Edit tour

Windows Analysis Report
e90zPYFENm.exe

Overview

General Information

Sample name:	e90zPYFENm.exe renamed because original name is a hash value
Original sample name:	4ef776934710c9c4f067287fe73f1c94902d9290f0e40e7da83629589c4510aa.exe
Analysis ID:	1502168
MD5:	94807b134058d14399767d8f5d84a5d5
SHA1:	b01a404085091bd567e9c129baecf8230ccbfc46
SHA256:	4ef776934710c9c4f067287fe73f1c94902d9290f0e40e7da83629589c4510aa
Tags:	119-45-147-28exe
Infos:

Detection

Metasploit

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Metasploit Payload

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Internet Provider seen in connection with other malware

PE file contains sections with non-standard names

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Suricata IDS alerts with low severity for network traffic

Yara signature match

Classification

Process Tree

System is w10x64

e90zPYFENm.exe (PID: 6628 cmdline: "C:\Users\user\Desktop\e90zPYFENm.exe" MD5: 94807B134058D14399767D8F5D84A5D5)

cleanup

Malware Configuration

Threatname: Metasploit

{"Type": "Metasploit Download", "URL": "http://119.45.147.28/cLzHwODM/SM8omDxZewgwWjFYVimA4g64y1JdIzY4ApXywlnL9_kGiyhwOZf2xLuhPjwY_i"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.3304629088.0000022BBCE50000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000000.00000002.3304629088.0000022BBCE50000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_0f5a852d	Identifies 64 bit metasploit wininet reverse shellcode. May also be used by other malware families.	unknown	0x14cb:$a: 49 BE 77 69 6E 69 6E 65 74 00 41 56 48 89 E1 49 C7 C2 4C 77 26 07 FF D5
00000000.00000002.3304629088.0000022BBCE50000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x1471:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000002.3304616074.0000022BBCDE0000.00000040.00000020.00020000.00000000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000000.00000002.3304616074.0000022BBCDE0000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_0f5a852d	Identifies 64 bit metasploit wininet reverse shellcode. May also be used by other malware families.	unknown	0x93b:$a: 49 BE 77 69 6E 69 6E 65 74 00 41 56 48 89 E1 49 C7 C2 4C 77 26 07 FF D5
00000000.00000002.3304616074.0000022BBCDE0000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x8e1:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
Click to see the 1 entries

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.5 - Destination IP: 119.45.147.28

Timestamp:	2024-08-31T11:47:46.313345+0200
SID:	2028765
Severity:	3
Source Port:	49715
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.5 - Destination IP: 119.45.147.28

Timestamp:	2024-08-31T11:45:56.078747+0200
SID:	2028765
Severity:	3
Source Port:	49717
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.5 - Destination IP: 119.45.147.28

Timestamp:	2024-08-31T11:47:09.235138+0200
SID:	2028765
Severity:	3
Source Port:	49713
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.5 - Destination IP: 119.45.147.28

Timestamp:	2024-08-31T11:46:32.079108+0200
SID:	2028765
Severity:	3
Source Port:	49704
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.3304629088.0000022BBCE50000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Metasploit {"Type": "Metasploit Download", "URL": "http://119.45.147.28/cLzHwODM/SM8omDxZewgwWjFYVimA4g64y1JdIzY4ApXywlnL9_kGiyhwOZf2xLuhPjwY_i"}

Multi AV Scanner detection for submitted file

Source: e90zPYFENm.exe	ReversingLabs: Detection: 60%
Source: e90zPYFENm.exe	Virustotal: Detection: 53%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: e90zPYFENm.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH

Source: C:\Users\user\Desktop\e90zPYFENm.exe

Code function: 4x nop then push rbx

0_2_00007FF71F481C94

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://119.45.147.28/cLzHwODM/SM8omDxZewgwWjFYVimA4g64y1JdIzY4ApXywlnL9_kGiyhwOZf2xLuhPjwY_i

Source: Joe Sandbox View

ASN Name: CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa

Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49715 -> 119.45.147.28:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49713 -> 119.45.147.28:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49704 -> 119.45.147.28:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49717 -> 119.45.147.28:443

Source: unknown	TCP traffic detected without corresponding DNS query: 119.45.147.28
Source: unknown	TCP traffic detected without corresponding DNS query: 119.45.147.28
Source: unknown	TCP traffic detected without corresponding DNS query: 119.45.147.28
Source: unknown	TCP traffic detected without corresponding DNS query: 119.45.147.28
Source: unknown	TCP traffic detected without corresponding DNS query: 119.45.147.28
Source: unknown	TCP traffic detected without corresponding DNS query: 119.45.147.28
Source: unknown	TCP traffic detected without corresponding DNS query: 119.45.147.28
Source: unknown	TCP traffic detected without corresponding DNS query: 119.45.147.28
Source: unknown	TCP traffic detected without corresponding DNS query: 119.45.147.28
Source: unknown	TCP traffic detected without corresponding DNS query: 119.45.147.28
Source: unknown	TCP traffic detected without corresponding DNS query: 119.45.147.28
Source: unknown	TCP traffic detected without corresponding DNS query: 119.45.147.28
Source: unknown	TCP traffic detected without corresponding DNS query: 119.45.147.28
Source: unknown	TCP traffic detected without corresponding DNS query: 119.45.147.28
Source: unknown	TCP traffic detected without corresponding DNS query: 119.45.147.28

Source: e90zPYFENm.exe, 00000000.00000002.3304460732.0000022BBCC0A000.00000004.00000020.00020000.00000000.sdmp, e90zPYFENm.exe, 00000000.00000003.2365454475.0000022BBCBEE000.00000004.00000020.00020000.00000000.sdmp, e90zPYFENm.exe, 00000000.00000002.3304460732.0000022BBCBEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://119.45.147.28/
Source: e90zPYFENm.exe, 00000000.00000002.3304460732.0000022BBCC0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://119.45.147.28/LzHwODM/SM8omDxZewgwWjFYVimA4g64y1JdIzY4ApXywlnL9_kGiyhwOZf2xLuhPjwY_i
Source: e90zPYFENm.exe, 00000000.00000003.2365454475.0000022BBCC0A000.00000004.00000020.00020000.00000000.sdmp, e90zPYFENm.exe, 00000000.00000002.3304460732.0000022BBCC0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://119.45.147.28/a81-46d0-b6b6-535557bcc5fa
Source: e90zPYFENm.exe, 00000000.00000003.2365454475.0000022BBCBEE000.00000004.00000020.00020000.00000000.sdmp, e90zPYFENm.exe, 00000000.00000002.3304460732.0000022BBCBEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://119.45.147.28/cLzHwODM/SM8omDxZewgwWjFYVimA4g64y1JdIzY4ApXywlnL9_kGiyhwOZf2xLuhPjwY_i
Source: e90zPYFENm.exe, 00000000.00000003.2365454475.0000022BBCC0A000.00000004.00000020.00020000.00000000.sdmp, e90zPYFENm.exe, 00000000.00000002.3304460732.0000022BBCC0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://119.45.147.28/cLzHwODM/SM8omDxZewgwWjFYVimA4g64y1JdIzY4ApXywlnL9_kGiyhwOZf2xLuhPjwY_i)
Source: e90zPYFENm.exe, 00000000.00000002.3304460732.0000022BBCC14000.00000004.00000020.00020000.00000000.sdmp, e90zPYFENm.exe, 00000000.00000003.2365517788.0000022BBCC24000.00000004.00000020.00020000.00000000.sdmp, e90zPYFENm.exe, 00000000.00000003.2365454475.0000022BBCC14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://119.45.147.28/cLzHwODM/SM8omDxZewgwWjFYVimA4g64y1JdIzY4ApXywlnL9_kGiyhwOZf2xLuhPjwY_iuq
Source: e90zPYFENm.exe, 00000000.00000002.3304460732.0000022BBCC14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://119.45.147.28/mP%
Source: e90zPYFENm.exe, 00000000.00000003.2365454475.0000022BBCBEE000.00000004.00000020.00020000.00000000.sdmp, e90zPYFENm.exe, 00000000.00000002.3304460732.0000022BBCBEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://119.45.147.28/u

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.3304629088.0000022BBCE50000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies 64 bit metasploit wininet reverse shellcode. May also be used by other malware families. Author: unknown
Source: 00000000.00000002.3304629088.0000022BBCE50000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000002.3304616074.0000022BBCDE0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies 64 bit metasploit wininet reverse shellcode. May also be used by other malware families. Author: unknown
Source: 00000000.00000002.3304616074.0000022BBCDE0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown

Source: C:\Users\user\Desktop\e90zPYFENm.exe	Code function: 0_2_00007FF71F48D860	0_2_00007FF71F48D860
Source: C:\Users\user\Desktop\e90zPYFENm.exe	Code function: 0_2_00007FF71F48BA50	0_2_00007FF71F48BA50
Source: C:\Users\user\Desktop\e90zPYFENm.exe	Code function: 0_2_00007FF71F488F00	0_2_00007FF71F488F00
Source: C:\Users\user\Desktop\e90zPYFENm.exe	Code function: 0_2_00007FF71F483D58	0_2_00007FF71F483D58
Source: C:\Users\user\Desktop\e90zPYFENm.exe	Code function: 0_2_00007FF71F487D20	0_2_00007FF71F487D20
Source: C:\Users\user\Desktop\e90zPYFENm.exe	Code function: 0_2_00007FF71F48B550	0_2_00007FF71F48B550
Source: C:\Users\user\Desktop\e90zPYFENm.exe	Code function: 0_2_00007FF71F48E1F0	0_2_00007FF71F48E1F0
Source: C:\Users\user\Desktop\e90zPYFENm.exe	Code function: 0_2_00007FF71F4827F0	0_2_00007FF71F4827F0
Source: C:\Users\user\Desktop\e90zPYFENm.exe	Code function: 0_2_0000022BBCDE0936	0_2_0000022BBCDE0936

Source: 00000000.00000002.3304629088.0000022BBCE50000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_0f5a852d os = windows, severity = x86, description = Identifies 64 bit metasploit wininet reverse shellcode. May also be used by other malware families., creation_date = 2021-04-07, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = 97daac4249e85a73d4e6a4450248e59e0d286d5e7c230cf32a38608f8333f00d, id = 0f5a852d-cacd-43d7-8754-204b09afba2f, last_modified = 2021-08-23
Source: 00000000.00000002.3304629088.0000022BBCE50000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000002.3304616074.0000022BBCDE0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_0f5a852d os = windows, severity = x86, description = Identifies 64 bit metasploit wininet reverse shellcode. May also be used by other malware families., creation_date = 2021-04-07, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = 97daac4249e85a73d4e6a4450248e59e0d286d5e7c230cf32a38608f8333f00d, id = 0f5a852d-cacd-43d7-8754-204b09afba2f, last_modified = 2021-08-23
Source: 00000000.00000002.3304616074.0000022BBCDE0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23

Source: classification engine

Classification label: mal80.troj.winEXE@1/0@0/1

Source: e90zPYFENm.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\e90zPYFENm.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: e90zPYFENm.exe	ReversingLabs: Detection: 60%
Source: e90zPYFENm.exe	Virustotal: Detection: 53%

Source: C:\Users\user\Desktop\e90zPYFENm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\e90zPYFENm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\e90zPYFENm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\e90zPYFENm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\e90zPYFENm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\e90zPYFENm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\e90zPYFENm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\e90zPYFENm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\e90zPYFENm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\e90zPYFENm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\e90zPYFENm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\e90zPYFENm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\e90zPYFENm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\e90zPYFENm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\e90zPYFENm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\e90zPYFENm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\e90zPYFENm.exe	Section loaded: schannel.dll	Jump to behavior

Source: C:\Users\user\Desktop\e90zPYFENm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: e90zPYFENm.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: e90zPYFENm.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH

Source: e90zPYFENm.exe

Static PE information: section name: .xdata

Source: C:\Users\user\Desktop\e90zPYFENm.exe

API coverage: 5.6 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\e90zPYFENm.exe

Last function: Thread delayed

Source: e90zPYFENm.exe, 00000000.00000003.2365454475.0000022BBCBEE000.00000004.00000020.00020000.00000000.sdmp, e90zPYFENm.exe, 00000000.00000002.3304460732.0000022BBCBEE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: e90zPYFENm.exe, 00000000.00000002.3304460732.0000022BBCC14000.00000004.00000020.00020000.00000000.sdmp, e90zPYFENm.exe, 00000000.00000003.2365517788.0000022BBCC24000.00000004.00000020.00020000.00000000.sdmp, e90zPYFENm.exe, 00000000.00000003.2365454475.0000022BBCC14000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: e90zPYFENm.exe, 00000000.00000002.3304460732.0000022BBCC14000.00000004.00000020.00020000.00000000.sdmp, e90zPYFENm.exe, 00000000.00000003.2365517788.0000022BBCC24000.00000004.00000020.00020000.00000000.sdmp, e90zPYFENm.exe, 00000000.00000003.2365454475.0000022BBCC14000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWQC

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\e90zPYFENm.exe

Code function: 0_2_00007FF71F481180 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_initterm,

0_2_00007FF71F481180

Remote Access Functionality

Yara detected Metasploit Payload

Source: Yara match	File source: 00000000.00000002.3304629088.0000022BBCE50000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3304616074.0000022BBCDE0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 DLL Side-Loading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Obfuscated Files or Information	LSASS Memory	1 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	11 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
e90zPYFENm.exe	61%	ReversingLabs	Win64.Backdoor.Swrort
e90zPYFENm.exe	53%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
https://119.45.147.28/cLzHwODM/SM8omDxZewgwWjFYVimA4g64y1JdIzY4ApXywlnL9_kGiyhwOZf2xLuhPjwY_i	0%	Avira URL Cloud	safe
https://119.45.147.28/cLzHwODM/SM8omDxZewgwWjFYVimA4g64y1JdIzY4ApXywlnL9_kGiyhwOZf2xLuhPjwY_i)	0%	Avira URL Cloud	safe
https://119.45.147.28/LzHwODM/SM8omDxZewgwWjFYVimA4g64y1JdIzY4ApXywlnL9_kGiyhwOZf2xLuhPjwY_i	0%	Avira URL Cloud	safe
http://119.45.147.28/cLzHwODM/SM8omDxZewgwWjFYVimA4g64y1JdIzY4ApXywlnL9_kGiyhwOZf2xLuhPjwY_i	0%	Avira URL Cloud	safe
https://119.45.147.28/a81-46d0-b6b6-535557bcc5fa	0%	Avira URL Cloud	safe
https://119.45.147.28/	0%	Avira URL Cloud	safe
https://119.45.147.28/u	0%	Avira URL Cloud	safe
https://119.45.147.28/cLzHwODM/SM8omDxZewgwWjFYVimA4g64y1JdIzY4ApXywlnL9_kGiyhwOZf2xLuhPjwY_iuq	0%	Avira URL Cloud	safe
https://119.45.147.28/mP%	0%	Avira URL Cloud	safe
https://119.45.147.28/cLzHwODM/SM8omDxZewgwWjFYVimA4g64y1JdIzY4ApXywlnL9_kGiyhwOZf2xLuhPjwY_i	0%	Virustotal		Browse
https://119.45.147.28/	2%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://119.45.147.28/cLzHwODM/SM8omDxZewgwWjFYVimA4g64y1JdIzY4ApXywlnL9_kGiyhwOZf2xLuhPjwY_i	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://119.45.147.28/cLzHwODM/SM8omDxZewgwWjFYVimA4g64y1JdIzY4ApXywlnL9_kGiyhwOZf2xLuhPjwY_i)	e90zPYFENm.exe, 00000000.00000003.2365454475.0000022BBCC0A000.00000004.00000020.00020000.00000000.sdmp, e90zPYFENm.exe, 00000000.00000002.3304460732.0000022BBCC0A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://119.45.147.28/cLzHwODM/SM8omDxZewgwWjFYVimA4g64y1JdIzY4ApXywlnL9_kGiyhwOZf2xLuhPjwY_i	e90zPYFENm.exe, 00000000.00000003.2365454475.0000022BBCBEE000.00000004.00000020.00020000.00000000.sdmp, e90zPYFENm.exe, 00000000.00000002.3304460732.0000022BBCBEE000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://119.45.147.28/a81-46d0-b6b6-535557bcc5fa	e90zPYFENm.exe, 00000000.00000003.2365454475.0000022BBCC0A000.00000004.00000020.00020000.00000000.sdmp, e90zPYFENm.exe, 00000000.00000002.3304460732.0000022BBCC0A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://119.45.147.28/LzHwODM/SM8omDxZewgwWjFYVimA4g64y1JdIzY4ApXywlnL9_kGiyhwOZf2xLuhPjwY_i	e90zPYFENm.exe, 00000000.00000002.3304460732.0000022BBCC0A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://119.45.147.28/	e90zPYFENm.exe, 00000000.00000002.3304460732.0000022BBCC0A000.00000004.00000020.00020000.00000000.sdmp, e90zPYFENm.exe, 00000000.00000003.2365454475.0000022BBCBEE000.00000004.00000020.00020000.00000000.sdmp, e90zPYFENm.exe, 00000000.00000002.3304460732.0000022BBCBEE000.00000004.00000020.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://119.45.147.28/u	e90zPYFENm.exe, 00000000.00000003.2365454475.0000022BBCBEE000.00000004.00000020.00020000.00000000.sdmp, e90zPYFENm.exe, 00000000.00000002.3304460732.0000022BBCBEE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://119.45.147.28/cLzHwODM/SM8omDxZewgwWjFYVimA4g64y1JdIzY4ApXywlnL9_kGiyhwOZf2xLuhPjwY_iuq	e90zPYFENm.exe, 00000000.00000002.3304460732.0000022BBCC14000.00000004.00000020.00020000.00000000.sdmp, e90zPYFENm.exe, 00000000.00000003.2365517788.0000022BBCC24000.00000004.00000020.00020000.00000000.sdmp, e90zPYFENm.exe, 00000000.00000003.2365454475.0000022BBCC14000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://119.45.147.28/mP%	e90zPYFENm.exe, 00000000.00000002.3304460732.0000022BBCC14000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
119.45.147.28	unknown	China		45090	CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1502168
Start date and time:	2024-08-31 11:45:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	e90zPYFENm.exe renamed because original name is a hash value
Original Sample Name:	4ef776934710c9c4f067287fe73f1c94902d9290f0e40e7da83629589c4510aa.exe
Detection:	MAL
Classification:	mal80.troj.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 4 Number of non-executed functions: 23
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa	linux_amd64.elf	Get hash	malicious	Unknown	Browse	119.29.233.208
	SecuriteInfo.com.Linux.Siggen.9999.28377.24731.elf	Get hash	malicious	Mirai	Browse	152.136.47.156
	BjdhvHE9Lu.exe	Get hash	malicious	Unknown	Browse	122.51.240.117
	SecuriteInfo.com.Trojan.DownLoader46.48074.21382.27832.exe	Get hash	malicious	Unknown	Browse	106.53.77.23
	firmware.m68k.elf	Get hash	malicious	Unknown	Browse	140.143.139.193
	KKveTTgaAAsecNNaaaa.sh4.elf	Get hash	malicious	Unknown	Browse	146.56.230.81
	KKveTTgaAAsecNNaaaa.spc.elf	Get hash	malicious	Unknown	Browse	120.53.107.161
	KKveTTgaAAsecNNaaaa.mpsl.elf	Get hash	malicious	Unknown	Browse	118.28.5.155
	kovENvYM9C.elf	Get hash	malicious	Unknown	Browse	134.175.132.160
	pzGt29I16y.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	111.229.0.18

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.042459121075471
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	e90zPYFENm.exe
File size:	73'728 bytes
MD5:	94807b134058d14399767d8f5d84a5d5
SHA1:	b01a404085091bd567e9c129baecf8230ccbfc46
SHA256:	4ef776934710c9c4f067287fe73f1c94902d9290f0e40e7da83629589c4510aa
SHA512:	e5a07dbf6bfd47283bca22b12c9f2aa080427c9c7650f92d19b194ca7ed156bd10307b027206f6b24296931ee26d514fb777145515e2208c8959a03b38c24d58
SSDEEP:	1536:8F++kp8oc6BQwZjKuJHo9WOqvKGoRGL8qVUdzrsgcFJhnItmT53m:lvzc6BQwZjKuJI9WrsRGL3OcFJhItmhm
TLSH:	D6732A67F3A350F8C113C574459B67B2EA31BC214874BB6D87E0EA722E22E51FE69311
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....sf...............).......................@...................................../....`... ............................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x1400013d0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH
Time Stamp:	0x6673B0BA [Thu Jun 20 04:31:54 2024 UTC]
TLS Callbacks:	0x40001560, 0x1, 0x40001530, 0x1
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	c723e9af32e40ee9cd97441df2c4ea30

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00010D25h]
mov dword ptr [eax], 00000001h
call 00007F2E0CE79AAFh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00010D05h]
mov dword ptr [eax], 00000000h
call 00007F2E0CE79A8Fh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
call 00007F2E0CE8783Ch
dec eax
cmp eax, 01h
sbb eax, eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007F2E0CE79CE9h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [0000EBA5h]
dec eax
mov eax, dword ptr [eax]
dec eax
test eax, eax
je 00007F2E0CE79D34h
nop dword ptr [eax+eax+00h]
call eax
dec eax
mov eax, dword ptr [0000EB8Fh]
dec eax
lea edx, dword ptr [eax+08h]
dec eax
mov eax, dword ptr [eax+08h]
dec eax
mov dword ptr [0000EB80h], edx
dec eax
test eax, eax
jne 00007F2E0CE79CF5h
dec eax
add esp, 28h
ret
nop word ptr [eax+eax+00h]
push esi
push ebx
dec eax
sub esp, 28h
dec eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x16000	0x8d0	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x13000	0x57c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x19000	0x94	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x11540	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x16258	0x208	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xe328	0xe400	43a91766180d67c8ce111e9bd941a8d7	False	0.5532997532894737	data	6.187637412043698	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x10000	0x100	0x200	395a4e9f11c8b3f97e55c1b5c78206d1	False	0.1640625	data	1.1390273388522143	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x11000	0x1830	0x1a00	f17419416e8e79e96db0d0ad7233fdb1	False	0.3117487980769231	data	4.893737932260672	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pdata	0x13000	0x57c	0x600	d2e16b3786312bc2fc3648be71769094	False	0.4934895833333333	data	4.309111008094311	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xdata	0x14000	0x56c	0x600	c8cc16dc306ff100e0c055a12467a5cb	False	0.3053385416666667	data	4.1806771646521055	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x15000	0xc80	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x16000	0x8d0	0xa00	45a3787a44cc66bf355793a2da7abe04	False	0.319921875	data	3.819323089090164	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x17000	0x60	0x200	eb9c3cc3a0b4c9366754ba7755a2651d	False	0.068359375	data	0.28265357431271465	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x18000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x19000	0x94	0x200	9d7a9b2d83b3d1cf4c2b0abc53f9f8d0	False	0.267578125	data	1.6272808376258594	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	DeleteCriticalSection, EnterCriticalSection, GetLastError, HeapAlloc, HeapCreate, InitializeCriticalSection, IsDBCSLeadByteEx, LeaveCriticalSection, MultiByteToWideChar, SetUnhandledExceptionFilter, Sleep, TlsGetValue, VirtualProtect, VirtualQuery, WideCharToMultiByte
msvcrt.dll	__C_specific_handler, ___lc_codepage_func, ___mb_cur_max_func, __getmainargs, __initenv, __iob_func, __set_app_type, __setusermatherr, _amsg_exit, _cexit, _commode, _errno, _fmode, _initterm, _lock, _onexit, _strrev, _unlock, abort, calloc, exit, fprintf, fputc, free, fwrite, getc, isspace, isxdigit, localeconv, malloc, memcpy, memmove, memset, realloc, signal, strerror, strlen, strncmp, strtol, strtoul, tolower, ungetc, vfprintf, wcslen, _strtoui64, _strtoi64
USER32.dll	EnumWindows

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-31T11:47:46.313345+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	49715	443	192.168.2.5	119.45.147.28
2024-08-31T11:45:56.078747+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	49717	443	192.168.2.5	119.45.147.28
2024-08-31T11:47:09.235138+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	49713	443	192.168.2.5	119.45.147.28
2024-08-31T11:46:32.079108+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	49704	443	192.168.2.5	119.45.147.28

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 31, 2024 11:46:00.002305984 CEST	49704	443	192.168.2.5	119.45.147.28
Aug 31, 2024 11:46:00.002336025 CEST	443	49704	119.45.147.28	192.168.2.5
Aug 31, 2024 11:46:00.002466917 CEST	49704	443	192.168.2.5	119.45.147.28
Aug 31, 2024 11:46:00.010966063 CEST	49704	443	192.168.2.5	119.45.147.28
Aug 31, 2024 11:46:00.010977983 CEST	443	49704	119.45.147.28	192.168.2.5
Aug 31, 2024 11:46:32.079108000 CEST	49704	443	192.168.2.5	119.45.147.28
Aug 31, 2024 11:46:37.096266985 CEST	49713	443	192.168.2.5	119.45.147.28
Aug 31, 2024 11:46:37.096312046 CEST	443	49713	119.45.147.28	192.168.2.5
Aug 31, 2024 11:46:37.096410036 CEST	49713	443	192.168.2.5	119.45.147.28
Aug 31, 2024 11:46:37.097058058 CEST	49713	443	192.168.2.5	119.45.147.28
Aug 31, 2024 11:46:37.097073078 CEST	443	49713	119.45.147.28	192.168.2.5
Aug 31, 2024 11:47:09.235137939 CEST	49713	443	192.168.2.5	119.45.147.28
Aug 31, 2024 11:47:14.253420115 CEST	49715	443	192.168.2.5	119.45.147.28
Aug 31, 2024 11:47:14.253467083 CEST	443	49715	119.45.147.28	192.168.2.5
Aug 31, 2024 11:47:14.253551960 CEST	49715	443	192.168.2.5	119.45.147.28
Aug 31, 2024 11:47:14.253942013 CEST	49715	443	192.168.2.5	119.45.147.28
Aug 31, 2024 11:47:14.253957987 CEST	443	49715	119.45.147.28	192.168.2.5
Aug 31, 2024 11:47:46.313344955 CEST	49715	443	192.168.2.5	119.45.147.28
Aug 31, 2024 11:47:51.332501888 CEST	49717	443	192.168.2.5	119.45.147.28
Aug 31, 2024 11:47:51.332542896 CEST	443	49717	119.45.147.28	192.168.2.5
Aug 31, 2024 11:47:51.332633972 CEST	49717	443	192.168.2.5	119.45.147.28
Aug 31, 2024 11:47:51.332951069 CEST	49717	443	192.168.2.5	119.45.147.28
Aug 31, 2024 11:47:51.332964897 CEST	443	49717	119.45.147.28	192.168.2.5

Target ID:	0
Start time:	05:45:58
Start date:	31/08/2024
Path:	C:\Users\user\Desktop\e90zPYFENm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\e90zPYFENm.exe"
Imagebase:	0x7ff71f480000
File size:	73'728 bytes
MD5 hash:	94807B134058D14399767D8F5D84A5D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000000.00000002.3304629088.0000022BBCE50000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Metasploit_0f5a852d, Description: Identifies 64 bit metasploit wininet reverse shellcode. May also be used by other malware families., Source: 00000000.00000002.3304629088.0000022BBCE50000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000002.3304629088.0000022BBCE50000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000000.00000002.3304616074.0000022BBCDE0000.00000040.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Metasploit_0f5a852d, Description: Identifies 64 bit metasploit wininet reverse shellcode. May also be used by other malware families., Source: 00000000.00000002.3304616074.0000022BBCDE0000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000002.3304616074.0000022BBCDE0000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	2.3%
Dynamic/Decrypted Code Coverage:	1.7%
Signature Coverage:	35.4%
Total number of Nodes:	1332
Total number of Limit Nodes:	8

Executed Functions

Function 0000022BBCDE0936 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 155
networklibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(696E6977,00000000), ref: 0000022BBCDE0951
InternetOpenA.WININET(00000000,00000000,00000000,00000000), ref: 0000022BBCDE096C
InternetConnectA.WININET(00000000,00000003,00000000,00000000), ref: 0000022BBCDE099E
HttpOpenRequestA.WININET(00000000,00000000,84A83200,00000000), ref: 0000022BBCDE0A0D
SleepEx.KERNEL32 ref: 0000022BBCDE0A62

Strings

wini, xrefs: 0000022BBCDE093C
U.;, xrefs: 0000022BBCDE0A07

Memory Dump Source

Source File: 00000000.00000002.3304616074.0000022BBCDE0000.00000040.00000020.00020000.00000000.sdmp, Offset: 0000022BBCDE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22bbcde0000_e90zPYFENm.jbxd

Yara matches

Similarity

API ID: InternetOpen$ConnectHttpLibraryLoadRequestSleep
String ID: wini$U.;
API String ID: 4156943158-3145566601
Opcode ID: a5eb2bfbb48236b9f5e03990cf58c1459f3e014b76e6d2055f02eac3c489b5ad
Instruction ID: 4a8a161dea5e73afdd9bf82d9ec16aa1eb6a8371a4fe2cbf0bc7a1c17392d745
Opcode Fuzzy Hash: a5eb2bfbb48236b9f5e03990cf58c1459f3e014b76e6d2055f02eac3c489b5ad
Instruction Fuzzy Hash: 40417AB420DB8D3FF62B86A45C9A7363BD8D75231AF15419BE409CA0E3DF109C42D225

Function 00007FF71F48F1B0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strrev.MSVCRT ref: 00007FF71F48F207
HeapCreate.KERNEL32 ref: 00007FF71F48F25F
HeapAlloc.KERNEL32 ref: 00007FF71F48F270
memcpy.MSVCRT ref: 00007FF71F48F287
EnumWindows.USER32 ref: 00007FF71F48F291

Strings

malloc error, xrefs: 00007FF71F48F2BF
HeapAlloc error, xrefs: 00007FF71F48F2A8
%02X, xrefs: 00007FF71F48F21C
5dff652a5b0f2c7c949500a6853c852d570c583c108470b8662b470c58024c38845dff000000002e986921ab949f9894000002000c7c94ad98841f98847e9884353539845dff000000005e354a85ab94000001000c7c94012e1c1d9894a504a69535000000558eaabe2047fcff845dff000000000e530f44ab94000031881c7c84f1, xrefs: 00007FF71F48F1C2

Memory Dump Source

Source File: 00000000.00000002.3304676005.00007FF71F481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71F480000, based on PE: true

Associated: 00000000.00000002.3304663507.00007FF71F480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304691736.00007FF71F490000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304703508.00007FF71F491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304719446.00007FF71F496000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304734406.00007FF71F499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71f480000_e90zPYFENm.jbxd

Similarity

API ID: Heap$AllocCreateEnumWindows_strrevmemcpy
String ID: %02X$5dff652a5b0f2c7c949500a6853c852d570c583c108470b8662b470c58024c38845dff000000002e986921ab949f9894000002000c7c94ad98841f98847e9884353539845dff000000005e354a85ab94000001000c7c94012e1c1d9894a504a69535000000558eaabe2047fcff845dff000000000e530f44ab94000031881c7c84f1$HeapAlloc error$malloc error
API String ID: 3536678949-3941634086
Opcode ID: 64d016b2da3ce2ce84043f31314739661b4709f10f71af079073d7489af18caf
Instruction ID: 8b30cee1967fba67be03ab86893e6b1e8af11cf9a7b88789a02880b24558a59e
Opcode Fuzzy Hash: 64d016b2da3ce2ce84043f31314739661b4709f10f71af079073d7489af18caf
Instruction Fuzzy Hash: A621C221F088D281FA60AB95A802AF49251AF897B4F884135DF5C037D5DE2DE46EC320

Function 0000022BBCDE0981 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 169
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetConnectA.WININET(00000000,00000003,00000000,00000000), ref: 0000022BBCDE099E

Part of subcall function 0000022BBCDE09EE: HttpOpenRequestA.WININET(00000000,00000000,84A83200,00000000), ref: 0000022BBCDE0A0D
Part of subcall function 0000022BBCDE09EE: SleepEx.KERNEL32 ref: 0000022BBCDE0A62

Strings

U.;, xrefs: 0000022BBCDE0A07

Memory Dump Source

Source File: 00000000.00000002.3304616074.0000022BBCDE0000.00000040.00000020.00020000.00000000.sdmp, Offset: 0000022BBCDE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22bbcde0000_e90zPYFENm.jbxd

Yara matches

Similarity

API ID: ConnectHttpInternetOpenRequestSleep
String ID: U.;
API String ID: 3895984052-4213443877
Opcode ID: 8730739dbdf539c9d8469545232423d07924b0106fdb062cff5531683efb989e
Instruction ID: f0726608a38f425e4e1bdb3ac623adc70d40332931cc7b526ad6715ebcfee055
Opcode Fuzzy Hash: 8730739dbdf539c9d8469545232423d07924b0106fdb062cff5531683efb989e
Instruction Fuzzy Hash: 554168A434DB8E2EFB1B82642C9A7393BD8D756316F18419BE409CB0E3DF049C42D325

Function 0000022BBCDE09EE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 112
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HttpOpenRequestA.WININET(00000000,00000000,84A83200,00000000), ref: 0000022BBCDE0A0D
SleepEx.KERNEL32 ref: 0000022BBCDE0A62

Strings

U.;, xrefs: 0000022BBCDE0A07

Memory Dump Source

Source File: 00000000.00000002.3304616074.0000022BBCDE0000.00000040.00000020.00020000.00000000.sdmp, Offset: 0000022BBCDE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_22bbcde0000_e90zPYFENm.jbxd

Yara matches

Similarity

API ID: HttpOpenRequestSleep
String ID: U.;
API String ID: 1158879192-4213443877
Opcode ID: 67e9473b793039c9a067aaab8365836b73d283826e7db9fe2785357646bc4685
Instruction ID: 6c280a81a33f09d87c7023e1c98dcb5c551186372909b30bb8b5011a3fb5e5a1
Opcode Fuzzy Hash: 67e9473b793039c9a067aaab8365836b73d283826e7db9fe2785357646bc4685
Instruction Fuzzy Hash: A821F1A030EB8D2FFB1A42A92CAA73A2BD9C799355F15419BF409C71D3ED048C468229

Non-executed Functions

Function 00007FF71F4827F0 Relevance: 115.8, APIs: 62, Strings: 3, Instructions: 2069COMMON

Download Yara Rule

APIs

localeconv.MSVCRT ref: 00007FF71F482874
isspace.MSVCRT ref: 00007FF71F48291C
isspace.MSVCRT ref: 00007FF71F482949
free.MSVCRT ref: 00007FF71F4829B7
free.MSVCRT ref: 00007FF71F4829DD
free.MSVCRT ref: 00007FF71F4829F1
_errno.MSVCRT ref: 00007FF71F4843A3

Strings

%02X, xrefs: 00007FF71F4827FB
nil), xrefs: 00007FF71F484FAD
d, xrefs: 00007FF71F4835BB

Memory Dump Source

Source File: 00000000.00000002.3304676005.00007FF71F481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71F480000, based on PE: true

Associated: 00000000.00000002.3304663507.00007FF71F480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304691736.00007FF71F490000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304703508.00007FF71F491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304719446.00007FF71F496000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304734406.00007FF71F499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71f480000_e90zPYFENm.jbxd

Similarity

API ID: free$isspace$_errnolocaleconv
String ID: %02X$d$nil)
API String ID: 2709793498-4184343865
Opcode ID: cb9d6b6424dca7eb44c06a0f9810f03c00a886b6c2c6bb954b0dd72dc0257fa2
Instruction ID: 7152d905ea478a12e342efecb41f750231cf2f2f8d7d2d963d2f793373cc9aef
Opcode Fuzzy Hash: cb9d6b6424dca7eb44c06a0f9810f03c00a886b6c2c6bb954b0dd72dc0257fa2
Instruction Fuzzy Hash: 33238132A08EC181EA70AF95E4413FAE7A1FB84BA4F844135DE8D17798DF3CD9698710

Function 00007FF71F483D58 Relevance: 35.6, APIs: 19, Strings: 1, Instructions: 634COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00007FF71F483DBD
malloc.MSVCRT ref: 00007FF71F483E14
free.MSVCRT ref: 00007FF71F483EA6
malloc.MSVCRT ref: 00007FF71F483EC0
malloc.MSVCRT ref: 00007FF71F4846FC

Strings

d, xrefs: 00007FF71F483E4D

Memory Dump Source

Source File: 00000000.00000002.3304676005.00007FF71F481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71F480000, based on PE: true

Associated: 00000000.00000002.3304663507.00007FF71F480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304691736.00007FF71F490000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304703508.00007FF71F491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304719446.00007FF71F496000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304734406.00007FF71F499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71f480000_e90zPYFENm.jbxd

Similarity

API ID: malloc$free
String ID: d
API String ID: 1480856625-2564639436
Opcode ID: 131ef27ca4691028fb1a7228baac7c47d3a4c309360703faa99e5b5a9061d2e9
Instruction ID: dc5f6920ba015317fd935913431a42e6805fb7e9129fc6ef004f7a8ccd049285
Opcode Fuzzy Hash: 131ef27ca4691028fb1a7228baac7c47d3a4c309360703faa99e5b5a9061d2e9
Instruction Fuzzy Hash: E9527C32608EC581E670AF95E4413AAF7A0FB84BA4F844135DE8D57B98DF3CD8698B50

Function 00007FF71F48BA50 Relevance: 20.7, APIs: 8, Strings: 3, Instructions: 1496stringCOMMON

Download Yara Rule

APIs

localeconv.MSVCRT ref: 00007FF71F48BAA4
strlen.MSVCRT ref: 00007FF71F48BAAF

Strings

!, xrefs: 00007FF71F48D64A
5, xrefs: 00007FF71F48BFAA
inity, xrefs: 00007FF71F48C8F2

Memory Dump Source

Source File: 00000000.00000002.3304676005.00007FF71F481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71F480000, based on PE: true

Associated: 00000000.00000002.3304663507.00007FF71F480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304691736.00007FF71F490000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304703508.00007FF71F491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304719446.00007FF71F496000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304734406.00007FF71F499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71f480000_e90zPYFENm.jbxd

Similarity

API ID: localeconvstrlen
String ID: !$5$inity
API String ID: 186660782-42873854
Opcode ID: 05ca077ae447e9b1fdb261f0bb18fb7f8c63a250f1938c3c57181f937dd40871
Instruction ID: 3939468cc5ba693f76c7a51ad2511480beb769c5cfd58526e306301e333485d2
Opcode Fuzzy Hash: 05ca077ae447e9b1fdb261f0bb18fb7f8c63a250f1938c3c57181f937dd40871
Instruction Fuzzy Hash: 59E2B132A0CEC28AE760AE55E0413BAF7A1FB85754F948135DF8957B88DF7CE4588B10

Function 00007FF71F481180 Relevance: 10.6, APIs: 7, Instructions: 138
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,00007FF71F4813E6), ref: 00007FF71F4811BE
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF71F48122F
malloc.MSVCRT(?,?,?,00007FF71F4813E6), ref: 00007FF71F481263
strlen.MSVCRT ref: 00007FF71F481284
malloc.MSVCRT(?,?,?,00007FF71F4813E6), ref: 00007FF71F481290
memcpy.MSVCRT ref: 00007FF71F4812A8

Memory Dump Source

Source File: 00000000.00000002.3304676005.00007FF71F481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71F480000, based on PE: true

Associated: 00000000.00000002.3304663507.00007FF71F480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304691736.00007FF71F490000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304703508.00007FF71F491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304719446.00007FF71F496000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304734406.00007FF71F499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71f480000_e90zPYFENm.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandledmemcpystrlen
String ID:
API String ID: 3806033187-0
Opcode ID: d655491aba52ecd03ddb5c7e6c8ac608dfad1fd9990cabd9ca365f04205814f0
Instruction ID: 5727c67f374989364083e8541689ff51941856101aa7ebbf1fe0189131c7cc80
Opcode Fuzzy Hash: d655491aba52ecd03ddb5c7e6c8ac608dfad1fd9990cabd9ca365f04205814f0
Instruction Fuzzy Hash: 91513D35F09EC285F610BB95E452AF9A3A1BF887A0FD44036DE0C477A5DE2CE5698360

Function 00007FF71F48D860 Relevance: 9.6, APIs: 6, Instructions: 567COMMON

Download Yara Rule

APIs

localeconv.MSVCRT ref: 00007FF71F48D886
memset.MSVCRT ref: 00007FF71F48D9D7

Memory Dump Source

Source File: 00000000.00000002.3304676005.00007FF71F481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71F480000, based on PE: true

Associated: 00000000.00000002.3304663507.00007FF71F480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304691736.00007FF71F490000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304703508.00007FF71F491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304719446.00007FF71F496000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304734406.00007FF71F499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71f480000_e90zPYFENm.jbxd

Similarity

API ID: localeconvmemset
String ID:
API String ID: 2367598729-0
Opcode ID: ef1a6bd30c8b1ef5a52fd631b677cbfae8b7dee52f744d4fcd3a5c23dbbc6152
Instruction ID: c369908f943cd46d42d90685d7d7d8737267582ec0a4db44c643246d7a57f5e9
Opcode Fuzzy Hash: ef1a6bd30c8b1ef5a52fd631b677cbfae8b7dee52f744d4fcd3a5c23dbbc6152
Instruction Fuzzy Hash: C2223822E1D9D246F7356EA584667FDA6A2EF40760FC48031DE8E477C5DE3DE8688320

Function 00007FF71F488F00 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 1385COMMON

Download Yara Rule

Strings

NaN, xrefs: 00007FF71F4891D7
, xrefs: 00007FF71F48A6A4
Infinity, xrefs: 00007FF71F489258
, xrefs: 00007FF71F48A3C0

Memory Dump Source

Source File: 00000000.00000002.3304676005.00007FF71F481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71F480000, based on PE: true

Associated: 00000000.00000002.3304663507.00007FF71F480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304691736.00007FF71F490000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304703508.00007FF71F491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304719446.00007FF71F496000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304734406.00007FF71F499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71f480000_e90zPYFENm.jbxd

Similarity

API ID:
String ID: $ $Infinity$NaN
API String ID: 0-3274152445
Opcode ID: dcca4a87874c45ebe53ae7a518311002c5f8d39e343f3a03519ebd9b1d622fa5
Instruction ID: 32219fcbb2faea6cdfedf34c86690317542e75aea40bbe1ea52118886ae5bdb9
Opcode Fuzzy Hash: dcca4a87874c45ebe53ae7a518311002c5f8d39e343f3a03519ebd9b1d622fa5
Instruction Fuzzy Hash: BFD2F436A1CEC18AE751DF65A0013AAF790FB85BA0F508135EE4A53B99DB7CE458CF10

Function 00007FF71F481C94 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

signal.MSVCRT ref: 00007FF71F481D12

Strings

CCG , xrefs: 00007FF71F481CB5

Memory Dump Source

Source File: 00000000.00000002.3304676005.00007FF71F481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71F480000, based on PE: true

Associated: 00000000.00000002.3304663507.00007FF71F480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304691736.00007FF71F490000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304703508.00007FF71F491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304719446.00007FF71F496000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304734406.00007FF71F499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71f480000_e90zPYFENm.jbxd

Similarity

API ID: signal
String ID: CCG
API String ID: 1946981877-1584390748
Opcode ID: 078caccd7ddbff15b13bf485c5a42bb937047296e936ded84d5a91076c28fca1
Instruction ID: 06039fa27865943fb01bfbdb0f01291e3068af390e9546ca08c3c4c47acbab65
Opcode Fuzzy Hash: 078caccd7ddbff15b13bf485c5a42bb937047296e936ded84d5a91076c28fca1
Instruction Fuzzy Hash: 2F31B361E08EC642FA7876D494523F991C19FC9370F984937CE1E463D0ED1CF8A98221

Function 00007FF71F48B550 Relevance: 1.7, APIs: 1, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3304676005.00007FF71F481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71F480000, based on PE: true

Associated: 00000000.00000002.3304663507.00007FF71F480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304691736.00007FF71F490000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304703508.00007FF71F491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304719446.00007FF71F496000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304734406.00007FF71F499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71f480000_e90zPYFENm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59f5729228283e406f091fd05bcf3439b5adb8d913954f2c67c7e7fcbb07d5d7
Instruction ID: dc337f908a45d8638fefc9d252fde59161be832b74c765ecc77cc40aed4aea10
Opcode Fuzzy Hash: 59f5729228283e406f091fd05bcf3439b5adb8d913954f2c67c7e7fcbb07d5d7
Instruction Fuzzy Hash: 1A91FB72A186814FE764EE55D4026AFF6A1FB84794F985030ED4A47B59CE3CE8148F50

Function 00007FF71F487D20 Relevance: 1.5, Strings: 1, Instructions: 296COMMON

Download Yara Rule

Strings

., xrefs: 00007FF71F487E4E

Memory Dump Source

Source File: 00000000.00000002.3304676005.00007FF71F481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71F480000, based on PE: true

Associated: 00000000.00000002.3304663507.00007FF71F480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304691736.00007FF71F490000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304703508.00007FF71F491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304719446.00007FF71F496000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304734406.00007FF71F499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71f480000_e90zPYFENm.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: dc7c95912ea179b4376ebdfd1fe7d6f82869dd945337f08c514ca93ba6913bec
Instruction ID: 19ef22a363c0825d233a04bf77bb8a556c6b8c541c58c0e867604ebc34865e43
Opcode Fuzzy Hash: dc7c95912ea179b4376ebdfd1fe7d6f82869dd945337f08c514ca93ba6913bec
Instruction Fuzzy Hash: 9CB11C62A1CAC242F755EE65D4267F9E691AF40BA4F848130DE0E477C5DE3CED28C760

Function 00007FF71F48E1F0 Relevance: 1.5, APIs: 1, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3304676005.00007FF71F481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71F480000, based on PE: true

Associated: 00000000.00000002.3304663507.00007FF71F480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304691736.00007FF71F490000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304703508.00007FF71F491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304719446.00007FF71F496000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304734406.00007FF71F499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71f480000_e90zPYFENm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 619082e5d1d758878a90591e7221134443d7cce5a0ae1aefa5c4e06a65ae55e5
Instruction ID: c5cf4c605452798450fd28847850fc7dd2fa8e7e45c8cf0a2039b1dc47aeaaa4
Opcode Fuzzy Hash: 619082e5d1d758878a90591e7221134443d7cce5a0ae1aefa5c4e06a65ae55e5
Instruction Fuzzy Hash: 7BA13762B1C9E246FB70AED5C4067FDAA92AB85B64FC8C031DE0D07381DA3CE959C710

Function 00007FF71F481710 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 00007FF71F48182B

Strings

VirtualProtect failed with code 0x%x, xrefs: 00007FF71F48189E
Address %p has no image-section, xrefs: 00007FF71F481782, 00007FF71F4818D5
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF71F4818C1
Mingw-w64 runtime failure:, xrefs: 00007FF71F481747

Memory Dump Source

Source File: 00000000.00000002.3304676005.00007FF71F481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71F480000, based on PE: true

Associated: 00000000.00000002.3304663507.00007FF71F480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304691736.00007FF71F490000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304703508.00007FF71F491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304719446.00007FF71F496000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304734406.00007FF71F499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71f480000_e90zPYFENm.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 1804819252-1534286854
Opcode ID: 71d792bb3950f311a4e2a21dd10c19bbecff29a4fd1631c03ab2524e9a169855
Instruction ID: 937eecaf902e2f09da11558e192ae30d21e008cb541b8a75921266080297ad48
Opcode Fuzzy Hash: 71d792bb3950f311a4e2a21dd10c19bbecff29a4fd1631c03ab2524e9a169855
Instruction Fuzzy Hash: 1951B572B04E8681EB10AB51E842AE9E7A0FF88BA0FC44135DE0C07395DF3CD569C390

Function 00007FF71F486BE0 Relevance: 7.8, APIs: 5, Instructions: 299
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF71F486D61
fputc.MSVCRT ref: 00007FF71F486E92

Memory Dump Source

Source File: 00000000.00000002.3304676005.00007FF71F481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71F480000, based on PE: true

Associated: 00000000.00000002.3304663507.00007FF71F480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304691736.00007FF71F490000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304703508.00007FF71F491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304719446.00007FF71F496000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304734406.00007FF71F499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71f480000_e90zPYFENm.jbxd

Similarity

API ID: fputcmemset
String ID:
API String ID: 947785774-0
Opcode ID: 209c1731aa60b8188c4a74713effcc0fbdefc831f164e84461958d52e030fee1
Instruction ID: a046ac7d8511889ad9231c90267ac54bead73d30b1c1adeca8c8fb2cd8e63c8b
Opcode Fuzzy Hash: 209c1731aa60b8188c4a74713effcc0fbdefc831f164e84461958d52e030fee1
Instruction Fuzzy Hash: 4AB11AE3E189C186F7A5AE64C0063B9A6D1AB00778F944235CE1E1B7C5DA3CEC69C761

Function 00007FF71F4818F0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 231
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(00007FF71F495040,00007FF71F495048,00000001,?,?,?,?,00007FF8C6F6ADA0,00007FF71F481228,?,?,?,00007FF71F4813E6), ref: 00007FF71F481AED

Strings

Unknown pseudo relocation protocol version %d., xrefs: 00007FF71F481C3E
Unknown pseudo relocation bit size %d., xrefs: 00007FF71F481C32
%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p., xrefs: 00007FF71F481B57

Memory Dump Source

Source File: 00000000.00000002.3304676005.00007FF71F481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71F480000, based on PE: true

Associated: 00000000.00000002.3304663507.00007FF71F480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304691736.00007FF71F490000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304703508.00007FF71F491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304719446.00007FF71F496000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304734406.00007FF71F499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71f480000_e90zPYFENm.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.
API String ID: 544645111-1286557213
Opcode ID: 36ec8a0bd9c9db9cff83aa638c4881caaa891938c39ba8aeb5229d7aeee479fa
Instruction ID: 66a7efba23fcda9a0b593ed55e4c565fe75af73f10462879c145957700142f38
Opcode Fuzzy Hash: 36ec8a0bd9c9db9cff83aa638c4881caaa891938c39ba8aeb5229d7aeee479fa
Instruction Fuzzy Hash: 7B91D722F09DD286EB107BA0D5416F9E291BFD47B4F948237CE1D177D4EE2CE8698260

Function 00007FF71F487090 Relevance: 6.2, APIs: 4, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3304676005.00007FF71F481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71F480000, based on PE: true

Associated: 00000000.00000002.3304663507.00007FF71F480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304691736.00007FF71F490000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304703508.00007FF71F491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304719446.00007FF71F496000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304734406.00007FF71F499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71f480000_e90zPYFENm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51b8acbbacccaf3c209e84173bc199a407feaa41f58d89eed801a17a1f7e4c2e
Instruction ID: d9ea28d544478ddba59167dbd0cc1b3b421e8d508e624e2cf3c0d84129e5e563
Opcode Fuzzy Hash: 51b8acbbacccaf3c209e84173bc199a407feaa41f58d89eed801a17a1f7e4c2e
Instruction Fuzzy Hash: B191D872E08AC246E765DFA981113F9ABA1AB04BA4F948230DF1C177C5DB3CE875C760

Function 00007FF71F48EBA0 Relevance: 6.1, APIs: 4, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsDBCSLeadByteEx.KERNEL32 ref: 00007FF71F48EBFA
MultiByteToWideChar.KERNEL32 ref: 00007FF71F48EC3A

Memory Dump Source

Source File: 00000000.00000002.3304676005.00007FF71F481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71F480000, based on PE: true

Associated: 00000000.00000002.3304663507.00007FF71F480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304691736.00007FF71F490000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304703508.00007FF71F491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304719446.00007FF71F496000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304734406.00007FF71F499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71f480000_e90zPYFENm.jbxd

Similarity

API ID: Byte$CharLeadMultiWide
String ID:
API String ID: 2561704868-0
Opcode ID: 74f192261df9a2bba6bcf5d7fc0ebefca92e3bd53692434ac92c6f5afbbc8d65
Instruction ID: 00517e8e5fe874139532ff6a8d77e095b43c81d6b03f2ed2c44c2dd7a97e008d
Opcode Fuzzy Hash: 74f192261df9a2bba6bcf5d7fc0ebefca92e3bd53692434ac92c6f5afbbc8d65
Instruction Fuzzy Hash: 5631C372A0CAC18AE3709FA5F4417A9B7A0BB957A4F884134EE88477D5DF3DD468CB10

Function 00007FF71F4837D0 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FF71F482CE8
_errno.MSVCRT ref: 00007FF71F482CEF
isspace.MSVCRT ref: 00007FF71F482D2C
_errno.MSVCRT ref: 00007FF71F482D3E

Memory Dump Source

Source File: 00000000.00000002.3304676005.00007FF71F481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71F480000, based on PE: true

Associated: 00000000.00000002.3304663507.00007FF71F480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304691736.00007FF71F490000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304703508.00007FF71F491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304719446.00007FF71F496000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304734406.00007FF71F499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71f480000_e90zPYFENm.jbxd

Similarity

API ID: _errno$isspace
String ID:
API String ID: 2429013468-0
Opcode ID: 6fa136de3026300b2d5c982cc7f54e95ce620e40246dd4444c51e6d38a58bf29
Instruction ID: c658b3a45e34ebfe86053d2d22df83cc8bf0e5b2070ecd6351f539e7c2b01c44
Opcode Fuzzy Hash: 6fa136de3026300b2d5c982cc7f54e95ce620e40246dd4444c51e6d38a58bf29
Instruction Fuzzy Hash: A6118622D0CAC191F6706EE494423FDEAD1AB41360FD44239DB99236D2CF3CB969C721

Function 00007FF71F481600 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 00007FF71F481680

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF71F481667
Unknown error, xrefs: 00007FF71F4816EC

Memory Dump Source

Source File: 00000000.00000002.3304676005.00007FF71F481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71F480000, based on PE: true

Associated: 00000000.00000002.3304663507.00007FF71F480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304691736.00007FF71F490000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304703508.00007FF71F491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304719446.00007FF71F496000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304734406.00007FF71F499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71f480000_e90zPYFENm.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 1284c3dbe34098de3f772b811e92f13abcfc319c20c2da7efb8e613618f028dd
Instruction ID: 4d19f52b338f9be9765cba458c8ec364b42f4df64a584749d1a1949790c6d407
Opcode Fuzzy Hash: 1284c3dbe34098de3f772b811e92f13abcfc319c20c2da7efb8e613618f028dd
Instruction Fuzzy Hash: 9F017062D0CFC483D6019F5898011FAB320FFAE759F699326EE8C26255DF29E5A6C700

Function 00007FF71F4816E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF71F481680

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF71F481667
Total loss of significance (TLOSS), xrefs: 00007FF71F4816E0

Memory Dump Source

Source File: 00000000.00000002.3304676005.00007FF71F481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71F480000, based on PE: true

Associated: 00000000.00000002.3304663507.00007FF71F480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304691736.00007FF71F490000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304703508.00007FF71F491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304719446.00007FF71F496000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304734406.00007FF71F499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71f480000_e90zPYFENm.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: 1126e2a43dcb5e995abd21aac53ac0efc0976c9e0c1b733b45b9d49a6aa37c90
Instruction ID: c5749797944709d2022baaed60c72cab1cd65f93bcd98eb13a4d948e6b2747e9
Opcode Fuzzy Hash: 1126e2a43dcb5e995abd21aac53ac0efc0976c9e0c1b733b45b9d49a6aa37c90
Instruction Fuzzy Hash: 40F06212D08EC482D2129F5CA4011EBB334FF8E798F585326EF8D36655DF28E9968710

Function 00007FF71F4816B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 00007FF71F481680

Strings

Partial loss of significance (PLOSS), xrefs: 00007FF71F4816B0
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF71F481667

Memory Dump Source

Source File: 00000000.00000002.3304676005.00007FF71F481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71F480000, based on PE: true

Associated: 00000000.00000002.3304663507.00007FF71F480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304691736.00007FF71F490000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304703508.00007FF71F491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304719446.00007FF71F496000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304734406.00007FF71F499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71f480000_e90zPYFENm.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: 729b921e8c67bd2a8a86f2febc95da86c5d23c4bdedc1143afcc74071d1fb600
Instruction ID: 815a6a87dd99833f12693dde0af91d3f05c794cda8d6d7538b322e7c4ac219e2
Opcode Fuzzy Hash: 729b921e8c67bd2a8a86f2febc95da86c5d23c4bdedc1143afcc74071d1fb600
Instruction Fuzzy Hash: B5F06212D08EC482D2129F5CA4011EBB330FF8E7A8F585326EF8D36255DF28E5968710

Function 00007FF71F4816A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 00007FF71F481680

Strings

Argument domain error (DOMAIN), xrefs: 00007FF71F4816A0
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF71F481667

Memory Dump Source

Source File: 00000000.00000002.3304676005.00007FF71F481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71F480000, based on PE: true

Associated: 00000000.00000002.3304663507.00007FF71F480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304691736.00007FF71F490000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304703508.00007FF71F491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304719446.00007FF71F496000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304734406.00007FF71F499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71f480000_e90zPYFENm.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: cd1e6333fdda96bc61dfffa17928df2eeae9fd87cc14cf013f0fe063539aaea2
Instruction ID: 8af9f1abd499bf717c9b2e84b746da8f71b4a18cdad0fc27fe847673cf9c4193
Opcode Fuzzy Hash: cd1e6333fdda96bc61dfffa17928df2eeae9fd87cc14cf013f0fe063539aaea2
Instruction Fuzzy Hash: 92F06212D08EC482D2129F5CA4011EBB330FF9E7A8F585726EF8D36255DF28E5968710

Function 00007FF71F4816D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF71F481680

Strings

The result is too small to be represented (UNDERFLOW), xrefs: 00007FF71F4816D0
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF71F481667

Memory Dump Source

Source File: 00000000.00000002.3304676005.00007FF71F481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71F480000, based on PE: true

Associated: 00000000.00000002.3304663507.00007FF71F480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304691736.00007FF71F490000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304703508.00007FF71F491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304719446.00007FF71F496000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304734406.00007FF71F499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71f480000_e90zPYFENm.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: cb17514bf05429c6f8a5baabd58c13e09d51df9f11e8b2c9f2b0e3054c2248d8
Instruction ID: 22515acfa3cbae4cee90e6ffcd6b9761a1dfaff4bba67056e8163ac03dd2cc09
Opcode Fuzzy Hash: cb17514bf05429c6f8a5baabd58c13e09d51df9f11e8b2c9f2b0e3054c2248d8
Instruction Fuzzy Hash: 6FF06212D08EC482D2129F5CA4011EBB330FF8E798F585326EF8D3A255DF28E9968710

Function 00007FF71F4816C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 00007FF71F481680

Strings

Overflow range error (OVERFLOW), xrefs: 00007FF71F4816C0
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF71F481667

Memory Dump Source

Source File: 00000000.00000002.3304676005.00007FF71F481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71F480000, based on PE: true

Associated: 00000000.00000002.3304663507.00007FF71F480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304691736.00007FF71F490000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304703508.00007FF71F491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304719446.00007FF71F496000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304734406.00007FF71F499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71f480000_e90zPYFENm.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: bcc78e6bb763a26e13ff9f125cce93f8c5baf4f424424cb2843e29d940c79696
Instruction ID: d2613eec6691228dc86e3c57ba9237a34df860595f71a844aa7d07dfd944c1d5
Opcode Fuzzy Hash: bcc78e6bb763a26e13ff9f125cce93f8c5baf4f424424cb2843e29d940c79696
Instruction Fuzzy Hash: E6F06212D08EC482D2129F5CA4011EBB370FF8E7A8F585326EF8D36255DF28E5968710

Function 00007FF71F481638 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF71F481680

Strings

Argument singularity (SIGN), xrefs: 00007FF71F481638
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF71F481667

Memory Dump Source

Source File: 00000000.00000002.3304676005.00007FF71F481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71F480000, based on PE: true

Associated: 00000000.00000002.3304663507.00007FF71F480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304691736.00007FF71F490000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304703508.00007FF71F491000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304719446.00007FF71F496000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3304734406.00007FF71F499000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff71f480000_e90zPYFENm.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: 5edab71d5b9905d534877fbc00034e895137ad5bf3cf5eeaa8b2c0205136d012
Instruction ID: 669cf09e206c33ae19afa6d2313e5ea602b12592edaa2a176d68004a13cc86ca
Opcode Fuzzy Hash: 5edab71d5b9905d534877fbc00034e895137ad5bf3cf5eeaa8b2c0205136d012
Instruction Fuzzy Hash: F4F06212D08EC482D2029F58A4001ABB320FF8E798F545326EF8D2A155DF28E5968710

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report e90zPYFENm.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Metasploit

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: e90zPYFENm.exePID: 6628, Parent PID: 1028

General

Chronological Activities

Disassembly

Analysis Process: e90zPYFENm.exePID: 6628, Parent PID: 1028COMMON

Execution Graph

Windows Analysis Report
e90zPYFENm.exe

Function 0000022BBCDE0936 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 155
networklibraryCOMMON

Function 00007FF71F48F1B0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 83
memoryCOMMON

Function 0000022BBCDE0981 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 169
networkCOMMON

Function 0000022BBCDE09EE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 112
networkCOMMON

Function 00007FF71F481180 Relevance: 10.6, APIs: 7, Instructions: 138
sleepstringCOMMON

Function 00007FF71F481C94 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91
COMMON

Function 00007FF71F481710 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 138
COMMON

Function 00007FF71F486BE0 Relevance: 7.8, APIs: 5, Instructions: 299
COMMON

Function 00007FF71F4818F0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 231
memoryCOMMON

Function 00007FF71F487090 Relevance: 6.2, APIs: 4, Instructions: 238
COMMON

Function 00007FF71F48EBA0 Relevance: 6.1, APIs: 4, Instructions: 83
COMMON

Function 00007FF71F481600 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38
COMMON

Function 00007FF71F4816B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Function 00007FF71F4816A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Function 00007FF71F4816C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON