Windows
Analysis Report
orderconfirmation.exe
Overview
General Information
Detection
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Classification
- System is w10x64
- orderconfirmation.exe (PID: 7392 cmdline:
"C:\Users\ user\Deskt op\orderco nfirmation .exe" MD5: 1DFDA6FC13C7EFAB9F6148E7339AB80C) - Virtual.exe (PID: 7508 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\Virtua l.exe" MD5: C8A2DE7077F97D4BCE1A44317B49EF41) - Virtual.exe (PID: 7532 cmdline:
C:\Users\u ser\AppDat a\Roaming\ fmBrowseru mz_test\Vi rtual.exe MD5: C8A2DE7077F97D4BCE1A44317B49EF41) - cmd.exe (PID: 7548 cmdline:
C:\Windows \SysWOW64\ cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 7556 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - explorer.exe (PID: 7928 cmdline:
C:\Windows \SysWOW64\ explorer.e xe MD5: DD6597597673F72E10C9DE7901FBA0A8)
- cleanup
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
Lumma Stealer, LummaC2 Stealer | Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell. | No Attribution |
{"C2 url": ["ghostreedmnu.shop", "vozmeatillu.shop", "drawzhotdog.shop", "stogeneratmns.shop", "teenylogicod.shop", "reinforcenh.shop", "gutterydhowi.shop", "fragnantbui.shop", "offensivedzvju.shop"], "Build id": "DtiPjR--NashTraff"}
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_LummaCStealer_2 | Yara detected LummaC Stealer | Joe Security |
System Summary |
---|
Source: | Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative: |
Click to jump to signature section
AV Detection |
---|
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: |
Source: | Avira: |
Source: | Malware Configuration Extractor: |
Source: | Integrated Neural Analysis Model: |
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: | ||
Source: | String decryptor: |
Source: | Static PE information: |
Source: | File opened: | Jump to behavior |
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: |
Source: | Code function: | 0_2_0040301A | |
Source: | Code function: | 0_2_00402B79 | |
Source: | Code function: | 2_2_616983E8 | |
Source: | Code function: | 2_2_616963E4 | |
Source: | Code function: | 2_2_616923A0 | |
Source: | Code function: | 2_2_616944A8 | |
Source: | Code function: | 2_2_616949E4 | |
Source: | Code function: | 2_2_6169885C | |
Source: | Code function: | 2_2_616968D8 | |
Source: | Code function: | 2_2_61697B1C | |
Source: | Code function: | 2_2_61696DDC | |
Source: | Code function: | 2_2_61692C0C | |
Source: | Code function: | 2_2_61693F10 | |
Source: | Code function: | 2_2_61697F84 | |
Source: | Code function: | 2_2_61695EE8 | |
Source: | Code function: | 3_2_615B83E8 | |
Source: | Code function: | 3_2_615B63E4 | |
Source: | Code function: | 3_2_615B23A0 | |
Source: | Code function: | 3_2_615B44A8 | |
Source: | Code function: | 3_2_615B49E4 | |
Source: | Code function: | 3_2_615B885C | |
Source: | Code function: | 3_2_615B68D8 | |
Source: | Code function: | 3_2_615B7B1C | |
Source: | Code function: | 3_2_615B6DDC | |
Source: | Code function: | 3_2_615B2C0C | |
Source: | Code function: | 3_2_615B3F10 | |
Source: | Code function: | 3_2_615B7F84 | |
Source: | Code function: | 3_2_615B5EE8 |
Networking |
---|
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: |
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: |
System Summary |
---|
Source: | Static PE information: |
Source: | Code function: | 0_2_00404FAA | |
Source: | Code function: | 0_2_0041206B | |
Source: | Code function: | 0_2_0041022D | |
Source: | Code function: | 0_2_00411F91 | |
Source: | Code function: | 2_2_616AB1E0 | |
Source: | Code function: | 2_2_6169A1F0 | |
Source: | Code function: | 2_2_616A8194 | |
Source: | Code function: | 2_2_616C3050 | |
Source: | Code function: | 2_2_616F0008 | |
Source: | Code function: | 2_2_616AA0EC | |
Source: | Code function: | 2_2_6167D0E8 | |
Source: | Code function: | 2_2_6169C350 | |
Source: | Code function: | 2_2_616DA2BC | |
Source: | Code function: | 2_2_616EE2B8 | |
Source: | Code function: | 2_2_616ED2B4 | |
Source: | Code function: | 2_2_616A0288 | |
Source: | Code function: | 2_2_616A9294 | |
Source: | Code function: | 2_2_6167B298 | |
Source: | Code function: | 2_2_616EF558 | |
Source: | Code function: | 2_2_6169F454 | |
Source: | Code function: | 2_2_616AA410 | |
Source: | Code function: | 2_2_616F74DC | |
Source: | Code function: | 2_2_616A24D0 | |
Source: | Code function: | 2_2_616944A8 | |
Source: | Code function: | 2_2_616A84BC | |
Source: | Code function: | 2_2_6169A760 | |
Source: | Code function: | 2_2_616AA77C | |
Source: | Code function: | 2_2_6168D73C | |
Source: | Code function: | 2_2_616DB7E4 | |
Source: | Code function: | 2_2_6169B7C4 | |
Source: | Code function: | 2_2_616A27AC | |
Source: | Code function: | 2_2_6168B624 | |
Source: | Code function: | 2_2_616AC6A0 | |
Source: | Code function: | 2_2_616A56B8 | |
Source: | Code function: | 2_2_616806B0 | |
Source: | Code function: | 2_2_616A5958 | |
Source: | Code function: | 2_2_6169A92C | |
Source: | Code function: | 2_2_616949E4 | |
Source: | Code function: | 2_2_616A28D4 | |
Source: | Code function: | 2_2_6167D8B4 | |
Source: | Code function: | 2_2_6168C894 | |
Source: | Code function: | 2_2_616A2BF4 | |
Source: | Code function: | 2_2_616DCBA0 | |
Source: | Code function: | 2_2_616A5B88 | |
Source: | Code function: | 2_2_616A7AF4 | |
Source: | Code function: | 2_2_61699AAC | |
Source: | Code function: | 2_2_616A5A94 | |
Source: | Code function: | 2_2_616A4D40 | |
Source: | Code function: | 2_2_61690DCC | |
Source: | Code function: | 2_2_616A7DB0 | |
Source: | Code function: | 2_2_616A9C74 | |
Source: | Code function: | 2_2_61698CF8 | |
Source: | Code function: | 2_2_616C7F74 | |
Source: | Code function: | 2_2_616A9F44 | |
Source: | Code function: | 2_2_616EDF5C | |
Source: | Code function: | 2_2_61693F10 | |
Source: | Code function: | 2_2_6169BE1C | |
Source: | Code function: | 2_2_616A8E10 | |
Source: | Code function: | 2_2_616AAE9C | |
Source: | Code function: | 2_2_6178F2D4 | |
Source: | Code function: | 2_2_6175E5F8 | |
Source: | Code function: | 2_2_6177B5B8 | |
Source: | Code function: | 2_2_61779580 | |
Source: | Code function: | 2_2_6177D46C | |
Source: | Code function: | 2_2_617804D0 | |
Source: | Code function: | 2_2_617864B8 | |
Source: | Code function: | 2_2_61790740 | |
Source: | Code function: | 2_2_61794714 | |
Source: | Code function: | 2_2_6178E638 | |
Source: | Code function: | 2_2_617956E8 | |
Source: | Code function: | 2_2_6177692C | |
Source: | Code function: | 2_2_6177A84C | |
Source: | Code function: | 2_2_6178DB68 | |
Source: | Code function: | 2_2_61779B60 | |
Source: | Code function: | 2_2_6176DD3C | |
Source: | Code function: | 2_2_6177CD3C | |
Source: | Code function: | 2_2_61793E34 | |
Source: | Code function: | 2_2_61783E0C | |
Source: | Code function: | 2_2_61781EF4 | |
Source: | Code function: | 2_2_6177AE88 | |
Source: | Code function: | 3_2_6152F2D4 | |
Source: | Code function: | 3_2_614FE5F8 | |
Source: | Code function: | 3_2_61519580 | |
Source: | Code function: | 3_2_6151B5B8 | |
Source: | Code function: | 3_2_6151D46C | |
Source: | Code function: | 3_2_615204D0 | |
Source: | Code function: | 3_2_615264B8 | |
Source: | Code function: | 3_2_61530740 | |
Source: | Code function: | 3_2_61534714 | |
Source: | Code function: | 3_2_6152E638 | |
Source: | Code function: | 3_2_615356E8 | |
Source: | Code function: | 3_2_6151692C | |
Source: | Code function: | 3_2_6151A84C | |
Source: | Code function: | 3_2_61519B60 | |
Source: | Code function: | 3_2_6152DB68 | |
Source: | Code function: | 3_2_6150DD3C | |
Source: | Code function: | 3_2_6151CD3C | |
Source: | Code function: | 3_2_61523E0C | |
Source: | Code function: | 3_2_61533E34 | |
Source: | Code function: | 3_2_61521EF4 | |
Source: | Code function: | 3_2_6151AE88 | |
Source: | Code function: | 3_2_615BA1F0 | |
Source: | Code function: | 3_2_615CB1E0 | |
Source: | Code function: | 3_2_615C8194 | |
Source: | Code function: | 3_2_615E3050 | |
Source: | Code function: | 3_2_61610008 | |
Source: | Code function: | 3_2_615CA0EC | |
Source: | Code function: | 3_2_6159D0E8 | |
Source: | Code function: | 3_2_615BC350 | |
Source: | Code function: | 3_2_6159B298 | |
Source: | Code function: | 3_2_615C9294 | |
Source: | Code function: | 3_2_615C0288 | |
Source: | Code function: | 3_2_6160D2B4 | |
Source: | Code function: | 3_2_6160E2B8 | |
Source: | Code function: | 3_2_615FA2BC | |
Source: | Code function: | 3_2_6160F558 | |
Source: | Code function: | 3_2_615BF454 | |
Source: | Code function: | 3_2_615CA410 | |
Source: | Code function: | 3_2_615C24D0 | |
Source: | Code function: | 3_2_616174DC | |
Source: | Code function: | 3_2_615C84BC | |
Source: | Code function: | 3_2_615B44A8 | |
Source: | Code function: | 3_2_615CA77C | |
Source: | Code function: | 3_2_615BA760 | |
Source: | Code function: | 3_2_615AD73C | |
Source: | Code function: | 3_2_615BB7C4 | |
Source: | Code function: | 3_2_615FB7E4 | |
Source: | Code function: | 3_2_615C27AC | |
Source: | Code function: | 3_2_615AB624 | |
Source: | Code function: | 3_2_615C56B8 | |
Source: | Code function: | 3_2_615A06B0 | |
Source: | Code function: | 3_2_615CC6A0 | |
Source: | Code function: | 3_2_615C5958 | |
Source: | Code function: | 3_2_615D7938 | |
Source: | Code function: | 3_2_615BA92C | |
Source: | Code function: | 3_2_615B49E4 | |
Source: | Code function: | 3_2_615C28D4 | |
Source: | Code function: | 3_2_615AC894 | |
Source: | Code function: | 3_2_6159D8B4 | |
Source: | Code function: | 3_2_615C2BF4 | |
Source: | Code function: | 3_2_6160EBD8 | |
Source: | Code function: | 3_2_615C5B88 | |
Source: | Code function: | 3_2_615FCBA0 | |
Source: | Code function: | 3_2_615C7AF4 | |
Source: | Code function: | 3_2_615C5A94 | |
Source: | Code function: | 3_2_615B9AAC | |
Source: | Code function: | 3_2_615C4D40 | |
Source: | Code function: | 3_2_615B0DCC | |
Source: | Code function: | 3_2_615C7DB0 | |
Source: | Code function: | 3_2_615C9C74 | |
Source: | Code function: | 3_2_615B8CF8 | |
Source: | Code function: | 3_2_615C9F44 | |
Source: | Code function: | 3_2_615E7F74 | |
Source: | Code function: | 3_2_6160DF5C | |
Source: | Code function: | 3_2_615B3F10 | |
Source: | Code function: | 3_2_615BBE1C | |
Source: | Code function: | 3_2_615C8E10 | |
Source: | Code function: | 3_2_615CAE9C |
Source: | Dropped File: |
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: |
Source: | Static PE information: |
Source: | Classification label: |
Source: | Code function: | 0_2_00407776 |
Source: | Code function: | 0_2_0040118A |
Source: | Code function: | 0_2_004034C1 |
Source: | Code function: | 0_2_00401BDF |
Source: | File created: | Jump to behavior |
Source: | Mutant created: |
Source: | File created: | Jump to behavior |
Source: | Process created: | |||
Source: | Process created: | Jump to behavior |
Source: | Static PE information: |
Source: | File read: | Jump to behavior |
Source: | Key opened: | Jump to behavior |
Source: | File read: | Jump to behavior |
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior |
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior |
Source: | Static file information: |
Source: | File opened: | Jump to behavior |
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: |
Source: | Code function: | 0_2_00406D5D |
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: |
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: |
Source: | Code function: | 0_2_00411C4E | |
Source: | Code function: | 2_2_617629CB | |
Source: | Code function: | 3_2_615029CB |
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file | ||
Source: | File created: | Jump to dropped file |
Source: | File created: | Jump to dropped file |
Hooking and other Techniques for Hiding and Protection |
---|
Source: | Module Loaded: |
Source: | Code function: | 2_2_6168D73C |
Source: | Process information set: | Jump to behavior |
Malware Analysis System Evasion |
---|
Source: | API/Special instruction interceptor: | ||
Source: | API/Special instruction interceptor: |
Source: | Code function: | 2_2_6168B878 |
Source: | Dropped PE file which has not been started: | Jump to dropped file |
Source: | API coverage: | ||
Source: | API coverage: |
Source: | Code function: | 0_2_0040301A | |
Source: | Code function: | 0_2_00402B79 | |
Source: | Code function: | 2_2_616983E8 | |
Source: | Code function: | 2_2_616963E4 | |
Source: | Code function: | 2_2_616923A0 | |
Source: | Code function: | 2_2_616944A8 | |
Source: | Code function: | 2_2_616949E4 | |
Source: | Code function: | 2_2_6169885C | |
Source: | Code function: | 2_2_616968D8 | |
Source: | Code function: | 2_2_61697B1C | |
Source: | Code function: | 2_2_61696DDC | |
Source: | Code function: | 2_2_61692C0C | |
Source: | Code function: | 2_2_61693F10 | |
Source: | Code function: | 2_2_61697F84 | |
Source: | Code function: | 2_2_61695EE8 | |
Source: | Code function: | 3_2_615B83E8 | |
Source: | Code function: | 3_2_615B63E4 | |
Source: | Code function: | 3_2_615B23A0 | |
Source: | Code function: | 3_2_615B44A8 | |
Source: | Code function: | 3_2_615B49E4 | |
Source: | Code function: | 3_2_615B885C | |
Source: | Code function: | 3_2_615B68D8 | |
Source: | Code function: | 3_2_615B7B1C | |
Source: | Code function: | 3_2_615B6DDC | |
Source: | Code function: | 3_2_615B2C0C | |
Source: | Code function: | 3_2_615B3F10 | |
Source: | Code function: | 3_2_615B7F84 | |
Source: | Code function: | 3_2_615B5EE8 |
Source: | Code function: | 2_2_616799E0 |
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: |
Source: | Process information queried: | Jump to behavior |
Source: | Code function: | 2_2_6168B878 |
Source: | Code function: | 2_2_616E02A4 |
Source: | Code function: | 0_2_00406D5D |
Source: | Code function: | 2_2_616DECC8 |
Source: | Code function: | 2_2_616E02A4 | |
Source: | Code function: | 2_2_616E06B0 | |
Source: | Code function: | 2_2_61796BB0 | |
Source: | Code function: | 3_2_61536BB0 | |
Source: | Code function: | 3_2_616002A4 | |
Source: | Code function: | 3_2_616006B0 |
HIPS / PFW / Operating System Protection Evasion |
---|
Source: | NtAllocateVirtualMemory: | Jump to behavior | ||
Source: | NtQuerySystemInformation: | Jump to behavior | ||
Source: | NtCreateFile: | Jump to behavior | ||
Source: | NtCreateNamedPipeFile: | Jump to behavior | ||
Source: | NtQuerySystemInformation: | Jump to behavior | ||
Source: | NtAllocateVirtualMemory: | Jump to behavior | ||
Source: | NtReadFile: | Jump to behavior | ||
Source: | NtClose: | |||
Source: | NtClose: | |||
Source: | NtAllocateVirtualMemory: | Jump to behavior | ||
Source: | NtProtectVirtualMemory: | Jump to behavior | ||
Source: | NtProtectVirtualMemory: | Jump to behavior | ||
Source: | NtAllocateVirtualMemory: | Jump to behavior | ||
Source: | NtQuerySystemInformation: | Jump to behavior | ||
Source: | NtProtectVirtualMemory: | Jump to behavior | ||
Source: | NtProtectVirtualMemory: | Jump to behavior |
Source: | Memory written: | Jump to behavior | ||
Source: | Memory written: | Jump to behavior |
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: |
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior |
Source: | Memory written: | Jump to behavior | ||
Source: | Memory written: | Jump to behavior |
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior |
Source: | Code function: | 0_2_0040D72E |
Source: | Code function: | 0_2_00401F9D | |
Source: | Code function: | 2_2_61789460 | |
Source: | Code function: | 3_2_61529460 |
Source: | Code function: | 0_2_00401626 |
Source: | Code function: | 2_2_616A7DB0 |
Source: | Code function: | 0_2_00404FAA |
Stealing of Sensitive Information |
---|
Source: | File source: |
Remote Access Functionality |
---|
Source: | File source: |
Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 1 Native API | 11 DLL Side-Loading | 311 Process Injection | 11 Masquerading | OS Credential Dumping | 2 System Time Discovery | Remote Services | 1 Archive Collected Data | 1 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
Credentials | Domains | Default Accounts | 1 PowerShell | Boot or Logon Initialization Scripts | 1 Abuse Elevation Control Mechanism | 311 Process Injection | LSASS Memory | 131 Security Software Discovery | Remote Desktop Protocol | Data from Removable Media | 1 Application Layer Protocol | Exfiltration Over Bluetooth | Network Denial of Service |
Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | 11 DLL Side-Loading | 11 Deobfuscate/Decode Files or Information | Security Account Manager | 1 Process Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | Steganography | Automated Exfiltration | Data Encrypted for Impact |
Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 1 Abuse Elevation Control Mechanism | NTDS | 2 File and Directory Discovery | Distributed Component Object Model | Input Capture | Protocol Impersonation | Traffic Duplication | Data Destruction |
Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 2 Obfuscated Files or Information | LSA Secrets | 125 System Information Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 11 DLL Side-Loading | Cached Domain Credentials | Wi-Fi Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
5% | ReversingLabs |
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
100% | Avira | HEUR/AGEN.1318482 | ||
0% | ReversingLabs | |||
0% | ReversingLabs | |||
0% | ReversingLabs | |||
0% | ReversingLabs | |||
0% | ReversingLabs | |||
0% | ReversingLabs | |||
0% | ReversingLabs | |||
0% | ReversingLabs |
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | URL Reputation | safe | ||
0% | Avira URL Cloud | safe | ||
0% | Avira URL Cloud | safe | ||
0% | Avira URL Cloud | safe | ||
0% | Avira URL Cloud | safe | ||
0% | Avira URL Cloud | safe | ||
0% | Avira URL Cloud | safe | ||
0% | Avira URL Cloud | safe | ||
0% | Avira URL Cloud | safe | ||
100% | Avira URL Cloud | malware | ||
0% | Avira URL Cloud | safe | ||
100% | Avira URL Cloud | malware | ||
0% | Avira URL Cloud | safe | ||
0% | Avira URL Cloud | safe | ||
0% | Avira URL Cloud | safe | ||
0% | Avira URL Cloud | safe | ||
100% | Avira URL Cloud | malware | ||
0% | Avira URL Cloud | safe | ||
0% | Avira URL Cloud | safe | ||
100% | Avira URL Cloud | malware | ||
100% | Avira URL Cloud | malware | ||
0% | Avira URL Cloud | safe | ||
100% | Avira URL Cloud | malware | ||
0% | Avira URL Cloud | safe | ||
0% | Avira URL Cloud | safe | ||
0% | Avira URL Cloud | safe | ||
100% | Avira URL Cloud | malware | ||
0% | Avira URL Cloud | safe | ||
0% | Avira URL Cloud | safe | ||
0% | Avira URL Cloud | safe | ||
0% | Avira URL Cloud | safe | ||
0% | Avira URL Cloud | safe | ||
100% | Avira URL Cloud | malware | ||
0% | Avira URL Cloud | safe |
Name | Malicious | Antivirus Detection | Reputation |
---|---|---|---|
true |
| unknown | |
true |
| unknown | |
true |
| unknown | |
true |
| unknown | |
true |
| unknown | |
true |
| unknown | |
true |
| unknown | |
true |
| unknown | |
true |
| unknown |
Name | Source | Malicious | Antivirus Detection | Reputation |
---|---|---|---|---|
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown | ||
false |
| unknown |
Joe Sandbox version: | 41.0.0 Charoite |
Analysis ID: | 1519505 |
Start date and time: | 2024-09-26 16:02:05 +02:00 |
Joe Sandbox product: | CloudBasic |
Overall analysis duration: | 0h 8m 16s |
Hypervisor based Inspection enabled: | false |
Report type: | full |
Cookbook file name: | default.jbs |
Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
Number of analysed new started processes analysed: | 13 |
Number of new started drivers analysed: | 0 |
Number of existing processes analysed: | 0 |
Number of existing drivers analysed: | 0 |
Number of injected processes analysed: | 0 |
Technologies: |
|
Analysis Mode: | default |
Analysis stop reason: | Timeout |
Sample name: | orderconfirmation.exe |
Detection: | MAL |
Classification: | mal100.troj.evad.winEXE@10/16@0/0 |
EGA Information: |
|
HCA Information: |
|
Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
- Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
- Not all processes where analyzed, report is missing behavior information
- Report creation exceeded maximum time and may have missing disassembly code information.
- Report size exceeded maximum capacity and may have missing disassembly code.
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
- VT rate limit hit for: orderconfirmation.exe
Time | Type | Description |
---|---|---|
10:03:27 | API Interceptor |
Process: | C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 1102032 |
Entropy (8bit): | 7.57927547257599 |
Encrypted: | false |
SSDEEP: | 24576:d4IUFcZ/0gD/COw3sTm95KbEcGm8MjN0L2ZNq8m/Ki1pBxgAC+06D:d4NcigD/COPTO5U8MjI2ZNqb/Ki1pBx7 |
MD5: | C0F73EC5259183FAE3EF1BF0865E2BDB |
SHA1: | AC594FC8B07EED381A005F2A83813AC3A30DC99A |
SHA-256: | FD9AB546C6BC4A0856D27AD42C7C0A17462BEE4F66E46906E00D25AD2E4F7E1E |
SHA-512: | 7508B6FFE777CAB7B084D3DA3DB064F0391AB91E9915788CCBACC23739ECEC821B4E34B6D49AFB11F6A67410698EADB49F078AFB0E082C1454A79CFBCF05E3BF |
Malicious: | false |
Reputation: | low |
Preview: |
Process: | C:\Users\user\Desktop\orderconfirmation.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 380176 |
Entropy (8bit): | 6.432472275317664 |
Encrypted: | false |
SSDEEP: | 6144:TTKw9G2rivrR7YR+euVO05XMog3N0++++I333O333qj333MEq333h3333f92333O:CcN3u++++I333O333qj333MJ333h333r |
MD5: | 496DF6AD1A158ED5037138E397713EF0 |
SHA1: | 287BD2219C955687BAA399DED57E9AB64334C63C |
SHA-256: | 07C04290F53AAAAA7DF6B6EA3A53103B6E3EF8FF658D8097617A9C48DFC6E90A |
SHA-512: | 422DA26A8F50C1F02C1CC7C4BED37CDB33732039BBA82F32C2A14BAA8C6A7BC5544856AB26A2071B5EA8E731A296E2C69071DA2F067312D05763AA3A9928BB3A |
Malicious: | true |
Antivirus: |
|
Reputation: | low |
Preview: |
Process: | C:\Users\user\Desktop\orderconfirmation.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 4242944 |
Entropy (8bit): | 6.558861714917866 |
Encrypted: | false |
SSDEEP: | 49152:CaNFpHwVfZqJru0K1kLo7RrObviwkZcrA2P16szn0uyIeOGTrLvQb8FN7J:uVfZq+1kLRGIn0uy7wb8 |
MD5: | 17CBAEDCC796DC92A5A7A4AE53999B8D |
SHA1: | D9DE37A9624DDB576BF5DDE24EF52A10A67C6B79 |
SHA-256: | 1C58B2449D28A6F15C5C7299C83E51A4C0AA9C86F39F6C77B323EF383E0C972A |
SHA-512: | EE7D96EDFFE0F9E24C74A335508B5BE97A296617BB229BF8E1DD15208AB8085E8D335A75E8F52586F660AF15DA6D06D8C0E3E4AC504138712B96D7D3E7705BE9 |
Malicious: | true |
Reputation: | low |
Preview: |
Process: | C:\Users\user\Desktop\orderconfirmation.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 3559696 |
Entropy (8bit): | 6.200307727314802 |
Encrypted: | false |
SSDEEP: | 49152:AQ902GYI12BpN8G/i6Hdw2u68X5RPrftuX9wZcQm2J9FjdH0pdTrRBlkG0BjMEgr:H9DGYIob9wp68pRzVsiHI9atBjMEY |
MD5: | C8A2DE7077F97D4BCE1A44317B49EF41 |
SHA1: | 6CB3212EC9BE08CB5A29BF8D37E9CA845EFC18C9 |
SHA-256: | 448402C129A721812FA1C5F279F5CA906B9C8BBCA652A91655D144D20CE5E6B4 |
SHA-512: | 9815EBA1566A8E33734F6A218071EC501DD1F799B1535E25D87C2B416B928AE8D15F8218CF20E685F9907EC39C202CBFC4728FE6AB9D87B3DE345109F626845E |
Malicious: | true |
Antivirus: |
|
Joe Sandbox View: | |
Reputation: | low |
Preview: |
Process: | C:\Windows\SysWOW64\cmd.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 370688 |
Entropy (8bit): | 6.659939192156715 |
Encrypted: | false |
SSDEEP: | 6144:CJdHU1vR3RO5NSdLcHUPnAGrV1GdauIgmxmbsWeSI7ifLW3NNj:CJS1vRhOfX0PA61Gig0mQ6ej |
MD5: | 6FC1AD9CBF97F491FE57D8936253E6A4 |
SHA1: | 3CF580FDEC66C17AAB1E565A319A4A3FA5F54091 |
SHA-256: | 4E186579D36A915C263E20616B1201314ABB42917959760EF03573F20EB2596F |
SHA-512: | 36CD5B9942EF6B0057999087AAA003A7621E8FD4244AFBD83485934E69634F87D7F1BF5AF4BC99D839D43CD02CC2CE50E62BC71AB16DE45FC40171B22E290FE5 |
Malicious: | true |
Antivirus: |
|
Preview: |
Process: | C:\Users\user\Desktop\orderconfirmation.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 608080 |
Entropy (8bit): | 6.297676823354886 |
Encrypted: | false |
SSDEEP: | 12288:koBFUsQ1H5FH3YUTd/df0RA7XkNvEKZm+aWodEEiblHN/:dFUsQ1H5FHdGKkNvEKZm+aWodEEcHN/ |
MD5: | D029339C0F59CF662094EDDF8C42B2B5 |
SHA1: | A0B6DE44255CE7BFADE9A5B559DD04F2972BFDC8 |
SHA-256: | 934D882EFD3C0F3F1EFBC238EF87708F3879F5BB456D30AF62F3368D58B6AA4C |
SHA-512: | 021D9AF52E68CB7A3B0042D9ED6C9418552EE16DF966F9CCEDD458567C47D70471CB8851A69D3982D64571369664FAEEAE3BE90E2E88A909005B9CDB73679C82 |
Malicious: | false |
Antivirus: |
|
Preview: |
Process: | C:\Users\user\Desktop\orderconfirmation.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 829264 |
Entropy (8bit): | 6.553848816796836 |
Encrypted: | false |
SSDEEP: | 12288:QgzGPEett9Mw9HfBCddjMb2NQVmTW75JfmyyKWeHQGoko+1:HzJetPMw9HfBCrMb2Kc6dmyyKWewGzB1 |
MD5: | 366FD6F3A451351B5DF2D7C4ECF4C73A |
SHA1: | 50DB750522B9630757F91B53DF377FD4ED4E2D66 |
SHA-256: | AE3CB6C6AFBA9A4AA5C85F66023C35338CA579B30326DD02918F9D55259503D5 |
SHA-512: | 2DE764772B68A85204B7435C87E9409D753C2196CF5B2F46E7796C99A33943E167F62A92E8753EAA184CD81FB14361E83228EB1B474E0C3349ED387EC93E6130 |
Malicious: | false |
Antivirus: |
|
Preview: |
Process: | C:\Users\user\Desktop\orderconfirmation.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 860518 |
Entropy (8bit): | 7.899823409435636 |
Encrypted: | false |
SSDEEP: | 24576:g5+W/5WF2Trqt4YUszzkWUnSAf68ZBL/Ppi:g5Hlszz1URxBi |
MD5: | 77F356E9CA520BEC31272D7A4749957F |
SHA1: | A9158606D300C5BE8436D45792B0694B86F2171D |
SHA-256: | AFD1FC4AE69BE1A700E2DB7719A6D9CA178F312D9F5A03FE125E822F71C246C8 |
SHA-512: | F7BE6A991CF4220D759922D38FFFBD141E20F89047AF1CA25E0BED71B115EF4DA916128EBD12F54AD81F69A524AFAFEA9C7772755F1326DC674E55948F6B76EE |
Malicious: | false |
Preview: |
Process: | C:\Users\user\Desktop\orderconfirmation.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 34981 |
Entropy (8bit): | 5.197542327627124 |
Encrypted: | false |
SSDEEP: | 768:wnL9pPW6C5GjCPJJVuTlX0/GE/URJk+ZNM3Oqc/QyJ:jG2xWp2/UXk+d1/QY |
MD5: | 1D24ED1F75EF5FBB15CF6CA92CF3F8E9 |
SHA1: | 6AE0680522A0A1B10ED842A9403C3CAD3502A789 |
SHA-256: | A2C1F93EDCA83080F8768722B224D6DCD84530537DEC326B84850A3B00C7E3B9 |
SHA-512: | 16166077CE5EFD445DBC111DA787827640C438A8F46D7B69CE72E5BD83F5BF46847B984009BFE36D985DEADB1F7F364B6B0D95B4C5C3EEC225763AF387CEA85A |
Malicious: | false |
Preview: |
Process: | C:\Users\user\AppData\Local\Temp\Virtual.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 380176 |
Entropy (8bit): | 6.432472275317664 |
Encrypted: | false |
SSDEEP: | 6144:TTKw9G2rivrR7YR+euVO05XMog3N0++++I333O333qj333MEq333h3333f92333O:CcN3u++++I333O333qj333MJ333h333r |
MD5: | 496DF6AD1A158ED5037138E397713EF0 |
SHA1: | 287BD2219C955687BAA399DED57E9AB64334C63C |
SHA-256: | 07C04290F53AAAAA7DF6B6EA3A53103B6E3EF8FF658D8097617A9C48DFC6E90A |
SHA-512: | 422DA26A8F50C1F02C1CC7C4BED37CDB33732039BBA82F32C2A14BAA8C6A7BC5544856AB26A2071B5EA8E731A296E2C69071DA2F067312D05763AA3A9928BB3A |
Malicious: | true |
Antivirus: |
|
Preview: |
Process: | C:\Users\user\AppData\Local\Temp\Virtual.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 4242944 |
Entropy (8bit): | 6.558861714917866 |
Encrypted: | false |
SSDEEP: | 49152:CaNFpHwVfZqJru0K1kLo7RrObviwkZcrA2P16szn0uyIeOGTrLvQb8FN7J:uVfZq+1kLRGIn0uy7wb8 |
MD5: | 17CBAEDCC796DC92A5A7A4AE53999B8D |
SHA1: | D9DE37A9624DDB576BF5DDE24EF52A10A67C6B79 |
SHA-256: | 1C58B2449D28A6F15C5C7299C83E51A4C0AA9C86F39F6C77B323EF383E0C972A |
SHA-512: | EE7D96EDFFE0F9E24C74A335508B5BE97A296617BB229BF8E1DD15208AB8085E8D335A75E8F52586F660AF15DA6D06D8C0E3E4AC504138712B96D7D3E7705BE9 |
Malicious: | true |
Preview: |
Process: | C:\Users\user\AppData\Local\Temp\Virtual.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 3559696 |
Entropy (8bit): | 6.200307727314802 |
Encrypted: | false |
SSDEEP: | 49152:AQ902GYI12BpN8G/i6Hdw2u68X5RPrftuX9wZcQm2J9FjdH0pdTrRBlkG0BjMEgr:H9DGYIob9wp68pRzVsiHI9atBjMEY |
MD5: | C8A2DE7077F97D4BCE1A44317B49EF41 |
SHA1: | 6CB3212EC9BE08CB5A29BF8D37E9CA845EFC18C9 |
SHA-256: | 448402C129A721812FA1C5F279F5CA906B9C8BBCA652A91655D144D20CE5E6B4 |
SHA-512: | 9815EBA1566A8E33734F6A218071EC501DD1F799B1535E25D87C2B416B928AE8D15F8218CF20E685F9907EC39C202CBFC4728FE6AB9D87B3DE345109F626845E |
Malicious: | true |
Antivirus: |
|
Preview: |
Process: | C:\Users\user\AppData\Local\Temp\Virtual.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 608080 |
Entropy (8bit): | 6.297676823354886 |
Encrypted: | false |
SSDEEP: | 12288:koBFUsQ1H5FH3YUTd/df0RA7XkNvEKZm+aWodEEiblHN/:dFUsQ1H5FHdGKkNvEKZm+aWodEEcHN/ |
MD5: | D029339C0F59CF662094EDDF8C42B2B5 |
SHA1: | A0B6DE44255CE7BFADE9A5B559DD04F2972BFDC8 |
SHA-256: | 934D882EFD3C0F3F1EFBC238EF87708F3879F5BB456D30AF62F3368D58B6AA4C |
SHA-512: | 021D9AF52E68CB7A3B0042D9ED6C9418552EE16DF966F9CCEDD458567C47D70471CB8851A69D3982D64571369664FAEEAE3BE90E2E88A909005B9CDB73679C82 |
Malicious: | false |
Antivirus: |
|
Preview: |
Process: | C:\Users\user\AppData\Local\Temp\Virtual.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 829264 |
Entropy (8bit): | 6.553848816796836 |
Encrypted: | false |
SSDEEP: | 12288:QgzGPEett9Mw9HfBCddjMb2NQVmTW75JfmyyKWeHQGoko+1:HzJetPMw9HfBCrMb2Kc6dmyyKWewGzB1 |
MD5: | 366FD6F3A451351B5DF2D7C4ECF4C73A |
SHA1: | 50DB750522B9630757F91B53DF377FD4ED4E2D66 |
SHA-256: | AE3CB6C6AFBA9A4AA5C85F66023C35338CA579B30326DD02918F9D55259503D5 |
SHA-512: | 2DE764772B68A85204B7435C87E9409D753C2196CF5B2F46E7796C99A33943E167F62A92E8753EAA184CD81FB14361E83228EB1B474E0C3349ED387EC93E6130 |
Malicious: | false |
Antivirus: |
|
Preview: |
Process: | C:\Users\user\AppData\Local\Temp\Virtual.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 860518 |
Entropy (8bit): | 7.899823409435636 |
Encrypted: | false |
SSDEEP: | 24576:g5+W/5WF2Trqt4YUszzkWUnSAf68ZBL/Ppi:g5Hlszz1URxBi |
MD5: | 77F356E9CA520BEC31272D7A4749957F |
SHA1: | A9158606D300C5BE8436D45792B0694B86F2171D |
SHA-256: | AFD1FC4AE69BE1A700E2DB7719A6D9CA178F312D9F5A03FE125E822F71C246C8 |
SHA-512: | F7BE6A991CF4220D759922D38FFFBD141E20F89047AF1CA25E0BED71B115EF4DA916128EBD12F54AD81F69A524AFAFEA9C7772755F1326DC674E55948F6B76EE |
Malicious: | false |
Preview: |
Process: | C:\Users\user\AppData\Local\Temp\Virtual.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 34981 |
Entropy (8bit): | 5.197542327627124 |
Encrypted: | false |
SSDEEP: | 768:wnL9pPW6C5GjCPJJVuTlX0/GE/URJk+ZNM3Oqc/QyJ:jG2xWp2/UXk+d1/QY |
MD5: | 1D24ED1F75EF5FBB15CF6CA92CF3F8E9 |
SHA1: | 6AE0680522A0A1B10ED842A9403C3CAD3502A789 |
SHA-256: | A2C1F93EDCA83080F8768722B224D6DCD84530537DEC326B84850A3B00C7E3B9 |
SHA-512: | 16166077CE5EFD445DBC111DA787827640C438A8F46D7B69CE72E5BD83F5BF46847B984009BFE36D985DEADB1F7F364B6B0D95B4C5C3EEC225763AF387CEA85A |
Malicious: | false |
Preview: |
File type: | |
Entropy (8bit): | 7.981226018947743 |
TrID: |
|
File name: | orderconfirmation.exe |
File size: | 3'678'161 bytes |
MD5: | 1dfda6fc13c7efab9f6148e7339ab80c |
SHA1: | d5c7e9b3bc28e876ae223f9a6dd9b4d7f6cda9fd |
SHA256: | 47a1bbb47ede2daa62558515a9a4e98410a8b2d7c9e74fe5c45783969c48be39 |
SHA512: | 36a68f46939c9ef4818368bd9c55e5bd85c9bbaa4a49040dfa208eacee375c541a4a20b5a4906c82b8c98d814fbe4e0825d968722abba7a0113eb5a7819554ac |
SSDEEP: | 49152:+pz3iNJsAL41DAd5HF9rE1CNcwpXwC4wvNys3qPbaNraNZGDniQgWHGXUTuSq:+pCsA8q/HFZEoNBpXoijL5cWmR |
TLSH: | 7406330637C9C5F2C924CA729F17EF994632F36639C44BC726968E465CE32A183437E9 |
File Content Preview: | MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...~.&L.....................................0....@..........................0.......3.......................................P............................. |
Icon Hash: | d292fcd8f2f2fe1c |
Entrypoint: | 0x411def |
Entrypoint Section: | .text |
Digitally signed: | false |
Imagebase: | 0x400000 |
Subsystem: | windows gui |
Image File Characteristics: | RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE |
DLL Characteristics: | |
Time Stamp: | 0x4C26F87E [Sun Jun 27 07:06:38 2010 UTC] |
TLS Callbacks: | |
CLR (.Net) Version: | |
OS Version Major: | 4 |
OS Version Minor: | 0 |
File Version Major: | 4 |
File Version Minor: | 0 |
Subsystem Version Major: | 4 |
Subsystem Version Minor: | 0 |
Import Hash: | b5a014d7eeb4c2042897567e1288a095 |
Instruction |
---|
push ebp |
mov ebp, esp |
push FFFFFFFFh |
push 00414C50h |
push 00411F80h |
mov eax, dword ptr fs:[00000000h] |
push eax |
mov dword ptr fs:[00000000h], esp |
sub esp, 68h |
push ebx |
push esi |
push edi |
mov dword ptr [ebp-18h], esp |
xor ebx, ebx |
mov dword ptr [ebp-04h], ebx |
push 00000002h |
call dword ptr [00413184h] |
pop ecx |
or dword ptr [00419924h], FFFFFFFFh |
or dword ptr [00419928h], FFFFFFFFh |
call dword ptr [00413188h] |
mov ecx, dword ptr [0041791Ch] |
mov dword ptr [eax], ecx |
call dword ptr [0041318Ch] |
mov ecx, dword ptr [00417918h] |
mov dword ptr [eax], ecx |
mov eax, dword ptr [00413190h] |
mov eax, dword ptr [eax] |
mov dword ptr [00419920h], eax |
call 00007F22A4B9F0A2h |
cmp dword ptr [00417710h], ebx |
jne 00007F22A4B9EF8Eh |
push 00411F78h |
call dword ptr [00413194h] |
pop ecx |
call 00007F22A4B9F074h |
push 00417048h |
push 00417044h |
call 00007F22A4B9F05Fh |
mov eax, dword ptr [00417914h] |
mov dword ptr [ebp-6Ch], eax |
lea eax, dword ptr [ebp-6Ch] |
push eax |
push dword ptr [00417910h] |
lea eax, dword ptr [ebp-64h] |
push eax |
lea eax, dword ptr [ebp-70h] |
push eax |
lea eax, dword ptr [ebp-60h] |
push eax |
call dword ptr [0041319Ch] |
push 00417040h |
push 00417000h |
call 00007F22A4B9F02Ch |
Name | Virtual Address | Virtual Size | Is in Section |
---|---|---|---|
IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_IMPORT | 0x150dc | 0xb4 | .rdata |
IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x1a000 | 0x18d04 | .rsrc |
IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_IAT | 0x13000 | 0x310 | .rdata |
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
---|---|---|---|---|---|---|---|---|---|
.text | 0x1000 | 0x11317 | 0x11400 | 797279c5ab1a163aed1f2a528f9fe3ce | False | 0.6174988677536232 | data | 6.576987441854239 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
.rdata | 0x13000 | 0x30ea | 0x3200 | 1359639b02bcb8f0a8743e6ead1c0030 | False | 0.43828125 | data | 5.549434098115495 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
.data | 0x17000 | 0x292c | 0x800 | 9415c9c8dea3245d6d73c23393e27d8e | False | 0.431640625 | data | 3.6583182363171756 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
.rsrc | 0x1a000 | 0x18d04 | 0x18e00 | 9dee09854e79aa987e5336a4defda540 | False | 0.2433358197236181 | data | 5.382874846103129 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
---|---|---|---|---|---|---|
RT_ICON | 0x1a1f0 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 1088 | Russian | Russia | 0.6781914893617021 |
RT_ICON | 0x1a658 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 4224 | Russian | Russia | 0.47068480300187615 |
RT_ICON | 0x1b700 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 9600 | Russian | Russia | 0.41161825726141077 |
RT_ICON | 0x1dca8 | 0x4228 | Device independent bitmap graphic, 64 x 128 x 32, image size 16896 | Russian | Russia | 0.3213863958431743 |
RT_ICON | 0x21ed0 | 0x10828 | Device independent bitmap graphic, 128 x 256 x 32, image size 67584 | Russian | Russia | 0.1865609842659411 |
RT_GROUP_ICON | 0x326f8 | 0x4c | data | Russian | Russia | 0.7763157894736842 |
RT_VERSION | 0x32744 | 0x350 | data | English | United States | 0.47523584905660377 |
RT_MANIFEST | 0x32a94 | 0x270 | ASCII text, with very long lines (624), with no line terminators | English | United States | 0.5144230769230769 |
DLL | Import |
---|---|
COMCTL32.dll | |
KERNEL32.dll | GetFileAttributesW, CreateDirectoryW, WriteFile, GetStdHandle, VirtualFree, GetModuleHandleW, GetProcAddress, LoadLibraryA, LockResource, LoadResource, SizeofResource, FindResourceExA, MulDiv, GlobalFree, GlobalAlloc, lstrcmpiA, GetSystemDefaultLCID, GetSystemDefaultUILanguage, GetUserDefaultUILanguage, MultiByteToWideChar, GetLocaleInfoW, lstrlenA, lstrcmpiW, GetEnvironmentVariableW, lstrcmpW, GlobalMemoryStatusEx, VirtualAlloc, WideCharToMultiByte, ExpandEnvironmentStringsW, RemoveDirectoryW, FindClose, FindNextFileW, DeleteFileW, FindFirstFileW, SetThreadLocale, GetLocalTime, GetSystemTimeAsFileTime, lstrlenW, GetTempPathW, SetEnvironmentVariableW, CloseHandle, CreateFileW, GetDriveTypeW, SetCurrentDirectoryW, GetModuleFileNameW, GetCommandLineW, GetVersionExW, CreateEventW, SetEvent, ResetEvent, InitializeCriticalSection, TerminateThread, ResumeThread, SuspendThread, IsBadReadPtr, LocalFree, lstrcpyW, FormatMessageW, GetSystemDirectoryW, DeleteCriticalSection, GetFileSize, SetFilePointer, ReadFile, SetFileTime, SetEndOfFile, EnterCriticalSection, LeaveCriticalSection, WaitForMultipleObjects, GetModuleHandleA, SystemTimeToFileTime, GetLastError, CreateThread, WaitForSingleObject, GetExitCodeThread, Sleep, SetLastError, SetFileAttributesW, GetDiskFreeSpaceExW, lstrcatW, ExitProcess, CompareFileTime, GetStartupInfoA |
USER32.dll | CharUpperW, EndDialog, DestroyWindow, KillTimer, ReleaseDC, DispatchMessageW, GetMessageW, SetTimer, CreateWindowExW, ScreenToClient, GetWindowRect, wsprintfW, GetParent, GetSystemMenu, EnableMenuItem, EnableWindow, MessageBeep, LoadIconW, LoadImageW, wvsprintfW, IsWindow, DefWindowProcW, CallWindowProcW, DrawIconEx, DialogBoxIndirectParamW, GetWindow, ClientToScreen, GetDC, DrawTextW, ShowWindow, SystemParametersInfoW, SetFocus, SetWindowLongW, GetSystemMetrics, GetClientRect, GetDlgItem, GetKeyState, MessageBoxA, wsprintfA, SetWindowTextW, GetSysColor, GetWindowTextLengthW, GetWindowTextW, GetClassNameA, GetWindowLongW, GetMenu, SetWindowPos, CopyImage, SendMessageW, GetWindowDC |
GDI32.dll | GetCurrentObject, StretchBlt, SetStretchBltMode, CreateCompatibleBitmap, SelectObject, CreateCompatibleDC, GetObjectW, GetDeviceCaps, DeleteObject, CreateFontIndirectW, DeleteDC |
SHELL32.dll | SHGetFileInfoW, SHBrowseForFolderW, SHGetPathFromIDListW, SHGetMalloc, ShellExecuteExW, SHGetSpecialFolderPathW, ShellExecuteW |
ole32.dll | CoInitialize, CreateStreamOnHGlobal, CoCreateInstance |
OLEAUT32.dll | VariantClear, OleLoadPicture, SysAllocString |
MSVCRT.dll | __set_app_type, __p__fmode, __p__commode, _adjust_fdiv, __setusermatherr, _initterm, __getmainargs, _acmdln, exit, _XcptFilter, _exit, ??1type_info@@UAE@XZ, _onexit, __dllonexit, _CxxThrowException, _beginthreadex, _EH_prolog, memset, _wcsnicmp, strncmp, malloc, memmove, _wtol, memcpy, free, memcmp, _purecall, ??2@YAPAXI@Z, ??3@YAXPAX@Z, _except_handler3, _controlfp |
Language of compilation system | Country where language is spoken | Map |
---|---|---|
Russian | Russia | |
English | United States |
Click to jump to process
Click to jump to process
Click to jump to process
Target ID: | 0 |
Start time: | 10:02:58 |
Start date: | 26/09/2024 |
Path: | C:\Users\user\Desktop\orderconfirmation.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0x400000 |
File size: | 3'678'161 bytes |
MD5 hash: | 1DFDA6FC13C7EFAB9F6148E7339AB80C |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | low |
Has exited: | true |
Target ID: | 2 |
Start time: | 10:03:00 |
Start date: | 26/09/2024 |
Path: | C:\Users\user\AppData\Local\Temp\Virtual.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff605b70000 |
File size: | 3'559'696 bytes |
MD5 hash: | C8A2DE7077F97D4BCE1A44317B49EF41 |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Antivirus matches: |
|
Reputation: | low |
Has exited: | true |
Target ID: | 3 |
Start time: | 10:03:01 |
Start date: | 26/09/2024 |
Path: | C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff6ae860000 |
File size: | 3'559'696 bytes |
MD5 hash: | C8A2DE7077F97D4BCE1A44317B49EF41 |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Antivirus matches: |
|
Reputation: | low |
Has exited: | true |
Target ID: | 4 |
Start time: | 10:03:01 |
Start date: | 26/09/2024 |
Path: | C:\Windows\SysWOW64\cmd.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0xa40000 |
File size: | 236'544 bytes |
MD5 hash: | D0FCE3AFA6AA1D58CE9FA336CC2B675B |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | true |
Target ID: | 5 |
Start time: | 10:03:01 |
Start date: | 26/09/2024 |
Path: | C:\Windows\System32\conhost.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff6ee680000 |
File size: | 862'208 bytes |
MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | true |
Target ID: | 9 |
Start time: | 10:03:21 |
Start date: | 26/09/2024 |
Path: | C:\Windows\SysWOW64\explorer.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0xd10000 |
File size: | 4'514'184 bytes |
MD5 hash: | DD6597597673F72E10C9DE7901FBA0A8 |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | moderate |
Has exited: | true |
Execution Graph
Execution Coverage: | 17.7% |
Dynamic/Decrypted Code Coverage: | 0% |
Signature Coverage: | 25.9% |
Total number of Nodes: | 1474 |
Total number of Limit Nodes: | 20 |
Graph
Function 00404FAA Relevance: 250.2, APIs: 103, Strings: 39, Instructions: 1671keyboardsynchronizationwindowCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00401626 Relevance: 22.8, APIs: 15, Instructions: 304COMMON
Control-flow Graph
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040301A Relevance: 7.5, APIs: 5, Instructions: 45COMMON
Control-flow Graph
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040118A Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00401B37 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 47timewindowCOMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00410CD0 Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 23COMMONLIBRARYCODE
Control-flow Graph
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00402844 Relevance: 6.4, APIs: 5, Instructions: 118stringCOMMON
Control-flow Graph
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040150B Relevance: 6.1, APIs: 4, Instructions: 100synchronizationthreadCOMMON
Control-flow Graph
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00401986 Relevance: 6.0, APIs: 4, Instructions: 27COMMON
Control-flow Graph
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040ADC3 Relevance: 4.5, APIs: 3, Instructions: 35COMMON
Control-flow Graph
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040C9FC Relevance: 3.2, APIs: 2, Instructions: 184COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040A62F Relevance: 3.1, APIs: 2, Instructions: 135COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040112B Relevance: 3.0, APIs: 2, Instructions: 42COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004022B0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040D9F0 Relevance: 3.0, APIs: 2, Instructions: 30COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040ECED Relevance: 3.0, APIs: 2, Instructions: 24memoryCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040E73A Relevance: 2.5, APIs: 2, Instructions: 34COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040A7DE Relevance: 1.6, APIs: 1, Instructions: 74COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040120B Relevance: 1.5, APIs: 1, Instructions: 28COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040DA56 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040DB97 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040653F Relevance: 1.5, APIs: 1, Instructions: 19COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040CC59 Relevance: 1.5, APIs: 1, Instructions: 18COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040DADC Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040DB6A Relevance: 1.5, APIs: 1, Instructions: 9timeCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040D89F Relevance: 1.3, APIs: 1, Instructions: 70COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040F42D Relevance: 1.3, APIs: 1, Instructions: 25COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00402F6C Relevance: 1.3, APIs: 1, Instructions: 17COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040D985 Relevance: 1.3, APIs: 1, Instructions: 16COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004024C4 Relevance: 1.3, APIs: 1, Instructions: 12memoryCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00401B1F Relevance: 1.3, APIs: 1, Instructions: 5COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040F3FC Relevance: 1.3, APIs: 1, Instructions: 4COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004034C1 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 290comCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00401F9D Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 150stringCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00401BDF Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 85libraryloaderCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00406D5D Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 39libraryloaderCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0041022D Relevance: .5, Instructions: 501COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0041206B Relevance: .1, Instructions: 70COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00411F91 Relevance: .1, Instructions: 70COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040D72E Relevance: .0, Instructions: 28COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00404AFF Relevance: 36.9, APIs: 14, Strings: 7, Instructions: 144fileCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00404603 Relevance: 35.2, APIs: 3, Strings: 17, Instructions: 207stringCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00402DC0 Relevance: 35.1, APIs: 16, Strings: 4, Instructions: 123windowlibrarystringCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00401DF3 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 120windowcommemoryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00403093 Relevance: 26.5, APIs: 10, Strings: 5, Instructions: 244stringCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00406A47 Relevance: 24.3, APIs: 16, Instructions: 270COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040677A Relevance: 13.5, APIs: 9, Instructions: 47windowCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00406DB2 Relevance: 12.1, APIs: 8, Instructions: 69COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040695E Relevance: 12.1, APIs: 8, Instructions: 68COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00407B33 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 102windowCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040408B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 96stringCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040755F Relevance: 10.6, APIs: 7, Instructions: 63timethreadinjectionCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00401000 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44stringCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004021ED Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39libraryloaderCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00402185 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004021B9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00402A69 Relevance: 6.1, APIs: 4, Instructions: 101COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00403F85 Relevance: 6.1, APIs: 4, Instructions: 66COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00401A85 Relevance: 6.1, APIs: 4, Instructions: 65COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00407FA5 Relevance: 6.1, APIs: 4, Instructions: 57COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004067ED Relevance: 6.1, APIs: 4, Instructions: 56COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040748A Relevance: 6.1, APIs: 4, Instructions: 55COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 004027C7 Relevance: 6.1, APIs: 4, Instructions: 53COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00403AB1 Relevance: 6.0, APIs: 4, Instructions: 41COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 0040702A Relevance: 6.0, APIs: 4, Instructions: 34windowCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 00401BA3 Relevance: 6.0, APIs: 4, Instructions: 28COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Execution Graph
Execution Coverage: | 0.2% |
Dynamic/Decrypted Code Coverage: | 0% |
Signature Coverage: | 0% |
Total number of Nodes: | 158 |
Total number of Limit Nodes: | 4 |
Graph
Function 6169119C Relevance: 9.1, APIs: 6, Instructions: 98threadCOMMON
Control-flow Graph
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616D8E68 Relevance: 4.5, APIs: 3, Instructions: 20memoryCOMMON
Control-flow Graph
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616D9988 Relevance: 3.0, APIs: 2, Instructions: 46memoryCOMMONLIBRARYCODE
Control-flow Graph
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 61691A54 Relevance: 2.6, APIs: 2, Instructions: 77COMMON
Control-flow Graph
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6168D73C Relevance: 121.1, APIs: 51, Strings: 18, Instructions: 383libraryloaderCOMMONLIBRARYCODE
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616983E8 Relevance: 51.0, APIs: 28, Strings: 1, Instructions: 282timeCOMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 61697B1C Relevance: 51.0, APIs: 28, Strings: 1, Instructions: 282timeCOMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616968D8 Relevance: 49.3, APIs: 27, Strings: 1, Instructions: 328timeCOMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 61695EE8 Relevance: 49.3, APIs: 27, Strings: 1, Instructions: 328timeCOMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616A0288 Relevance: 47.7, APIs: 22, Strings: 5, Instructions: 423processCOMMON
Control-flow Graph
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616A4D40 Relevance: 46.0, APIs: 21, Strings: 5, Instructions: 456processCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616DCBA0 Relevance: 44.2, APIs: 24, Strings: 1, Instructions: 465COMMONLIBRARYCODE
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616944A8 Relevance: 42.3, APIs: 28, Instructions: 349fileCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 61693F10 Relevance: 42.3, APIs: 28, Instructions: 348fileCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6169A1F0 Relevance: 40.6, APIs: 20, Strings: 3, Instructions: 398COMMONLIBRARYCODE
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6169BE1C Relevance: 37.1, APIs: 20, Strings: 1, Instructions: 385COMMONLIBRARYCODE
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616799E0 Relevance: 33.6, APIs: 16, Strings: 3, Instructions: 316libraryloaderCOMMONLIBRARYCODE
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 61699AAC Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 225COMMONLIBRARYCODE
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616DECC8 Relevance: 18.1, APIs: 12, Instructions: 115memoryfileCOMMONLIBRARYCODE
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616EDF5C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 201COMMONLIBRARYCODE
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6169A92C Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 373COMMONLIBRARYCODE
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 61698CF8 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 369COMMONLIBRARYCODE
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6169B7C4 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 177COMMONLIBRARYCODE
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 61690DCC Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 159fileCOMMONLIBRARYCODE
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616A8E10 Relevance: 15.3, APIs: 10, Instructions: 292timeCOMMONLIBRARYCODE
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616EE2B8 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 288COMMONLIBRARYCODE
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6168C894 Relevance: 12.2, APIs: 8, Instructions: 196COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616A84BC Relevance: 9.2, APIs: 6, Instructions: 222COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616A9C74 Relevance: 9.2, APIs: 6, Instructions: 216COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616A7AF4 Relevance: 9.2, APIs: 6, Instructions: 211COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616AA77C Relevance: 9.2, APIs: 6, Instructions: 194COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616AAE9C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 227COMMONLIBRARYCODE
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Control-flow Graph
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616E1450 Relevance: 38.6, APIs: 16, Strings: 6, Instructions: 136libraryloaderCOMMONLIBRARYCODE
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6169DB48 Relevance: 28.2, APIs: 3, Strings: 13, Instructions: 205COMMONLIBRARYCODE
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616DACA0 Relevance: 27.2, APIs: 18, Instructions: 239COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616DB424 Relevance: 27.2, APIs: 18, Instructions: 238COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616DB06C Relevance: 27.2, APIs: 18, Instructions: 236COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616D9F0C Relevance: 27.2, APIs: 18, Instructions: 235COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616896BC Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 50libraryloaderCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6168DF50 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 108threadCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616DD6BC Relevance: 19.7, APIs: 13, Instructions: 183COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 61679638 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 113memorylibraryloaderCOMMONLIBRARYCODE
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6169AEC8 Relevance: 18.2, APIs: 12, Instructions: 193processsynchronizationCOMMONLIBRARYCODE
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616991D4 Relevance: 18.2, APIs: 12, Instructions: 192processsynchronizationCOMMONLIBRARYCODE
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6177E554 Relevance: 17.9, APIs: 8, Strings: 2, Instructions: 408stringCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6169757C Relevance: 16.6, APIs: 11, Instructions: 87COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616959CC Relevance: 16.6, APIs: 11, Instructions: 83COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616798E0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 58libraryloaderCOMMONLIBRARYCODE
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616E40C0 Relevance: 15.2, APIs: 10, Instructions: 206COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6167370C Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 244timeCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616A4A64 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 209COMMONLIBRARYCODE
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6178A748 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 171stringCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 61766528 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 76stringCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 61679394 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 73libraryloaderCOMMONLIBRARYCODE
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6167EF58 Relevance: 13.7, APIs: 9, Instructions: 171memoryCOMMONLIBRARYCODE
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616A87A0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 91timeCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616A89F0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 83timeCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6169A870 Relevance: 12.0, APIs: 8, Instructions: 50synchronizationCOMMONLIBRARYCODE
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6168AEA0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 220threadmemoryCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6169FCB0 Relevance: 10.7, APIs: 7, Instructions: 174COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616882A8 Relevance: 10.6, APIs: 7, Instructions: 146synchronizationCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6168BCB8 Relevance: 10.6, APIs: 7, Instructions: 126COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6168A02C Relevance: 10.6, APIs: 7, Instructions: 119sleepsynchronizationCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 61763108 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 90stringCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6169ED58 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86COMMONLIBRARYCODE
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616A88D8 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 83timeCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616A8B10 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 75timeCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616DD458 Relevance: 10.6, APIs: 7, Instructions: 63COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6168E9C4 Relevance: 9.2, APIs: 6, Instructions: 178memoryCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 61787340 Relevance: 9.2, APIs: 6, Instructions: 158COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6168D228 Relevance: 9.1, APIs: 6, Instructions: 135synchronizationsleepCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616B4320 Relevance: 9.1, APIs: 6, Instructions: 118COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6169E6DC Relevance: 9.1, APIs: 6, Instructions: 92COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6167A2FC Relevance: 9.1, APIs: 6, Instructions: 74COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6168E2CC Relevance: 9.1, APIs: 6, Instructions: 74librarythreadCOMMONLIBRARYCODE
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6169DF14 Relevance: 9.1, APIs: 6, Instructions: 52COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6167541C Relevance: 9.0, APIs: 6, Instructions: 48threadCOMMONLIBRARYCODE
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 61692064 Relevance: 9.0, APIs: 6, Instructions: 37threadCOMMONLIBRARYCODE
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 61697500 Relevance: 9.0, APIs: 6, Instructions: 36COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6169548C Relevance: 9.0, APIs: 6, Instructions: 36COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 61763250 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 124stringCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 617875C8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120fileCOMMONLIBRARYCODE
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 61683C0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93threadCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616897AC Relevance: 8.8, APIs: 7, Instructions: 77COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616F7850 Relevance: 7.7, APIs: 5, Instructions: 159COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 61681268 Relevance: 7.6, APIs: 5, Instructions: 142COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 61674BF4 Relevance: 7.6, APIs: 5, Instructions: 131threadCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616A4608 Relevance: 7.6, APIs: 5, Instructions: 128COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6169E17C Relevance: 7.6, APIs: 5, Instructions: 123COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6168ACA0 Relevance: 7.6, APIs: 5, Instructions: 90synchronizationthreadCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 617892B0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6176719C Relevance: 7.6, APIs: 5, Instructions: 84COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 61684AE4 Relevance: 7.6, APIs: 5, Instructions: 83COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 61689D9C Relevance: 7.6, APIs: 5, Instructions: 81COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6178A524 Relevance: 7.5, APIs: 5, Instructions: 46stringCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 61797584 Relevance: 7.5, APIs: 5, Instructions: 39timethreadCOMMONLIBRARYCODE
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 617893EC Relevance: 7.5, APIs: 5, Instructions: 28COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6179C284 Relevance: 7.5, APIs: 5, Instructions: 26COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 617934A8 Relevance: 7.5, APIs: 5, Instructions: 26COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616A72C4 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 226COMMONLIBRARYCODE
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6167F8CC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 127COMMONLIBRARYCODE
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6168E430 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90threadCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616EE934 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMONLIBRARYCODE
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616CC354 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 79COMMONLIBRARYCODE
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6167F2B8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26COMMONLIBRARYCODE
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 61690904 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17libraryloaderCOMMONLIBRARYCODE
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6175E388 Relevance: 6.3, APIs: 5, Instructions: 80COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 61676D50 Relevance: 6.3, APIs: 4, Instructions: 327synchronizationthreadCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6168C2C8 Relevance: 6.2, APIs: 4, Instructions: 208sleepCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616B0694 Relevance: 6.2, APIs: 4, Instructions: 195COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6167DC7C Relevance: 6.2, APIs: 4, Instructions: 153COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6169F90C Relevance: 6.1, APIs: 4, Instructions: 124COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 61682484 Relevance: 6.1, APIs: 4, Instructions: 110COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6169FFF8 Relevance: 6.1, APIs: 4, Instructions: 102COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616A0BBC Relevance: 6.1, APIs: 4, Instructions: 101COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6168A9D4 Relevance: 6.1, APIs: 4, Instructions: 91COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6169CDF0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616AD634 Relevance: 6.1, APIs: 4, Instructions: 82COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616A11C4 Relevance: 6.1, APIs: 4, Instructions: 75COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 617615FC Relevance: 6.1, APIs: 4, Instructions: 74COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 61761700 Relevance: 6.1, APIs: 4, Instructions: 74COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616804A8 Relevance: 6.1, APIs: 4, Instructions: 67COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6178876C Relevance: 6.1, APIs: 4, Instructions: 67COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6169FF3C Relevance: 6.1, APIs: 4, Instructions: 59COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 61755340 Relevance: 6.1, APIs: 4, Instructions: 55COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6169DFE0 Relevance: 6.0, APIs: 4, Instructions: 45COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6167F7CC Relevance: 6.0, APIs: 4, Instructions: 39memoryCOMMONLIBRARYCODE
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 61765784 Relevance: 6.0, APIs: 4, Instructions: 36COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6168AB9C Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 22COMMONLIBRARYCODE
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 61674E14 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96threadCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616A4144 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 86COMMONLIBRARYCODE
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616A3A40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMONLIBRARYCODE
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616A3E18 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMONLIBRARYCODE
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 61675A68 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64synchronizationCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616A3950 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMONLIBRARYCODE
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 61675B60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54memoryCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616D8DBC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMONLIBRARYCODE
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616A1C8C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 61689468 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42timeCOMMONLIBRARYCODE
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 616A38E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
Function 6168F670 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMONLIBRARYCODE
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Similarity |
|