: 00416478

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: _strcspn_strlen_strncpy_strpbrk
String ID:
API String ID: 635841138-0
Opcode ID: ce234708ced47c643e7636637e99cfeb62a74c8038a33029ec81b380856e9e48
Instruction ID: 635981cbe2151109b6194cce370e88a77034d9ec2908c4ee9fd545fd02658f3e
Opcode Fuzzy Hash: ce234708ced47c643e7636637e99cfeb62a74c8038a33029ec81b380856e9e48
Instruction Fuzzy Hash: 0A510BB2D012269BDF319BA5DC816FF77A8AB44318F26052FD805A2242E73CCDC1879D

Function 0041B2BC Relevance: 6.1, APIs: 4, Instructions: 145fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,00000000,?,0042D9E4), ref: 0041B3A4

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 18b5f9fbf2ad483612655590b242f76d747ab116a6ff48ed956632f0df11284f
Instruction ID: ed280efa82c87b02be5e1dbf1e8acc392504d9f920e1def4a13abc69968bea66
Opcode Fuzzy Hash: 18b5f9fbf2ad483612655590b242f76d747ab116a6ff48ed956632f0df11284f
Instruction Fuzzy Hash: BB519471A00248CFDB32DFA9CC84AEDBBB8FF45304F60415AE9699B252D7345A81CF59

Function 00415F91 Relevance: 6.1, APIs: 4, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51058bebb2d4a0ba1d31e01f8713f4f304ca86666ea717fb46c6b7f53b281ab2
Instruction ID: 0ece8c6ab2a1b0978e4269eaa82fcc2a0f0fdde64aa38d79aa27d99546471abc
Opcode Fuzzy Hash: 51058bebb2d4a0ba1d31e01f8713f4f304ca86666ea717fb46c6b7f53b281ab2
Instruction Fuzzy Hash: 4631F571A04224AAEB24DB35AC41BEB3BA9DF44315F25806BF80892281E77DCDC1C25D

Function 0041442D Relevance: 6.1, APIs: 4, Instructions: 113COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 0041444F

Part of subcall function 00415B7B: RtlEnterCriticalSection.NTDLL(?), ref: 00415BA3

__lock.LIBCMT ref: 0041449B
RtlEnterCriticalSection.NTDLL(0000000D), ref: 004144E5
RtlLeaveCriticalSection.NTDLL(0000000D), ref: 004144F2

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: CriticalSection$Enter__lock$Leave
String ID:
API String ID: 885841014-0
Opcode ID: a6c6612f6726ed16518befad866fbf69278125153c78e87308b65c73d5fe1b80
Instruction ID: 2e16277dc42f8a6a400e2c3b54ef0ad5139fdfe98634f10f164a33856e727b71
Opcode Fuzzy Hash: a6c6612f6726ed16518befad866fbf69278125153c78e87308b65c73d5fe1b80
Instruction Fuzzy Hash: 9B4117719007129BCB209F65D8417DE77A1AF81334F24862FD2359A1D1DB7C99C28B5C

Function 004172DF Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

Part of subcall function 0041E627: VirtualQuery.KERNEL32(?,?,0000001C), ref: 0041E641
Part of subcall function 0041E627: GetSystemInfo.KERNEL32(?,?,?,0000001C), ref: 0041E652
Part of subcall function 0041E627: VirtualQuery.KERNEL32(?,?,0000001C,?,?,0000001C), ref: 0041E698

WideCharToMultiByte.KERNEL32(?,00000000,?,?,?,?,00000000,00000000,?,00000100,?,00000001,?,00000001,?), ref: 0041731D
LCMapStringA.KERNEL32(?,?,?,?,00000000,00000000,?,00000100,?,00000001,?,00000001,?), ref: 00417339
LCMapStringA.KERNEL32(?,?,?,?,?,00000000,?,00000100,?,00000001,?,00000001,?), ref: 004173A5
_strncpy.LIBCMT ref: 004173CA

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: QueryStringVirtual$ByteCharInfoMultiSystemWide_strncpy
String ID:
API String ID: 1411509361-0
Opcode ID: 0193c1170d1af1da8ed7c2d1208624dbb874ae913acbdab2569ca25da4a8d829
Instruction ID: c5b998f8757d9015ae8da4623aa08d2fb5ffe24b0753f7125c68bfb4f5fa2ded
Opcode Fuzzy Hash: 0193c1170d1af1da8ed7c2d1208624dbb874ae913acbdab2569ca25da4a8d829
Instruction Fuzzy Hash: D3315A72C0425EEBCF119FA5DC418EE7BB1FF48354F14812AF924621A0C7394992EF99

Function 0041C401 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

___initmbctable.LIBCMT ref: 0041C40E
_strlen.LIBCMT ref: 0041C427
_strlen.LIBCMT ref: 0041C460
_strcat.LIBCMT ref: 0041C47D

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: _strlen$___initmbctable_strcat
String ID:
API String ID: 109824703-0
Opcode ID: 83596566147bba89ac50cda230d8f960f942dace8478570eebe1e7f3e12f8b0b
Instruction ID: aecccb479df253a319077c954303b86f499dff71de012b39cee18dbd7cdd79d5
Opcode Fuzzy Hash: 83596566147bba89ac50cda230d8f960f942dace8478570eebe1e7f3e12f8b0b
Instruction Fuzzy Hash: BE1163B698C210AED7302FB1BC905F63786AB01328360467FE095432A1DB3C18D38B8C

Function 00411060 Relevance: 6.1, APIs: 4, Instructions: 69fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000,?,?,004107CC,-00000004,0000001C,?,?,?,?,00000001,00000008), ref: 004110AA
UnmapViewOfFile.KERNEL32(00000000,?,?,004107CC,-00000004,0000001C,?,?,?,?,00000001,00000008,000000FF,?,?,00000001), ref: 004110FF
CloseHandle.KERNEL32(00000000,?,?,004107CC,-00000004,0000001C,?,?,?,?,00000001,00000008,000000FF,?,?,00000001), ref: 00411106
CloseHandle.KERNEL32(00000000,?,?,004107CC,-00000004,0000001C,?,?,?,?,00000001,00000008,000000FF,?,?,00000001), ref: 0041110D

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: CloseFileHandleView$Unmap
String ID:
API String ID: 1018311036-0
Opcode ID: efac7f39593556fe32960664120906300de0e62f58d815180b917fc59eec4a56
Instruction ID: 62ed04df4e5a14ae7252075893d07cec59bdeb1acca4e08cb964f562851f0438
Opcode Fuzzy Hash: efac7f39593556fe32960664120906300de0e62f58d815180b917fc59eec4a56
Instruction Fuzzy Hash: 50117F30B02260BBC7305B55DC4DEEB7E28EB5AB64F61811AF305566F1D2B94CC2C6A8

Function 00414E1C Relevance: 6.1, APIs: 4, Instructions: 69threadCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 00414E44
RtlExitUserThread.NTDLL(00000000), ref: 00414E53
FlsGetValue.KERNEL32(004247A8,0000000C), ref: 00414E6C
FlsSetValue.KERNEL32(?), ref: 00414E82

Part of subcall function 00413E83: __lock.LIBCMT ref: 00413EA1
Part of subcall function 00413E83: HeapFree.KERNEL32(00000000,?,004246F8,0000000C,00415B5F,00000000,004247F8,00000008,00415B94,?,?,?,0041BA1C,00000004,00425150,00000010), ref: 00413EE8

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: Value$CloseExitFreeHandleHeapThreadUser__lock
String ID:
API String ID: 3768287693-0
Opcode ID: 8aaa84c5ea303c07c023bafa6713cc395e3b57277a4ace6475d1f005ec8d6440
Instruction ID: 7a9587cd1f16faa87f867f4acf5c4a1a87d23e5a42e8cb7b0da30dc50c65bc1b
Opcode Fuzzy Hash: 8aaa84c5ea303c07c023bafa6713cc395e3b57277a4ace6475d1f005ec8d6440
Instruction Fuzzy Hash: 08216D71A407109FD724AF65E845EAA7BA1FF84765B10451EF906973A0CF38EC81CA9C

Function 0041AB24 Relevance: 6.1, APIs: 4, Instructions: 57memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(00000000,?,00000000,0041B115), ref: 0041AB4B
RtlAllocateHeap.NTDLL(00000008,000041C4,00000000), ref: 0041AB84
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 0041ABA2
HeapFree.KERNEL32(00000000,?), ref: 0041ABB9

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: Heap$Allocate$AllocFreeVirtual
String ID:
API String ID: 94566200-0
Opcode ID: 54456761ee3a74d021dda87f4e7309e537ae6b3998d3a564d60b73401514c880
Instruction ID: 49930ada39713b44ade05262e838f32e531029d33af051b9bee5041e7601a2ac
Opcode Fuzzy Hash: 54456761ee3a74d021dda87f4e7309e537ae6b3998d3a564d60b73401514c880
Instruction Fuzzy Hash: 771119313042419FD7318F6AFC46AA67BB6FB91750790463AF252D62A0C370A8A6CB09

Function 00420EF7 Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

___addl.LIBCMT ref: 00420F06
___addl.LIBCMT ref: 00420F1A
___addl.LIBCMT ref: 00420F32
___addl.LIBCMT ref: 00420F4A

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: ___addl
String ID:
API String ID: 2260456530-0
Opcode ID: a6d3fea94caffdbfbeec600a8d228e4f9831f0a4e76ee5ff08ec74ce47c2ef23
Instruction ID: 66be002701016eb227c6b7fc749c6a1329c3ce5f9475afadf3c012ef8399b07f
Opcode Fuzzy Hash: a6d3fea94caffdbfbeec600a8d228e4f9831f0a4e76ee5ff08ec74ce47c2ef23
Instruction Fuzzy Hash: 3DF06277600112EFEB205A42ED01E57B7EDFF44314B45482AFD58D2132E766E8A8CB52

Function 004054E2 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 358COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004054E7

Part of subcall function 00406131: __EH_prolog.LIBCMT ref: 00406136

Part of subcall function 00403CA9: std::locale::facet::_Decref.LIBCPMT ref: 00403CAF

_strcspn.LIBCMT ref: 00405655

Strings

e, xrefs: 0040558D

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: H_prolog$Decref_strcspnstd::locale::facet::_
String ID: e
API String ID: 765611367-4024072794
Opcode ID: 6989579e8fe5a17550c66839fc7fceb2417a09a4820ae2b98edd922a51fc9261
Instruction ID: e86af2bc0806b7d8b6b9724ff1ed76631a4ccf934b6b9f0d06023629a3589b77
Opcode Fuzzy Hash: 6989579e8fe5a17550c66839fc7fceb2417a09a4820ae2b98edd922a51fc9261
Instruction Fuzzy Hash: E6D16772900608AFDF01DFA4DC85AEE7BB5EF08308F15402AF905BB292D739A951DF58

Function 00407312 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 223COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00407317

Part of subcall function 00401163: __EH_prolog.LIBCMT ref: 00401168

Part of subcall function 00415747: KiUserExceptionDispatcher.NTDLL(?,?,00401278,004281F4,?,/A,?,?,?,00413083,00401278,004281F4,0042D4A8,00401278,00401278,?), ref: 00415775

Strings

invalid map/set<T> iterator, xrefs: 0040732B
|EB, xrefs: 00407340, 0040734D

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: H_prolog$DispatcherExceptionUser
String ID: invalid map/set<T> iterator$|EB
API String ID: 1370957130-889349240
Opcode ID: e794160866f02b4873d797d4c191187ab252ca78fb051dec6c60da122830fffd
Instruction ID: cfccddc9af60f329fc9c095f140bf7009386a4a59e08fec4e99f9c952b300543
Opcode Fuzzy Hash: e794160866f02b4873d797d4c191187ab252ca78fb051dec6c60da122830fffd
Instruction Fuzzy Hash: AEA14F70908280AFDB15CF14D184B667FE1AB55308F2880AED8855F392C779FD86CBA7

Function 00402C92 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 185COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00402C97

Part of subcall function 00411365: __EH_prolog.LIBCMT ref: 0041136A

Part of subcall function 00406D41: __EH_prolog.LIBCMT ref: 00406D46

Part of subcall function 004040BC: __EH_prolog.LIBCMT ref: 004040C1

Part of subcall function 00402BFC: __EH_prolog.LIBCMT ref: 00402C01

Strings

lax.nl.env.exact_case.%s=%s, xrefs: 00402E5B
lax.nl.env.%s=%s, xrefs: 00402E08, 00402E0D, 00402E31

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: H_prolog
String ID: lax.nl.env.%s=%s$lax.nl.env.exact_case.%s=%s
API String ID: 3519838083-1796629959
Opcode ID: 4a00bd07545f5000b3c685a59bcf601e03f26b5f3d798c1067527e91460d2e79
Instruction ID: 95027f21c49b224b231d62f290a94ebe781777ef3e557235238f4059b0ef544d
Opcode Fuzzy Hash: 4a00bd07545f5000b3c685a59bcf601e03f26b5f3d798c1067527e91460d2e79
Instruction Fuzzy Hash: 9F715F71E00219EFCF04EB95C986AEEBBB8AF50304F50416AF505B71D1DB786E84CB99

Function 00410134 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 172COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00410139

Strings

MicroVersion, xrefs: 00410189
JavaHome, xrefs: 0041015E

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: H_prolog
String ID: JavaHome$MicroVersion
API String ID: 3519838083-2677630228
Opcode ID: 20e3acc952a038b3af12563df467047e2b899bb78b9081ae9525a04ba6000d8d
Instruction ID: 2c8e2a9dbf5c6fa99439792e0287f50f7f99ae12cea6863223e2ab28d2dfc39b
Opcode Fuzzy Hash: 20e3acc952a038b3af12563df467047e2b899bb78b9081ae9525a04ba6000d8d
Instruction Fuzzy Hash: 0F619471D04259EFDB00EFA5C946ADE7BB4AF05304F50416FF40077292DB78AA45CBA9

Function 00401403 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00401408

Part of subcall function 004067E9: __EH_prolog.LIBCMT ref: 004067EE

Part of subcall function 0040265A: __EH_prolog.LIBCMT ref: 0040265F

Part of subcall function 00406883: __EH_prolog.LIBCMT ref: 00406888

Part of subcall function 00402AB4: __EH_prolog.LIBCMT ref: 00402AB9

Part of subcall function 00402EDA: __EH_prolog.LIBCMT ref: 00402EDF

Strings

.exe, xrefs: 00401456
unable to locate executable, xrefs: 00401543

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: H_prolog
String ID: .exe$unable to locate executable
API String ID: 3519838083-1739398756
Opcode ID: c71029c300d5b6a1640cab96f17f8cf56ac9d7a8bef60e4433125bf09bd9b959
Instruction ID: efdf16bef9284aaf24fcecc9915265899847645a9463572c28b6bfea987de3dc
Opcode Fuzzy Hash: c71029c300d5b6a1640cab96f17f8cf56ac9d7a8bef60e4433125bf09bd9b959
Instruction Fuzzy Hash: 85515172D00218AADF10FBE5C846FCE7BB89F15318F41807BF505B71D2D6789A498B65

Function 0040983D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00409842

Part of subcall function 00408CB0: __EH_prolog.LIBCMT ref: 00408CB5

Part of subcall function 00406B1E: __EH_prolog.LIBCMT ref: 00406B23

Strings

\..\jre\bin, xrefs: 0040988C
\NPJava32.dll, xrefs: 0040994A

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: H_prolog
String ID: \..\jre\bin$\NPJava32.dll
API String ID: 3519838083-102645089
Opcode ID: d7bc56a210a47b4d84a6fa1c8a56245827030e8498592be318949e1f3c524d90
Instruction ID: bcfff82385b425507ad586e6357883958df313f2866ef671c63f73ec430543ac
Opcode Fuzzy Hash: d7bc56a210a47b4d84a6fa1c8a56245827030e8498592be318949e1f3c524d90
Instruction Fuzzy Hash: E25172B1E00219AACB00FFA5DC86BEE7B75AF01308F00457EF904772D2D7B95A498799

Function 0041ECAD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 0041ECC9

Strings

, xrefs: 0041ED17
, xrefs: 0041ECF0

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: ae6ef7f9dc25fadb2a6a880761758ca4c823e36990b62ee310361c5e3d6d48c8
Instruction ID: db05d62cadd328532e6515807ace2d16a0a9204a9efb37351131e07a25f339d2
Opcode Fuzzy Hash: ae6ef7f9dc25fadb2a6a880761758ca4c823e36990b62ee310361c5e3d6d48c8
Instruction Fuzzy Hash: 054169316002995EEB118B29EC59BFA3BE8EB05304F2404E6E946DB153C62949C5D7DC

Function 00402EDA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00402EDF

Strings

path, xrefs: 00402F40
Path, xrefs: 00402F84

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: H_prolog
String ID: Path$path
API String ID: 3519838083-1791709477
Opcode ID: 5e40aaf4ed47cdc820702f0185d1bf50c0d4d4fef65f9cdc397dc3e4546b6862
Instruction ID: 421d49ef3281a0bdf0f3de4d8cbc5f638aa4c1177e079d29fba60a70de246731
Opcode Fuzzy Hash: 5e40aaf4ed47cdc820702f0185d1bf50c0d4d4fef65f9cdc397dc3e4546b6862
Instruction Fuzzy Hash: 84318172A10119AFCB00EF99CA469EEBB74BF44314F10813AF811772D1DB74AA44DBD9

Function 0040E310 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040E315

Strings

\StringFileInfo\040904b0\CompanyName, xrefs: 0040E38B
company: %s, xrefs: 0040E3B7

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: H_prolog
String ID: \StringFileInfo\040904b0\CompanyName$company: %s
API String ID: 3519838083-687074582
Opcode ID: 5810597c1f0495f06a95cfdf7065e61ff0b4142226a60e7ce9d97c1c4929aa32
Instruction ID: 3fff5d8134b0ef0de1aec03fddfc997c478f973f74c5401f8ddb14134fc405a9
Opcode Fuzzy Hash: 5810597c1f0495f06a95cfdf7065e61ff0b4142226a60e7ce9d97c1c4929aa32
Instruction Fuzzy Hash: 39214172D00118AACF00EF95D885DDEBBB8EF44758F10802BF915B7181D7789A44CBA8

Function 004204B5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

__shift.LIBCMT ref: 004204D8

Part of subcall function 00420498: _strlen.LIBCMT ref: 004204A0

_strcat.LIBCMT ref: 00420515

Strings

e+000, xrefs: 00420507

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: __shift_strcat_strlen
String ID: e+000
API String ID: 208078240-1027065040
Opcode ID: 1d245ffe33c64c34526efea1788691be5b00e9f0e900454bb2c238cb3bf20c32
Instruction ID: bbf1ecedab5fe765bbf9c983643f2e232d5e8be53f452894324958bf522748cb
Opcode Fuzzy Hash: 1d245ffe33c64c34526efea1788691be5b00e9f0e900454bb2c238cb3bf20c32
Instruction Fuzzy Hash: D921F0723083A49FD72A9E38AC907A63FD15B02358F5884AFE085CA293D679C8C1C759

Function 0040A138 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040A13D

Part of subcall function 004067E9: __EH_prolog.LIBCMT ref: 004067EE

Part of subcall function 0040265A: __EH_prolog.LIBCMT ref: 0040265F

Part of subcall function 00406883: __EH_prolog.LIBCMT ref: 00406888

Part of subcall function 00406AB8: GetFileAttributesW.KERNELBASE(-00000004,0040133F,?,?), ref: 00406AC7

Strings

\bin\jre.exe, xrefs: 0040A16A
\bin\java.exe, xrefs: 0040A1A9

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: H_prolog$AttributesFile
String ID: \bin\java.exe$\bin\jre.exe
API String ID: 719147301-1069483913
Opcode ID: 59ee3b2cd8abe1e5bc16460be772674d1a2bddcd1066ad65aac1b6acf2a43b74
Instruction ID: 92a5b913b861d30cfe90557012c406c35276ba141b0a28e92dcededde5ae75df
Opcode Fuzzy Hash: 59ee3b2cd8abe1e5bc16460be772674d1a2bddcd1066ad65aac1b6acf2a43b74
Instruction Fuzzy Hash: A1216872D00258AECB00FBE9D846ECEBB78AF15714F41853BF504B3182D779960987A5

Function 00406305 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040630A

Part of subcall function 0041235D: InterlockedIncrement.KERNEL32(00000000), ref: 0041236F
Part of subcall function 0041235D: InterlockedDecrement.KERNEL32(00000000), ref: 00412384
Part of subcall function 0041235D: __lock.LIBCMT ref: 0041238C

Part of subcall function 004063DF: _strlen.LIBCMT ref: 004063E4

Part of subcall function 00403D0A: _strlen.LIBCMT ref: 00403D1B

Strings

false, xrefs: 0040634C
true, xrefs: 0040636A

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: Interlocked_strlen$DecrementH_prologIncrement__lock
String ID: false$true
API String ID: 3391087120-2658103896
Opcode ID: 541593a059fa759ec84aa5ea556c5072113d7219c51071618ccb036026c67f67
Instruction ID: 6a89202dff5fc2248bda2a38375d1ed002f8ab108d6cd8db08e3b3aef7542049
Opcode Fuzzy Hash: 541593a059fa759ec84aa5ea556c5072113d7219c51071618ccb036026c67f67
Instruction Fuzzy Hash: 29213EB1D007099FCB10EFB5D4425DEBBF8AF04304B10452FE069E7241E778A6418B98

Function 0041C634 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

___initmbctable.LIBCMT ref: 0041C646
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe,00000104,00000000,?,?,?,?,?,004150E3,?,004247B8,00000018), ref: 0041C65E

Strings

C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe, xrefs: 0041C650, 0041C655

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: FileModuleName___initmbctable
String ID: C:\Users\user\Desktop\Infor IDF Auxiliary Machine.exe
API String ID: 767393020-813280243
Opcode ID: 23910124e580494ea470da2430ae9f08fc4d75f05b09e9ad9b06ebe5f7a0cb0a
Instruction ID: 82801267961e233b6e6daf7bc4318ec6fa89f00873a84989f6fc0b4001794a96
Opcode Fuzzy Hash: 23910124e580494ea470da2430ae9f08fc4d75f05b09e9ad9b06ebe5f7a0cb0a
Instruction Fuzzy Hash: 4A11E7B2F44104AFD720DBA9EC81ADB77A8EB95360B50057BE809E3251D674AD418B68

Function 004145A9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,00424758,00000010,00406D0D,00000000,00004000,?,?,00000000), ref: 004145D5
GetLastError.KERNEL32(?,?,00000000), ref: 004145DF

Strings

@, xrefs: 004145C0

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: ErrorFileLastType
String ID: @
API String ID: 1621975986-2766056989
Opcode ID: 9de71b022d57de2d21fae6fc9f57f2c52084fc36b36731b3d5e8fec9ab13e596
Instruction ID: 53e573fc3507acab2de635c1683088dacf71c2ad8c313c64f864c110a3d2ce43
Opcode Fuzzy Hash: 9de71b022d57de2d21fae6fc9f57f2c52084fc36b36731b3d5e8fec9ab13e596
Instruction Fuzzy Hash: 0E110871A05204ABCF21AB74E8067DD3B509F82339F19460BE6705B2D3CB7C45C1AB5D

Function 0040608F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00406094
std::locale::facet::_Incref.LIBCPMT ref: 00406109

Strings

bad cast, xrefs: 004060E3

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: H_prologIncrefstd::locale::facet::_
String ID: bad cast
API String ID: 931760182-3145022300
Opcode ID: c0cd3d3abf1e92f9b0aa3729aa151e29ca9bd95eeb94dee5ae8274da598e3fd7
Instruction ID: 43767b857c40ffc456dfc2e8a118e863a121c4098c06f96d5c5854140a4108cd
Opcode Fuzzy Hash: c0cd3d3abf1e92f9b0aa3729aa151e29ca9bd95eeb94dee5ae8274da598e3fd7
Instruction Fuzzy Hash: 7F01E532E0052497CB10FB65C9026EEB735AB80724F51022FE422B72D2DBBC9E01CB9C

Function 00406131 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00406136
std::locale::facet::_Incref.LIBCPMT ref: 004061AB

Strings

bad cast, xrefs: 00406185

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: H_prologIncrefstd::locale::facet::_
String ID: bad cast
API String ID: 931760182-3145022300
Opcode ID: 05e1d3d3be8a9cab048970543999a97e2840a0ab10b6864dc5deddf2a9afa88d
Instruction ID: d5b7b4dd72678ebc9806452029753f369796af98f022cbf710ff4df004465886
Opcode Fuzzy Hash: 05e1d3d3be8a9cab048970543999a97e2840a0ab10b6864dc5deddf2a9afa88d
Instruction Fuzzy Hash: 78018272E0052497CB10FBA5D902AEEB774AB80729F51026FE412B72D1DBBC9E01C798

Function 00405FD3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00405FD8
std::locale::facet::_Incref.LIBCPMT ref: 0040604D

Strings

bad cast, xrefs: 00406027

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: H_prologIncrefstd::locale::facet::_
String ID: bad cast
API String ID: 931760182-3145022300
Opcode ID: 042c257e0917e37a35fde5ee1ac94dd84ef020ef63af04afe5fb087cf3e97c7d
Instruction ID: 4bf539fd838fc87eca0b192fd1ed4f0bb8996fc181f15976787db23ad23585f1
Opcode Fuzzy Hash: 042c257e0917e37a35fde5ee1ac94dd84ef020ef63af04afe5fb087cf3e97c7d
Instruction Fuzzy Hash: D6018272E0052597CB10FF65D9026EEB774AB40729F51422FE412B72D1DB7C9E05C798

Function 00412904 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00412909
std::locale::facet::_Decref.LIBCPMT ref: 00412942

Strings

)A, xrefs: 00412917

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: DecrefH_prologstd::locale::facet::_
String ID: )A
API String ID: 2855265189-2712435313
Opcode ID: bbc4e8b4384f7e507161fe53fd83af13d37484ce0c29fbd52105b897510ba6a0
Instruction ID: 9182611065c10ffccf4632655464990c376c23f88d02202db2df5448709ae679
Opcode Fuzzy Hash: bbc4e8b4384f7e507161fe53fd83af13d37484ce0c29fbd52105b897510ba6a0
Instruction Fuzzy Hash: 1A018074B002129FEB14EF55C505BEEB7B4EF90704F10445FA452A7291DBF8A980CB59

Function 0040D2E9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040D2EE

Strings

lax.application.name, xrefs: 0040D30C
LaunchAnywhere, xrefs: 0040D332

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: H_prolog
String ID: LaunchAnywhere$lax.application.name
API String ID: 3519838083-2002782635
Opcode ID: 40002d3bf324629e762742df3b633bc2a95dad7d20e3363427d9b6354151a1e5
Instruction ID: 3a187570a8b11176efac54b76b42f051ad089738f60c42394eecc0526552fe91
Opcode Fuzzy Hash: 40002d3bf324629e762742df3b633bc2a95dad7d20e3363427d9b6354151a1e5
Instruction Fuzzy Hash: 61F09071F44254ABC705BF59E94779C7B60EB1032AFA0822FF811672D1C7BC9644CA5D

Function 004112FF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00411304

Part of subcall function 00401163: __EH_prolog.LIBCMT ref: 00401168

Part of subcall function 00415747: KiUserExceptionDispatcher.NTDLL(?,?,00401278,004281F4,?,/A,?,?,?,00413083,00401278,004281F4,0042D4A8,00401278,00401278,?), ref: 00415775

Strings

pEB, xrefs: 0041132E
deque<T> too long, xrefs: 0041130C

Memory Dump Source

Source File: 00000000.00000002.2043765965.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043751029.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.0000000000430000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043765965.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Infor IDF Auxiliary Machine.jbxd

Similarity

API ID: H_prolog$DispatcherExceptionUser
String ID: deque<T> too long$pEB
API String ID: 1370957130-2064984450
Opcode ID: 4231c20796b8a1549b54ce2d192d6f1a532675f22beba54fabbb4bbcb2246086
Instruction ID: eaa2d0e769b3d031f2bf12c30002e81721ee0c33293d6e8fac651faa5a5b3c6a
Opcode Fuzzy Hash: 4231c20796b8a1549b54ce2d192d6f1a532675f22beba54fabbb4bbcb2246086
Instruction Fuzzy Hash: BDE0E6B1A10118D6C704F7D1ED46ADD77B8BF1474CF90406BE111B5095DFB85648CB69

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Infor IDF Auxiliary Machine.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: Infor IDF Auxiliary Machine.exePID: 7316, Parent PID: 1028

General

Chronological Activities

Analysis Process: conhost.exePID: 7324, Parent PID: 7316

General

Chronological Activities

Disassembly

Analysis Process: Infor IDF Auxiliary Machine.exePID: 7316, Parent PID: 1028COMMON

Execution Graph

Graph

Windows Analysis Report
Infor IDF Auxiliary Machine.exe

Function 00414FC6 Relevance: 7.6, APIs: 5, Instructions: 121
COMMON

Function 00411F19 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 119
libraryCOMMON

Function 0041B5F1 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 172
COMMON

Function 00417BCA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 13
libraryloaderCOMMONLIBRARYCODE

Function 0040BEED Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 289
COMMON

Function 00402979 Relevance: 6.1, APIs: 4, Instructions: 78
stringCOMMON

Function 0040DA80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71
keyboardCOMMON

Function 00415747 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24
COMMONLIBRARYCODE

Function 0040BC90 Relevance: 3.1, APIs: 2, Instructions: 104
COMMON

Function 005704AB Relevance: 3.0, APIs: 2, Instructions: 33
libraryloaderCOMMON

Function 00570C74 Relevance: 3.0, APIs: 2, Instructions: 30
memoryCOMMON

Function 0041A748 Relevance: 3.0, APIs: 2, Instructions: 26
memoryCOMMON

Function 00570304 Relevance: 2.7, APIs: 2, Instructions: 165
memoryCOMMON

Function 0040C25F Relevance: 1.6, APIs: 1, Instructions: 108
COMMON